Compliance attestation
Also known as: posture attestation · statement of compliance
A compliance attestation is a dated document stating what an organization assessed, by what method, and within what limits — without claiming compliance in law.
It differs from a certification, which involves an accredited body, and from an audit, which involves a third party retrieving evidence from the systems. An attestation states what was looked at, and by whom.
Its credibility rests on what it admits. An attestation that states its scope — the domains covered, the share of the questionnaire actually answered, what was set aside — is worth more than a document asserting only the positive.
It has a validity period. Without an end date, a buyer may believe last year's document still holds, which is rarely true of a compliance posture.
What it means for a small business
It is the document that unblocks a sale when the buyer demands proof and a full audit report is out of reach. Its value depends entirely on the buyer being able to verify it without going through the supplier.
So what actually applies to you?
A definition tells you what a term means, not what your organization must do. The assessment answers the second question — free, no credit card.
Updated September 1, 2026 · Educational definition; not legal advice.