The AICPA has never certified anybody. Not one company, not once. SOC 2 is an attestation engagement, a licensed CPA’s opinion on controls across a defined period, and the report it produces is restricted by design. The AICPA’s own audit guide, in its October 2022 edition, says a SOC 2 report “is restricted to use by users with that knowledge,” meaning readers who understand what they are looking at. You cannot hand it to a reporter. You cannot post it as a PDF. And “SOC 2 certified” is not a status the AICPA issues to anyone.
Now scroll to the bottom of Muck Rack’s State of Journalism 2026 landing page. As of 13 October 2026, the footer reads “SOC 2® Certified.” That is a media intelligence company, selling to communications professionals, publishing survey research about what journalists trust, using the one phrase its auditor’s own professional body steers people away from. It is not dishonesty. It is the default. Everyone writes it that way because everyone writes it that way, and nobody has read the guidelines.
That pattern is the whole problem with this category. The average certification press release is wrong before the story even gets a chance to be boring.
Most certification releases break a rule before the headline ends
Pull ten certification announcements off the wires and you will find the same four errors. The body gets named as the certifier when it never certifies. The scope gets dropped, so a certificate covering one product in one data center reads as a company-wide guarantee. The word “certified” gets bolted onto something that was an attestation, an authorization, or a clearance. And the verb tense implies permanence for a status that expires.
These are not hypotheticals. AvePoint’s January 27, 2022 release on GlobeNewswire described the company’s “corporate status as an ISO and SOC 2 Type II certified vendor,” naming no standard, no certification body, and converting an attestation into a certification in six words. Netskope’s January 9, 2024 release called its FedRAMP result “The Impact Level ‘High’ certification” when FedRAMP then issued authorizations. Real companies, real compliance teams, real legal review, and the language still slipped.
ISO is blunt about its side of it. Its certification page states that ISO “does not perform certification or issue certificates, and it does not permit anyone to use the ISO logo in connection with certification,” and that a company therefore cannot be certified by ISO. Certification comes from an external body accredited under ISO/IEC 17021-1:2015, and the mark you may display belongs to that body. ISO publishes a brochure called “Misuse of third party marks of conformity” built on ISO/IEC 17030:2021, and runs a complaints route for false certification claims with a stated 14-day response window. Someone is reading.
Who decides what you are allowed to claim?
The certifying body does, and each one draws the line in a different place. This is the research step most teams skip, and it takes about forty minutes.
B Lab owns the “Certified B Corporation” trademark and licenses it. Its brand book requires the trademark symbol after first use, specifies five logo elements that must always appear together, permits black or white only, reserves the “Circle B” mark for B Lab, and forbids B Corps from using the B Lab logo at all. The name is styled “B Corp” with a space, never “B-Corp” or “BCorp.” Since August 31, 2026, every use of the logo has to point readers to bcorp.com. B Lab’s own certification notice concedes that it “is not a conformity assessment body as defined by Regulation (EU) No 765/2008,” worth knowing before you type the word “accredited” in a certification press release. Under B Lab Standards V2, open for recertification since January 2026, assurance moves to third-party providers working to requirements based on ISO 17021-1.
FDA is where sloppy wording becomes a legal finding. The text of 21 CFR 807.97 says a substantial equivalence determination “does not in any way denote official approval of the device,” and that “any representation that creates an impression of official approval of a device because of complying with the premarket notification regulations is misleading and constitutes misbranding.” Goodwin’s November 22, 2022 analysis counted four warning letters citing 807.97 since 2017 and thirteen citing 807.39, the parallel rule on implying approval from establishment registration. Cleared is 510(k). Approved is PMA. The agency has written down that they are not synonyms.
FedRAMP’s name and logo are GSA property and cannot be used without GSA’s express written permission. Its brand guidance for cloud service providers requires an active Marketplace listing and insists the name align with the product named in the assessment materials, with that product on your dedicated Marketplace page. Claim the company, and you have overclaimed. HITRUST r2 runs two years from the letter date, conditional on an interim assessment submitted in the 90-day window before the one-year anniversary, and HITRUST reserves the right to revoke; e1 and i1 run one year. Great Place To Work Certification lasts 12 months, the badge must carry a TM symbol, the corporate logo is off limits to certified companies, and the Fortune list name and badge license separately through PARS International. Unlicensed companies write “100 Best Companies to Work For” with no Fortune prefix. Finalists sit under hard embargo, and the terms say you may not alert any press or conduct any media efforts until it lifts. The 2026 World’s Best Workplaces embargo lifted at 7:00 a.m. EST on November 12.
Breach that embargo and you lose the placement. That is the only rule in this post with a same-week penalty.
The Claim Ladder, four rungs your evidence has to reach
Here is the framework I use to decide whether a certification deserves an announcement and how high the claim can reach. I call it the Claim Ladder, and it has four rungs. You write at the height of the highest rung your evidence actually supports, and not one rung above it.
Rung one is Possession. You hold the thing. “We hold ISO/IEC 27001 certification.” That is it. Rung one is true for 96,709 organizations as of the 2024 ISO Survey, and it is not news anywhere, ever. It belongs on a trust page and in an RFP response.
Rung two is Precision. You hold the thing, you can name the exact scope, and you can name who verified it. “Our production platform, hosted in two named regions, is certified to ISO/IEC 27001 by [certification body], accredited by [accreditation body], certificate number X, valid through [date].” Rung two is what a security buyer needs and what a careful reporter will check. Still not news.
Rung three is Primacy. Something about your position is first, only, or earliest inside a category a reader already recognizes. MasterControl’s May 5, 2025 release claimed to be the first quality management system to reach FedRAMP Moderate, and that is a legitimate rung three: narrow, checkable, falsifiable. Rung three is the lowest rung that a trade desk will treat as a story, and the category has to be one the publication already covers. “First in our vertical” invented for the release is not primacy, it is a sentence.
Rung four is Permission. The certificate opens something specific that was closed last week, for a named group of people, with a number attached. A hospital system that could not buy from you can now buy from you. A federal agency that was blocked by procurement can now run a pilot. Rung four is where a certification press release stops being an announcement and becomes a business story, because it has a before and an after.
Most teams write rung three or rung four copy on rung one evidence. That is the disease, and the Claim Ladder is the cure. It takes one meeting: put the draft headline beside the certificate and ask which rung the paperwork supports.
Is your certification actually news?
Run the volume math before you run anything else. The ISO Survey for 2024, now compiled from IAF CertSearch, counted 1,474,118 valid ISO 9001 certificates, 676,232 for ISO 14001, 542,527 for ISO 45001, and 96,709 for ISO/IEC 27001, that last figure roughly double the 48,671 recorded for 2023. Precisely’s January 2026 release noted more than 475 authorized offerings on the FedRAMP Marketplace. You are joining a crowd, and the size of the crowd is public.
Then run the attention math. Cision’s 2026 State of the Media Report, drawn from more than 1,800 journalists across 19 markets, found 66% of journalists rely on PR-provided content as their top source of story ideas. That is the good news. The rest is less comfortable: 72% say fewer than a quarter of pitches they get are relevant, 82% will reject a pitch that misaligns with their audience or beat, and most sort more than 50 pitches a week. Muck Rack’s State of Journalism 2026, built on nearly 1,100 responses, found 51% of journalists saying only 1% to 10% of their published stories started from a pitch.
Cision’s respondents did say what moves them: original data, access to an expert, an embargoed announcement, and good visuals. Notice that a certificate is none of those four. But a certificate plus the audit data you can share, plus the person who ran the program, plus an embargo, plus a scan of the certificate itself, covers all four.
This is where distribution strategy beats hope. Instant Press’s own catalog runs 1,016 publications plus roughly 228 Fast Press outlets, mean Domain Authority 62.3, median placement $1,500, with News accounting for 713 of the genre spread. A rung one certification goes out as searchable, indexed coverage that answers the buyer who googles you, which is the honest job for it. A rung four certification gets worked through the 1,200-plus journalist relationships, because a story sits underneath it.
Write the release, then cut your first two paragraphs
Lead with the consequence, not the certificate. The headline carries the correct verb for the body involved, the exact designation, and the scope. Paragraph one answers who can now do what. Paragraph two gives the verifier, the scope, the dates, and the certificate or report identifier, because that is what a skeptical editor copies into a search box. The quote comes from whoever ran the work, not the CEO, and it names the hardest control to pass rather than a commitment to excellence. The boilerplate carries the badge under the body’s current rules, with the required link and symbol.
What you leave out matters as much. No “world-class.” No “rigorous standards” without naming them. No restricted-use report offered to press. If you took a qualified opinion, the AICPA logo is off the table, so state the scope and skip the mark.
HEADLINE: [Company] Earns [Exact Designation] for [Named Product or System]
SUBHEAD: [Who can now do what, in one clause]
[CITY], [Date]. [Company] today said [named product or system] has
received [exact designation, spelled as the body spells it] from
[certification body or CPA firm], [accredited by / licensed in]
[accreditation body or jurisdiction].
The [certificate / report] covers [precise scope: product, environment,
regions, facilities] for the period [start] to [end], [certificate or
report identifier]. [Body] [certifies / attests to / authorizes] against
[exact standard and version].
What changes: [named buyer type] in [named market] can now [specific
action that was blocked]. [Company] expects [honest, bounded number].
"[The hardest requirement was X. Here is what we rebuilt to pass it.]"
said [Name, Title, the person who ran the program].
[Verification: how a reporter checks this independently, with the public
registry, marketplace listing, or directory link.]
About [Company]: [Two sentences.] [Badge used per [Body]'s current brand
rules, with required link and trademark symbol.]Four lines in that skeleton do the real work: exact designation, precise scope, what changes, and how a reporter verifies it without calling you. Drop those four and you have a notice. Keep them and a certification press release can hold its own next to a funding round, because it says something falsifiable about what your company can now be trusted to do.
So before the draft goes to legal: which rung are you actually standing on?