What certificates actually prove

A certificate proves that a management system was audited. It does not prove that an environment holds up in an actual incident. That's decided by the operation behind it.

We work with companies holding a valid ISO 27001 certificate whose implementation falls short of the minimum. That's not a contradiction: the certificate checks whether rules, responsibilities and documents exist. How well the measures actually work day to day, it checks only to a limited extent.

Certificates have their value. They make providers comparable, satisfy requirements from customers and tenders, and the path to one creates order. If you need one, we'll get you there.

But when your customer, your insurer or a regulator wants to know whether you'd survive an attack, the certificate alone isn't enough. What counts then are measures actually implemented, and evidence that they work.