The short answer: Before you sign an SOW to hire a security assessor, ask each firm for a redacted certification statement from a recent report. It shows who signs, what they certify and what they leave out. You see it before you pay. Directors want better reporting: 57% of private company directors rate better cyber-risk reporting very or extremely important.
This applies to any organization buying a security assessment; we cover it from the buyer’s side, for the CIO, CTO or IT director who writes the SOW and carries the findings to the board.
Fifty-seven percent of private company directors say improving the quality of management’s cyber-risk reporting is very or extremely important, per NACD’s 2026 handbook. That’s 38% calling it very important and 19% extremely important. Among public company directors the figure is 43%. If you run IT at a mid-market company, that pressure lands on you and on whatever report your assessor hands over. Its last page decides how far the board trusts it.
Assessor evaluations tend to compare method, tools and price. Fair questions. But the certification statement is the cheapest thing on the table to inspect, and the sales deck never answers what it does: who puts their name on the findings? A firm that can show you a signed statement from past work, client details blacked out, is showing you how it will treat your report. A firm that can’t is asking you to trust a signature you’ve never seen.
This guide covers why to ask before the SOW and what to request. Then it shows how to check the signer, which answers should end an evaluation, and how to write the statement into your contract.
Why Ask for a Certification Statement Before the SOW?
Because after the SOW, you’ve lost your say over who does the work. Gartner’s 2025 survey of 330 respondents, all non-executive directors worldwide, found only 10% express strong confidence in the value of their cybersecurity investments. A board that doubts the spend will read your assessor’s report closely. Check the signer while you can still walk.
The same survey found 90% lack a measure of confidence in cybersecurity value. Evaluations, meanwhile, tend to run the other way. You see a capability deck, a sample report with every page polished, a rate card and two references. Each one tells you what the firm can do on its best day. None tells you who will sign your findings, or what they will and won’t vouch for.
That gap may matter more now. ISC2’s 2025 workforce study of 16,029 respondents found 59% reporting critical or significant skills needs, up from 44% a year earlier. Risk assessment ranked third among specific needs, at 29%, behind AI at 41% and cloud security at 36%. Our read, and it’s an inference rather than a finding: when assessment skills are hard to hire, the name on the pitch and the name on the report can drift apart. Check anyway.
Boards notice when that happens. A report the board can’t trace to an accountable person becomes one more IT status update, the kind directors have stopped accepting. And what CISOs expect from vendors starts with proof, not promises.
What to Request: A Redacted Statement From a Recent Report
Ask each shortlisted firm for three things from one recent engagement: the signed certification page, the signer’s role, and the written exclusions. Redacted is fine. The FTC’s Safeguards Rule requires the financial firms it covers to run penetration tests yearly and vulnerability assessments every six months. Active assessors have recent engagements to draw from.
1. Ask for the last page, not the sample report
Here’s the counterintuitive part: the sample report tells you almost nothing. It’s built to sell, and every firm’s looks good. The certification page is built to bind. Ask for the real one from a real engagement, with the client’s name and systems blacked out.
2. Read the signer’s role: performed, supervised or reviewed
Each verb is a legitimate role, and each is a different promise. “Performed” means the signer did the testing. “Supervised” means they directed people who did. “Reviewed” means they read someone else’s work after the fact. None of these is wrong. What’s wrong is a statement that doesn’t say, because then your board can’t know which promise it’s reading.
3. Read what the statement leaves out
Good statements name their exclusions in writing: systems not tested, dates not covered, tests not run. An assessment is only the start of the work, which is why it pays to treat the assessment as an input. A statement with no exclusions usually means the firm hasn’t thought about scope, not that it tested everything.
If your shortlist has three firms, you should have three certification pages by Friday. Each should name a person, a role and the exclusions. A firm that sends a sample deck instead is selling you the report, not the signature. Missing one? Talk to us first
Is the Signer the Person in the Pitch Meeting?
It should be, and the rest of your security program already works that way. Regulators tie security claims to accountable people. For the financial firms it covers, New York’s DFS rule needs the highest-ranking executive and the CISO to sign each April 15 filing. Whoever signs needs standing to answer for the work.
The table below shows how four US rules tie security claims to an accountable person or role, and how often.
| Rule | Who signs or reports | How often | What the name carries |
| NYDFS, 23 NYCRR 500.17 | Highest-ranking executive and the CISO | Annually, by April 15 | A certification of material compliance, or an acknowledgment of noncompliance, backed by records kept five years |
| CMMC, 32 CFR 170.22 | The Affirming Official, a senior representative | After each assessment, then annually | Name, title and contact details in the government’s system |
| FTC Safeguards Rule, 16 CFR 314.4 | A Qualified Individual, who may work for a service provider | In writing to the board, at least annually | Oversight of the whole security program |
| SEC, Regulation S-K Item 106 | The company, describing management’s expertise; no signer named | Each annual 10-K | Management’s role and expertise in managing cyber risk |
Why do these rules land on an accountable person or role? Because someone can be questioned. A board member can ask a follow-up. Nobody can cross-examine a logo. The FTC rule makes the point sharper: the Qualified Individual may sit at a service provider, but your firm keeps responsibility for compliance and must have a senior staff member oversee that person. Outsourcing the work doesn’t outsource the answer. New York’s rule adds a paper trail, too: five years of supporting records.
The SEC adds a second reason. Under its 2023 rules, public companies describe management’s role and expertise in managing cyber risk in their 10-K, for fiscal years ending on or after December 15, 2023. A material incident generally goes on a Form 8-K within four business days of that determination. If you’re public, the expertise behind your security program is now on the record. That’s a poor moment to learn your assessor’s signer can’t answer a question.
The offensive play: make the signer attend the scoping call. It costs the firm an hour. It tells you whether the person who will certify your findings understands your environment before testing starts. C4 Technical Services states the same principle for its own work: “the experts who scope your project are the same ones who deliver it from start to finish.”
Four Answers That Should End the Evaluation
Four answers should end an evaluation: no named signer, a signer picked after the SOW, no redacted sample, and no exclusions. Federal banking regulators’ 2023 guidance lists 14 due diligence factors for choosing a third party. Key personnel qualifications is one of them. Your assessor’s signer is key personnel.
- “The firm signs, not a person.” A company name on the last page means nobody personally stands behind your findings. Ask who the board should call with a question.
- “We’ll assign the signer once we staff the project.” Then you’re buying a signature sight unseen. The person who certifies your findings should be named in the proposal.
- “We can’t share a statement, even redacted.” Every firm can black out a client’s name. A firm that won’t is protecting something other than its clients.
- “There are no exclusions; everything’s in scope.” No real assessment tests everything. A firm that can’t tell you what it left out probably doesn’t know.
Automate the timing, never the human moment. Scanners and six-month vulnerability assessments belong on a calendar. The signature doesn’t. It’s where a person decides what they’ll stand behind, and the controls insurers verify are only as good as that person’s check.
Next time an assessor pitches you, write down who’s in the room. Then check their statement’s signer against that list. A name you never met means the senior people sold the work and someone else will certify it. Different names? Compare notes with us
Writing the Statement Into Your SOW: Three Numbers to Track at Delivery
Write three numbers into the SOW and check them when the report lands. Track the signer’s share of hours, the share of in-scope systems tested, and exclusions you never agreed to. Set targets before kickoff. A statement measured against a contract is evidence. One read cold is a guess.
Score your last assessment on the same three first. That’s your baseline.
- Signer hours. Ask for hours by person in the final invoice. The signer should appear on the work, not only on the cover. A signer under 10% of hours is a flag worth a question, unless the statement says “reviewed” and the SOW expected that.
- Scope coverage. Count the in-scope systems listed in the SOW. Count the ones the statement says were tested. Anything under 100% needs a written reason.
- Surprise exclusions. Count exclusions in the statement that weren’t in the SOW. The target is zero.
These thresholds are a rule of thumb, not a benchmark. Read the numbers together. If coverage is full but the signer barely worked the engagement, people you never vetted did the testing. Ask who performed it before the report reaches your board. If the signer worked the engagement but coverage is short, you have an access or scoping problem, so fix it before the retest. If both look right but surprise exclusions appear, the SOW was vague. Fix it at renewal.
Then carry the numbers forward. The same three checks apply when you work through the remediation and retest, and they give your next audit-readiness review a record to start from.
Frequently Asked Questions
Inspect the Signature Before You Buy the Work
Run the four-answer test on your own last assessment first. If its signer is a name you can’t place, the evaluation failed before the SOW. Score it on the three numbers, too. Then ask the next firm for its last page before you ask for its price. A named signer is the cheapest place to start.
The program, the risk decisions and the board conversation are yours to own. Testing the controls and ranking what matters most is what C4 Technical Services’ cybersecurity consultants deliver, with the same experts from scoping to the final report. If you want to see who’d stand behind your findings before you sign anything, let’s talk scope.
References
- “Principle 5: Guide Cybersecurity Risk Measurement and Reporting.” National Association of Corporate Directors, Director’s Handbook on Cyber-Risk Oversight 2026. Published April 15, 2026. Verified live October 19, 2026.
- “Gartner Survey Finds 90 Percent of Non-Executive Directors Lack a Measure of Confidence in Cybersecurity Value.” Gartner. Published November 24, 2025. Verified live October 19, 2026.
- “2025 ISC2 Cybersecurity Workforce Study.” ISC2. Published December 4, 2025. Verified live October 19, 2026.
- “16 CFR 314.4, Elements.” Federal Trade Commission, Standards for Safeguarding Customer Information, via the Electronic Code of Federal Regulations. Published undated (current text, up to date as of October 15, 2026). Verified live October 19, 2026.
- “23 NYCRR 500.17, Notices to Superintendent.” New York State Department of Financial Services regulation, via Cornell Legal Information Institute. Published undated (current text, as amended effective November 1, 2023). Verified live October 19, 2026.
- “32 CFR 170.22, Affirmation.” Department of Defense, CMMC Program, via the Electronic Code of Federal Regulations. Published undated (current text, up to date as of October 15, 2026). Verified live October 19, 2026.
- “SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies.” US Securities and Exchange Commission, press release 2023-139. Published July 26, 2023 (rules adopted in 2023 and in force, framed as such). Verified live October 19, 2026.
- “Interagency Guidance on Third-Party Relationships: Risk Management.” Board of Governors of the Federal Reserve System, FDIC and OCC, Federal Register Vol. 88, No. 111. Published June 9, 2023 (2023 guidance in force, framed as such). Verified live October 19, 2026.
- “Risk Assessment.” NIST Computer Security Resource Center glossary (from NIST SP 800-30 Rev. 1). Published undated (glossary entry). Verified live October 19, 2026.
- “NIST Releases Version 2.0 of Landmark Cybersecurity Framework.” NIST. Published February 26, 2024 (framework release, framed as 2024 in the passage). Verified live October 19, 2026.
