The Business of Trust
Lara B. — Building Cyberr
How certification became a requirement for doing business, and whether we know what we are actually buying
There is a strange thing about certification.
ISO standards are voluntary. Certification is performed by independent certification bodies, not by ISO itself. ISO also acknowledges that certification can become a legal or contractual requirement in some industries.
That distinction sounds clear on paper. In business, it gets blurry.
A customer asks for the certificate. Procurement puts it on the checklist. The competitor has one. The tender requires one. The supplier gets certified.
The decision starts looking less like a choice and more like the cost of staying in the market. That would be fine if we knew exactly what we were buying.
We spend money on certification because it is supposed to tell the market something. That a company is secure. Well organised. Reliable. Serious about risk.
The question is how much of that value comes from the certification itself.
And how much comes from the fact that everyone has agreed to ask for one.
A very big business
Certification is no longer a niche compliance exercise.
In 2024, there were 96,709 valid ISO/IEC 27001 certificates worldwide, covering 179,877 certified sites. That is almost twice the 48,671 certificates recorded in 2023.
Across the major ISO management standards, the numbers become enormous. ISO 9001 accounted for 1,474,118 certificates. ISO 14001 had 676,232. ISO 45001 had 542,527. ISO 27001 had 96,709.
Behind those certificates is an industry.
Consultants prepare companies for certification. Software companies sell platforms to manage compliance. Training companies teach employees what they need to know. Certification bodies audit organisations and issue certificates. Surveillance audits follow. Recertification follows again.
The payment is recurring.
SGS, one of the world's largest testing, inspection and certification companies, reported CHF 761 million in 2024 sales from its Certification business. Adjusted operating income was CHF 153 million, a 20.1% operating margin. Its Testing & Inspection business had a 14.7% margin.
Certification is profitable.
There is nothing wrong with that.
But profitable industries deserve the same question as every other industry:
What is the customer actually getting?
What are we buying?
ISO 27001 is not a cybersecurity product.
It is a standard for an information security management system. Certification provides written assurance from an independent body that an organisation's system meets specified requirements. ISO itself does not issue the certificate.
That distinction matters.
Certification can force a company to take security seriously. It can expose missing processes, unclear ownership and weak controls. It can make an organisation document what it does instead of relying on tribal knowledge.
For some companies, that is valuable.
A badly organised company can become much better organised through the process.
But there is another reason companies buy certification.
Customers ask for it.
Imagine a software company with 50 employees. Its security is reasonable. Its engineers understand access control. Its backups work. Its incident response process exists. Its customers have never had a problem.
Then a large customer enters procurement.
“Are you ISO 27001 certified?” No.
The deal stops.
The company now has a business decision. Spend money on certification or lose the customer.
The certificate has become market access.
That is a perfectly rational reason to buy it. It is simply a different reason from becoming more secure.
Voluntary, in theory
Nobody is standing at the door forcing companies to get certified.
The market does something more efficient.
Customers ask for the certificate.
Procurement departments use it to reduce the number of suppliers they need to investigate themselves. Large companies use standardised requirements because they cannot manually audit every vendor. Suppliers comply because they want the business.
The cycle reinforces itself.
More customers ask for certification.
More suppliers get certified.
The certificate becomes normal.
Then not having one becomes abnormal.
At some point, the question is no longer:
“Does this certification create enough value for us?”
It becomes:
“Can we afford not to have it?”
That is how FOMO becomes an economic mechanism.
Nobody has to say you must buy it.
They only have to make sure everyone you want to sell to expects you to have it.
The box
Procurement loves boxes.
Certified? Yes.
ISO 27001? Yes.
Current certificate? Yes.
Move to the next question.
The box is useful. It saves time. It creates a common language between buyers and suppliers.
But a box is also an extraordinary compression of information.
A certificate does not tell a customer everything about the security of a company.
It tells them that an organisation has been assessed against a defined standard, within a defined scope, by a certification body.
The scope matters.
A certification covers the activities and locations defined within that certification. It does not magically cover everything the company does.
Yet in procurement, “ISO 27001 certified” can become a much larger statement than the certificate actually makes.
That is where trust starts to become perception.
The grey market
There is another market hiding behind the formal one.
Not fake certificates. Something more ordinary. Compliance theatre.
A company knows an audit is coming. Policies are cleaned up. Evidence is collected. Processes are documented. Employees are reminded what they need to do. Gaps are closed.
The audit happens. The certificate arrives. Then the business goes back to normal.
This does not require dishonest auditors or dishonest companies.
It is a natural response to incentives.
If the market rewards the certificate, companies will optimise for obtaining the certificate.
The danger comes when the audit becomes the event and security becomes the background.
A beautifully documented control that nobody follows is still a beautiful document.
The real test begins after the auditor leaves.
Then the company gets breached
This is where the conversation becomes uncomfortable. A certified company can still be hacked.
ISO 27001 never promised immunity from cyberattacks.
But the existence of a breach raises an obvious question.
What did the certification actually tell the customer?
There is evidence that certification can have real value. Research on 143 US-listed companies found ISO/IEC 27001 certification was associated with improvements in profitability, labour productivity and, to a lesser extent, sales performance.
There is also research suggesting certification can affect how investors react when something goes wrong. One study found that ISO 27001 certification was associated with less negative investor reaction following cybersecurity breaches.
That matters. It suggests the certificate has value even when the company fails to prevent an incident.
But notice what kind of value this evidence measures. Financial performance. Investor perception.
That is not the same as proving that certification prevented the breach. A certificate can be valuable because people believe it signals good security.
That belief can have a measurable financial effect.
It still leaves a much harder question unanswered.
Did the certificate make the company more secure?
The value nobody puts on the invoice
There are at least three things a company may be buying when it pays for certification.
Security.
Better controls. Better processes. Better risk management.
Trust.
An independent signal that makes customers more comfortable doing business with you.
Revenue.
Access to customers and tenders that would otherwise be unavailable.
All three can be legitimate.
The problem is that they are rarely separated.
A company may spend €20,000, €50,000 or considerably more on certification and never calculate which of those three things generated the return.
Did the certificate prevent an incident?
Did it improve security?
Did it save 500 hours of customer due diligence?
Did it unlock €1 million in revenue?
Did it simply stop procurement from rejecting the company?
These are very different returns on investment.
Yet the market tends to treat them as one thing.
Certified.
Not certified.
Tick the box.
And what happens when it goes wrong?
This may be the most revealing part of the whole system.
A company has the certificate. The logo is on the website. Procurement is satisfied.The customer is reassured.
Then the company gets breached.
The certificate does not mean the breach was impossible. It was never supposed to.
But what happens to the trust that the certificate created?
Does the customer look at the certificate differently?
Does anyone ask whether the controls that were audited actually worked?
Does the certification body examine what happened?
Does the customer demand more evidence?
Or does the organisation simply report the incident, fix the problem and continue to display the certificate?
The answer matters because certification is not only a technical exercise.
It is a trust mechanism.
The customer is outsourcing part of its judgement to the certificate.
That is the whole point.
So what is a certificate worth?
The certification industry has become very good at measuring conformity.
It can tell us how many certificates exist. Where they are. Which standards they cover. Which certification bodies issued them. Whether they are valid.
What it is harder to see is the number that should matter most to the buyer:
What changed?
Are certified companies more secure?
Do they suffer fewer incidents?
Do they recover faster?
Are their customers actually safer?
Are their organisations better managed?
Do they win more business?
Does certification reduce the cost of customer due diligence?
Does it create enough value to justify the cost?
The answer may be different for every company.
That is precisely why the question matters.
Certification may be extremely valuable. It may improve security. It may improve management. It may reduce friction in procurement. It may create trust. It may generate revenue.
It can do all of those things.
But once certification becomes a condition of doing business, we stop asking the question we would normally ask about any other business expense:
What is the return?
We have built a large and increasingly sophisticated market around proving that organisations can be trusted.
The certificates have grown.
The industry has grown.
The procurement requirements have grown.
Perhaps the scrutiny should grow with them.
Because there is a simple question sitting underneath the entire business of certification:
When a company shows you its certificate, what exactly have you learned about the company that you did not know before?
And when that company gets breached six months later, the question becomes harder still.
Did we buy security, did we buy trust, did we buy revenue, or did we simply buy the right to tick the box?
Sources
ISO, Certification and ISO/IEC 27001 Information Security Management Systems
ISO Survey 2024
SGS, 2024 Integrated Report
Research on ISO/IEC 27001 certification and firm performance
Research on ISO/IEC 27001 certification and investor reaction to cybersecurity breaches
10 reactions · 3 comments
Comments
Kamran M.: Just WOW!!! a great write up , loved readinhg it so to the point and insightful.
Luis P.: Lara, perhaps the answer to “What changed?” is surprisingly simple: For the provider: “permission” to provide. For the customer: an “insurance policy.” For security: more needs. And perhaps that is exactly the problem.
Lara B.: Kamran Mirza thanks!