Certification vs Compliance

Why they differ

Compliance means following the rules; certification is an outside body's formal statement that a standard is met at a point in time.

Certification

Compliance & regulation

Formal proof from an approved outside body that an organisation's security meets a published standard such as ISO 27001.

Formal

A certificate issued by an officially approved certification body after an outside audit in two stages shows that an ISMS meets every requirement of ISO 27001; it runs for three years, kept alive by yearly follow-up audits. ISO 27002 is guidance only and cannot be certified against.

In plain English

Like a driving test - you may already drive carefully, but only the examiner's pass gives you a licence that strangers will trust.

In practice

Several municipalities require ISO 27001 certification in a tender for hosting their case systems, so a Danish hosting company books a certification body, passes both audit stages and attaches the certificate to its bid.

Why it matters

Customers cannot inspect every supplier themselves, so they rely on the certificate - but it proves that a working system exists, not that a breach cannot happen.

Compliance

Fundamentals

Living up to the laws, rules and standards that apply - for example NIS2, GDPR or ISO 27001.

Formal

The state of meeting the requirements set by laws, contracts, standards and the organisation's own policies, and being able to show proof that they are met.

In plain English

Like a car passing its road-worthiness check - it proves the car meets the rules, but not that it is driven safely.

In practice

Before the yearly audit, the compliance officer at a Danish pension fund gathers proof that backups have been test-restored and that every employee has completed the required security training.

Why it matters

Failing to comply can mean fines, lost customers and personal liability for managers - and requirements often force needed work that would otherwise be put off.

Shared connections

Audit ISO 27001