← Back to news 18.10.2026 Series: Basic terms, part 8

An attestation is not a certificate

Basic terms, part 8: The supplier questionnaire says "ISO 27001 certified", "C5 attestation", "BSI-tested" or "accredited". Four answers that sound alike and mean different things. Who checks, who checks the checker, and what ends up on paper: certification, accreditation and attestation, with the passages from EU law, the BSI Act and the BSI's C5.

Twenty suppliers have returned the questionnaire. For the question about proof of information security, the answers say "ISO 27001 certified", "C5 attestation", "BSI-tested" and once "accredited". All four get the same tick in the evaluation. Yet they mean different things, and one of them does not fit the question at all.

Certification: a body confirms that requirements are met

EU law groups certification under the umbrella term conformity assessment. Regulation (EC) No 765/2008 defines it in Article 2(12) as

"the process demonstrating whether specified requirements relating to a product, process, service, system, person or body have been fulfilled"

Whoever does this is, under point 13, a conformity assessment body, one that performs activities "including calibration, testing, certification and inspection". For ISO/IEC 27001, a certification body assesses an organisation's management system for a defined scope and, if successful, issues a certificate with a period of validity. The BSI can also certify itself: under Section 52(1) of the BSI Act, it is the national certification body of the federal administration for IT security. This is where ISO 27001 certification on the basis of IT-Grundschutz takes place, for example.

The decisive detail on a certificate is therefore not the logo but the scope. A certificate for the data centre in Frankfurt says nothing about software development in Lisbon.

Accreditation: someone checks the checker

How do you know the certification body itself is any good? That is what accreditation is for. Article 2(10) of the same regulation defines it as

"an attestation by a national accreditation body that a conformity assessment body meets the requirements set by harmonised standards and, where applicable, any additional requirements including those set out in relevant sectoral schemes, to carry out a specific conformity assessment activity"

And Article 4(1): "Each Member State shall appoint a single national accreditation body." In Germany, that is the Deutsche Akkreditierungsstelle (DAkkS). So it is the checkers that are accredited, not the organisations they check. A supplier who gives "accredited" as proof of its information security is answering a different question, unless it is a testing laboratory itself. The right follow-up question for a certificate is: is the body that issued it accredited for exactly this standard?

Attestation: an auditor confirms a statement

For C5, the BSI's criteria catalogue for cloud services, there is no certificate. The BSI describes the route like this, in German: „Die Erfüllung der Kriterien kann dann durch Wirtschaftsprüfer testiert und somit gegenüber Kunden nachgewiesen werden.“ Fulfilment of the criteria can be attested by auditors and so demonstrated to customers. The result is an attestation with an audit report. Depending on the type of engagement, the auditors examine whether the criteria are currently met or also whether they were met throughout a past period: a point in time or a period.

And one sentence on the BSI's page should be in every supplier assessment:

„Das BSI ist bei der Auswahl der Auditoren sowie der eigentlichen Prüfung nicht involviert und wertet die Prüfberichte auch nicht aus.“

In short: the BSI is not involved in selecting the auditors or in the audit itself, and does not evaluate the reports. A C5 attestation is therefore not "tested by the BSI". It is a report against a BSI catalogue, and the customer has to read it. The BSI explicitly recommends requesting and evaluating the audit report initially and then annually. The catalogue is now available in a new version, C5:2026.

Three questions for any proof

Who checked? An accredited certification body, the BSI, an auditor, or the supplier itself?
Against what, and for what? Which standard or catalogue, and which scope: the whole company or the one service you use?
For which point in time? A reference date, a period, and is the certificate or report still current?

Certificates, attestations and accreditation are all valuable. They just should not get the same tick in the evaluation. That is why, where supplier evidence is kept in isidaten, the document is stored together with who issued it, for which scope and how long it is valid.