Certifications and audits reassure customers and regulators, and they're often required to win business. But being compliant and being secure aren't the same thing. Attackers don't check your certificates before they attack.
What the common frameworks are
- ISO/IEC 27001: an international standard for running an information security management system — the policies, risk assessments and controls that govern security.
- SOC 2: an independent auditor's report on how a service organization protects customer data, common for software and cloud providers.
- PCI DSS: mandatory security requirements for organizations that store, process or transmit payment card data.
- Privacy laws such as Alberta's PIPA and the federal PIPEDA, which require reasonable safeguards for personal information.
Why compliance isn't enough
- It's a point in time. An audit shows what was true on the day it happened. Configurations drift, staff change and new vulnerabilities appear the next morning.
- It sets a minimum. Frameworks describe baseline expectations, not everything a determined attacker will try.
- Scope can be narrow. A certification may cover one system or process, not your whole organization.
Why compliance still matters
Frameworks give structure, a common language with customers, and a checklist of controls that genuinely reduce risk. The goal isn't to choose between compliance and security — it's to use compliance as the floor, not the ceiling.
How to get both
- Map your controls once, then reuse the evidence across frameworks.
- Monitor continuously rather than scrambling before each audit.
- Test your defences the way an attacker would, beyond the audit checklist.
- Treat audit findings as a starting point for improvement.
Questions to ask your team
- What exactly is in scope for our certification — and what isn't?
- How do we know controls still work between audits?
- When were we last tested by someone thinking like an attacker, not an auditor?