Compliance attestation vs verification: what each proves

Three words that get used as one

• Attestation. A named person states that something is true for a date or a period and puts their name to it. "We test restores quarterly" on a renewal form is an attestation. So is a technician marking this month's restore test as passed.
• Verification. Someone checks the thing itself: counts the users without an MFA method in the export, restores a file and opens it, signs in to the break-glass account and watches the alert arrive.
• Independent assurance. A third party does the checking and reports what it found, within a stated scope. A SOC 2 report is the familiar example: an "assertion-based examination" of a service organization's description of its system, performed by "CPAs in public practice" (AICPA).

The vocabulary is confusing because accountants call that third kind of work an attestation engagement. In audit language the word means an independent examination of someone else's claim; on a renewal form or a vendor questionnaire it means your own signature. When someone asks for "an attestation", ask which one they mean.

NIST's assessment guidance gives the same ladder in other words. Assessors obtain evidence through "one of three types of actions (i.e., examine, interview, test)" (NIST glossary). An attestation is an interview written down. Examining the record is stronger. A test, "exercising one or more assessment objects" to "compare actual with expected behavior" (NIST SP 800-53A), is the strongest, and the one most often skipped.

What each kind of evidence proves

The rows stack. An MFA claim backed by the policy screenshot, the registration export and a few sampled sign-ins answers questions no single screenshot can; the MFA coverage guide lists the exact reports. A restore test works the same way: a dated record of what was restored, from which restore point, and who opened it, as in the restore test template.

Why the difference costs money

A cyber-insurance application is a set of attestations. The carrier prices the policy on what the applicant states, and the checking can come after a claim. In 2022 Travelers asked a federal court in Illinois to rescind a $1 million cyber policy it had issued to International Control Services (Reed Smith), alleging misrepresentations about "the extent to which it utilized multifactor authentication (MFA)". After a ransomware attack, Travelers said it learned that ICS "only utilized MFA to protect its firewall and did not use MFA to protect any other digital assets". On August 26, 2022, after ICS agreed to it, the court entered judgment rescinding the policy (Lockton).

The lesson is not to stop attesting; every renewal requires it. It is to attest to what was checked, in words that match the check. If the export shows MFA on every mailbox, write that, not "MFA on all systems". The calendar of what carriers ask for at renewal lists the checks worth having on file before the form arrives.

Six habits that make an attestation hold up

1. Attest to the check, not the intention. Write what was done and what was seen: "Restored payroll.xlsx from the 02:00 restore point; file opened; 4 minutes", not "backups OK".

2. Attach what the system produced. An export or log generated by the system beats a screenshot, and a screenshot beats a sentence. File the export as it came out and work on a copy.

3. Hash the file when you collect it. A SHA-256 hash recorded at collection lets anyone show later that the file is unchanged. On macOS run shasum -a 256 file, in PowerShell Get-FileHash file -Algorithm SHA256, on Linux sha256sum file. A matching hash proves the file has not changed since it was hashed. It does not prove the file was true.

4. Record who, when and from where. A name, a timestamp and, for sign-offs, an IP address do not make a statement true. They make it attributable, and an attributable statement is one a carrier or auditor can rely on, or challenge.

5. Split the doer and the signer. The technician who ran the control provides the evidence; someone at the client signs off on the result. A false attestation then needs two people to miss the same thing, and the MSP is not the only party vouching for its own work.

6. Re-perform a sample. Once a quarter, verify part of what you attest to: pick five users from the MFA export and open their sign-in details, or restore one file nobody asked for. Record the sample and the result. This is the step that turns an attested record into a verified one; the break-glass test applies the same idea to one account.

What a pack of attestations lets a reader conclude

An evidence pack built from attested results is a record, so read it as one. A carrier or auditor can conclude:

• who stated each result, when, and with which files;
• that the attached files are the ones filed at the time, if their hashes match;
• which scheduled runs happened, which were late and which were missed;
• that a client contact agreed with a result, where it was co-signed.

It cannot conclude that a passed control passed: only the attached evidence can show that, and only as far as that evidence goes. It says nothing about controls outside the pack, or about the period after it ends. A reader who needs more re-performs a sample or asks for an independent examination.

Questions

Is a self-attestation worth anything?

Yes. Most renewals and vendor reviews run on them. An attestation is worth the evidence behind it and the name on it: a dated, signed result with the export attached carries far more weight than a box ticked from memory.

Does a hash prove the evidence is genuine?

It proves integrity, not truth. A matching SHA-256 shows the file has not changed since it was hashed. If the hash went into a dated log when the file was collected, it also shows the file existed by that date. Neither shows that the contents were accurate.

Who should sign a client's attestation to its insurer?

Usually the client: the statement is about the client's environment and the policy is theirs. The MSP's part is the evidence behind each answer, filed where the client can see it before signing.

Next step

ControlLedger is built on this distinction. For each recurring control the assignee logs pass, fail, exception or not applicable and attaches the screenshot or export, and every file is hashed with SHA-256 when stored. On the Solo and MSP plans a client contact can co-sign a result through a magic link that covers that one attestation and records their name, the timestamp and the IP address. The Evidence Pack prints the control matrix, the attestation log, every file's hash, exceptions and co-signatures, and anyone can check a pack's hash on the verify page while the account exists. What it does not do is verify that a control was performed: every pack states that it records attestations made by your account, and it is not legal, insurance or audit advice. The help page goes from signup to the first pack. Free for one client, no credit card.