Use "aligned with" when you have mapped your practices to a framework, "compliant" only when you have assessed yourself against stated requirements and can show it, "attested" when an independent CPA has issued a report, and "certified" only when an accredited body has issued a certificate. Picking the wrong word is the most common overclaim.
Why the word matters
Buyers read these words as shorthand for how much work someone independent has verified. If your wording sounds like an independent party signed off, and none did, the gap shows up in diligence, and it damages trust in every other answer you gave.
The AICPA describes SOC as a suite of service offerings that CPAs may provide in connection with system level controls of a service organization. In other words, a SOC report is produced by a CPA. It is not a certificate you hold by deciding to follow a framework. In 2026 the AICPA has also published material about the credibility risks of quick turn SOC engagements, which is a reminder that buyers are reading these reports with care.
The wording ladder
| Word | What it should mean | Evidence you need |
|---|---|---|
| Informed by | You read it and borrowed ideas | None required, but do not stretch it |
| Aligned with | You mapped your practices to it | A mapping document with dates |
| Self assessed against | You reviewed yourself against the requirements | The assessment, owner and date |
| Attested | An independent CPA issued a report | The report, scope and period |
| Certified | An accredited body issued a certificate | The certificate, scope and expiry |
Common slips
- "We are SOC 2 compliant." SOC 2 is a report, not a state you are in. Say what exists: a report for a stated period, or an audit in progress.
- "We are ISO certified" when you have only built an internal programme. A certificate has a scope and an issuing body.
- "FedRAMP ready" or "NIST compliant" without a named baseline and date.
- "Our vendor is certified, so we are." Inherited controls are real, but your certificate is not their certificate.
How to say it when you are partway there
State the true stage and the date. For example: "We are working toward an independent audit. Our practices are mapped to the relevant criteria, and the mapping is available on request." That is specific, checkable and honest. Avoid phrases like "essentially compliant" or "equivalent to".
Process to keep wording safe
- Keep a claims register: every external claim, the evidence behind it, the owner and the review date.
- Require the register entry before any new claim goes into a deck, a website or a questionnaire.
- Have one named approver for external security claims.
- Review the register after every audit milestone, and delete or change claims that are no longer true.
- Train sales to use the approved wording and to hand off anything outside it.
This is operational advice, not legal advice. If a claim might carry contractual weight, have your counsel review it.
Where Safeguard fits
Safeguard's compliance and evidence automation can keep the evidence, owner and review date for each claim in one place, so the wording you publish tracks what you can show. A free scan is available at https://gold.safeguard.sh/scan.
Quick check
Can we say aligned with a framework if we only read it?
Say informed by. Aligned should mean you mapped your practices to it and can show the mapping.
Who should approve external security claims?
One named person, usually security or compliance, with legal consulted when the claim could be contractual.
Sources
Last reviewed: 19 October 2026.
