Sovereign Secure Certificate Verification and Certified Clients

Sovereign Secure certificate verification depends on what you have been shown. A Cyber Essentials or Cyber Essentials Plus certificate we issued is listed on the IASME certificate search, the official search for the NCSC scheme, so you can check it yourself for free without contacting us. PCI DSS, PCI PIN and card production results are confidential and have no public register, so you verify them from the Attestation of Compliance (AOC) and a short email to us.

We do not run a separate register of our own. The official sources below are the ones a procurement team should rely on, and this page shows you how to read them. It is also the home of our badge programme for certified clients.

How does Sovereign Secure certificate verification work?

Find the document you hold in the table, then follow the matching section below. Each credential has a different issuer and a different place to check it.

How do I verify a Cyber Essentials certificate issued by Sovereign Secure?

Search the organisation’s name on the IASME certificate search and read the result. It should show a certificate issued within the last 12 months with the correct level. The search result does not name the certification body or the scope, so check those on the certificate itself, which names Sovereign Secure for certificates we issued. The search is free and needs no account.

1. Open the certificate search. The NCSC directs people to it on IASME’s website, because IASME delivers the scheme for the NCSC.
2. Enter the organisation’s name. Try its registered name from Companies House as well as any trading name.
3. Read the matching result: company name, certificate reference, certificate level, certification date and expiry date.
4. Compare it with the certificate the supplier gave you, which also shows the scope and the certification body, using the table below.
5. If anything does not match, or the organisation is not listed, email us before you rely on it.

IASME asks that the search is used only to check certification, not for marketing or data research. Organisations checking many suppliers can register for the IASME Supplier Assurance Tool, a free platform for checking certification across a supply chain. For a screen-by-screen walkthrough, see our guide on how to check a Cyber Essentials certificate, and for what the higher level involves, see Cyber Essentials Plus.

Why can’t I find a certified organisation in the search?

Usually because the certificate has expired, the organisation is certified under a different name, or another certification body issued it. The common causes are:

• Expired. The search only covers certificates issued in the last 12 months. A lapsed supplier needs to renew its Cyber Essentials certificate before it counts again.
• Different name. The certificate is issued to the legal entity in scope, which may be a parent company or a registered name that differs from the brand you know.
• Different certification body. If the certificate names another body, ask that body to confirm it. We can only confirm certificates we issued.
• Not certified. Wording such as “working towards Cyber Essentials” or “Cyber Essentials compliant” is not certification. Only a certificate from a licensed certification body counts.

If you still cannot find it, email [email protected] with the organisation’s name and the certificate number. We will tell you whether we issued it and whether it is current.

How are PCI DSS Attestations of Compliance verified?

Ask the organisation for its current AOC, check that Sovereign Secure is named as the assessor and that the assessment is less than 12 months old, then email us to confirm it. The PCI Security Standards Council does not certify merchants or service providers and publishes no list of compliant companies, so the AOC is the evidence.

The full Report on Compliance (ROC) is confidential and normally stays between the organisation, its acquirer and the payment brands. The AOC is the summary designed to be shared with customers and partners, often under a non-disclosure agreement.

PCI DSS compliance is revalidated every year, so an older AOC is out of date. Service providers may also appear on Visa’s Global Registry of Service Providers or Mastercard’s list of compliant service providers, but those listings run through the card brands’ own programmes, so absence from them does not prove non-compliance.

Treat a “PCI certificate” on its own with care. It is not a PCI SSC document and does not replace the AOC. The same principle applies to our PCI PIN security audits and card production audits as a QPA and CPSA company: results go to the payment brands, not to a public register. Read more about our PCI DSS assessments.

How do I add the “Certified by Sovereign Secure” badge to my website?

Ask us for your badge snippet once your certificate is issued. It pairs the official Cyber Essentials or Cyber Essentials Plus digital badge from your IASME digital certificate with a short “Certified by Sovereign Secure” text link, so visitors can see who certified you and how to check it.

IASME issues certificates digitally, and certified organisations receive a digital Cyber Essentials badge to display on their website. We do not host, copy or alter the Cyber Essentials marks: you embed the badge exactly as IASME provides it and follow IASME’s branding guidelines. The official rules for the marks are covered in our guide to the Cyber Essentials logo; this section covers only our own snippet.

Our snippet adds one plain text line beneath it, for example “Cyber Essentials Plus certified by Sovereign Secure, an IASME-licensed certification body”, linking to our Cyber Essentials certification page or to this verification page.

A few rules keep the badge credible:

• Show the level you hold. Never display the Plus badge with a basic certificate.
• Do not redraw, recolour or crop the Cyber Essentials marks, or take them from another website.
• Do not imply the certificate covers more than its scope.
• Remove the text line if your certificate lapses, and renew before expiry to keep both.

To request the snippet, email [email protected] with your organisation’s name and certificate number, or use the form below. It is available on request to organisations we have certified.

Can PCI clients say they were assessed by Sovereign Secure?

Yes, if you hold a current, compliant AOC from an assessment we performed and you want to say so. We supply a plain-text line such as “PCI DSS assessed by Sovereign Secure, a PCI SSC Qualified Security Assessor company”.

• Never use the PCI SSC logo, and never say the Council itself certified you.
• Name the standard and version you were assessed against.
• Remove the line if your AOC is more than 12 months old and has not been revalidated.
• We check the wording with you against the PCI SSC’s rules on use of its name and marks before you publish.

Can my organisation be listed on this page?

Yes, if you want to be. Listing is opt-in: tell us when you request your badge snippet, and we will only add your name and a link to your website once you have agreed in writing. The organisations we already name, from banks to card manufacturers, are on our clients page.

Why Sovereign Secure

You can check our own credentials the same way we ask you to check a supplier’s: at the source.

We are headquartered at 16 Whalley Road, Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka; our company facts page lists these details and our accreditations in one place. ISO certification audits for our consultancy clients are carried out by our partner certification body, MQA International. If you hold an ISO certificate, our guide to the ISO 27001 logo rules explains which marks and wording you can use.

What to do next

Already certified by us? Email your certificate number to request your badge snippet. Checking a supplier and stuck? Send us the organisation’s name and certificate number. Need certifying yourself? See our Cyber Essentials packages and prices, call +44 161 523 5276 or use the form below.