Compliance badges
What you may display after an audit, and how
A badge is a claim. Here is which ones you can make for each framework, who owns the mark, and how to make it verifiable.
SOC 2
SOC 2 ends in a report from an independent CPA firm, not a certificate. The AICPA owns the SOC logos and publishes the terms for using them. Check those terms, and ask your audit firm, before putting a SOC logo on your site.
Say which report you have, Type I or Type II, and the period it covers. Buyers will ask.
ISO 27001
ISO does not certify anyone and does not allow its own logo to be used to show certification. Your accredited certification body issues the certificate and its own certification mark, with rules for how you may display it. Use their mark, follow their rules, and name the body.
HIPAA
There is no official HIPAA certification, and the US Department of Health and Human Services does not endorse or certify companies. A "HIPAA compliant" badge is a self-declaration. If you show one, be ready to explain what it is based on, such as a third-party assessment.
GDPR
Article 42 of the GDPR allows approved certification schemes, but a generic "GDPR compliant" badge is a self-declaration. If you hold a certification under an approved scheme, name the scheme and the body that awarded it.
PCI DSS
PCI DSS compliance is validated, not certified. The PCI Security Standards Council restricts the use of its marks. Say what was validated, at which level, by whom, and when.
Show status buyers can verify
A badge on its own cannot be checked. Link it to a trust page that shows the report or certificate date, its scope, and how to request it. Never show a badge for an audit that is still in progress.
Find out what your compliance program actually looks like
Thirty minutes, your real systems, no slideware. We'll show you what we'd automate first, and what you don't need us for.