Attestation
What is Attestation?
A formal declaration by an independent party (such as a CPA firm) that an organisation's controls or processes meet specified criteria. SOC reports are a form of attestation, distinct from certification.
Terms that appear alongside attestation
Each of these is named in at least one of the same controls as attestation. The number is how many controls name both.
- nist 18 shared controls
- compliance 16 shared controls
- integrity 15 shared controls
- audit 13 shared controls
- authentication 11 shared controls
- iso 27001 11 shared controls
- soc 2 11 shared controls
- cybersecurity 10 shared controls
Frameworks that govern attestation
What the standards actually require on attestation
Requirements naming attestation across 6 standards, quoted from the control text.
Applicable interpretive publications are considered in planning and performing the engagement.
ssae-18-attestation-standards-soc-reporting::105.23 · AT-C 105.23 Conduct of an Attestation Engagement in Accordance With the Attestation Standards →The SCS must issue a source VSA stating the Source level of any revision at Level 1 or above, and anyone authorised to access a revision must be able to fetch its VSA; a revision with no VSA is Source Level 0.
slsa::SS.4 · Source verification summary attestations (Source L1 to L4) →Enterprise attestation per WebAuthn L3 6.5.4 + CTAP2.1. Standard attestation is ANONYMOUS per AAGUID batch (so individual authenticators are not identifiable) to protect privacy. ENTERPRISE ATTESTATION carries the AUTHENTICATOR-UNIQUE IDENTIFIER (e.g.
FIDO2-Enterprise-Attestation · Enterprise Attestation and AAGUID Allowlisting →Sets the Annex V requirements for qualified electronic attestations of attributes (incl. verification of the attributes' accuracy and binding to the subject), and provides for their use in public services (Art 45c).
EIDAS-Art.45d · Requirements for qualified electronic attestation of attributes →Submit a signed annual attestation for the previous financial year to NSW GovAI within Digital NSW by 31 October each year, first due 31 October 2027, using the approved template with its evidence requirements, endorsed by the Accountable Official and approved...
nsw-ai-operational-policy-2026::7.2 · 7.2 Submit the signed annual attestation →The attestation report and Item 1506 disclosures go in the filing that contains the emissions to which they relate; where the emissions are deferred to the second-quarter Form 10-Q or an amended 10-K or 20-F, the annual report must state that the attestation r...
sec-climate-disclosure-rule::1506(f) · Item 1506(f), Item 601(b)(27) and Rule 436(i): location of the attestation and the provider's letter →Questions people ask about attestation
What is Attestation?
Why is Attestation important for compliance?
Which compliance frameworks address Attestation?
Where can I learn more about Attestation?
See how Attestation applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.