What is attestation?
In governance and compliance, an attestation is a formal, signed statement that something is true: that a set of controls is in place, that a review was carried out, or that an organization met a standard during a stated period. The person or firm that signs it takes responsibility for the claim, which is what gives an attestation value as evidence. A false attestation is a violation in itself, and in some cases a crime.
Self-attestation vs. third-party attestation
A self-attestation comes from inside the organization making the claim. A manager certifies each quarter that she reviewed her team's access, a vendor's officer confirms every year that the company meets the contract's security schedule, or a software producer selling to U.S. federal agencies signs a CISA form declaring that its development process meets practices drawn from the NIST Secure Software Development Framework. A third-party attestation comes from an independent assessor who has tested the claim, such as a CPA firm issuing a SOC 2 report. Independent attestations carry more weight because the signer has no stake in the result, but a self-attestation still creates accountability, since the signer can face contractual, regulatory or fraud consequences if it is false.
Common attestations in security
- SOC reports: examinations performed by CPA firms under the AICPA's attestation standards, in which the auditor gives an opinion on management's description of its system and on whether the controls were suitably designed and, in a Type II report, operated effectively.
- PCI DSS Attestation of Compliance (AOC): the signed summary of a PCI DSS assessment that merchants and service providers give to their acquiring banks and customers.
- Sarbanes-Oxley certifications: U.S. public company CEOs and CFOs certify each periodic financial report and their responsibility for internal controls, and at larger companies an external auditor also attests to management's assessment of internal control over financial reporting.
- Penetration test letters: a short letter of attestation from the testing firm confirming that a test took place, with its scope and dates, for customers who should not see the full report.
- Access review attestations: recurring sign-offs by managers or system owners that every account and permission they reviewed is still needed.
Attestation vs. acknowledgement
The two records often appear together in compliance monitoring and are easy to mix up. An acknowledgement confirms that a person received and understood a policy and will follow it, such as a new hire accepting the acceptable use policy. An attestation confirms that something was done or is true, such as an application owner signing that the quarterly access review is complete and that 14 stale accounts were removed. In short, people acknowledge rules and attest to facts.
Attestation vs. assertion, audit and certification
In an audit, an assertion is management's claim, and an attestation engagement is the auditor's work to test that claim and report on it. An audit more broadly evaluates an organization against criteria and may or may not end in an attestation. A certification, such as ISO/IEC 27001, is issued by an accredited body after it finds that a management system conforms to a standard.
Device attestation is a different meaning
In hardware and identity, attestation has a separate, technical sense: a device proves its state or model cryptographically. A TPM can report signed measurements of the boot process to a remote verifier, a FIDO2 authenticator can prove its make and model when a passkey is registered, and mobile platforms use attestation checks to tell a management system whether a phone has been tampered with. Scenario context tells you which meaning is intended.
Attestation on the CompTIA Security+ exam
SY0-801 places attestation in compliance monitoring under objective 5.4, paired with acknowledgement, and it appears again in objective 5.3, where vendors supply compliance attestations as part of ongoing vendor monitoring. Objective 5.5 adds the audit side: management's assertion is the claim an attestation engagement tests. Wording such as "formally certifies that the controls were reviewed" or "signed statement of compliance" points to attestation, while "confirms they have read and understood the policy" points to acknowledgement. Other distractors are a right-to-audit clause, which lets you collect evidence yourself, and a certification, which comes from an accredited certification body.