Resource / Decision guide
Choose the assurance
path that fits.
The right starting point is the customer’s requirement and the decision you need to unlock—not a framework chosen in isolation.
A simple sequence
Ask what the buyer
will actually accept.
What decision must this support?
Is the goal a single questionnaire, a tender requirement, a procurement review, or a broader assurance objective?
Which form of evidence is requested?
Separate a policy request, a certificate, an attestation, and an independent report. They carry different expectations.
What scope can the team sustain?
Consider the services, systems, locations, suppliers, and operating routines that would need to remain in scope.
Who provides independent assurance?
Readiness support can organise the work. Certification and eligible reports come from independent bodies.
ISO 27001 is a management-system certification route. SOC 2 is an independent report against applicable trust services criteria. Cyber Essentials is a UK scheme with its own requirements. Applicability depends on the buyer, scope, and jurisdiction.