When a retailer evaluates a new technology provider, security questionnaires can quickly become a long list of acronyms.

ISO 27001. SOC 1. SOC 2. PCI DSS. PCI SSF.

They all relate to security, but they do not mean the same thing.

A certification or independent assurance report can tell a retailer a lot about how a technology provider manages information, protects payment data and operates its security controls. But it does not automatically mean that every system, product or process from that provider has the same scope of coverage.

That distinction matters.

For retailers handling customer information, payment data, employee information, transaction records and increasingly connected commerce operations, retail security certifications are an important part of evaluating technology risk.

The right question is not simply:

"Is the vendor certified?"

It is:

"Certified or assessed against what standard, for which systems, and what does that actually tell us?"

Why Security Certifications Matter in Retail

Retail technology sits close to some of a business's most sensitive information.

A modern retail environment can involve:

• Customer profiles and contact information
• Payment and transaction data
• Loyalty information
• Order history
• Employee and user credentials
• Product and pricing data
• Inventory information
• Store and e-commerce systems
• Integrations with payment providers and other enterprise platforms

The risk is not limited to the technology itself.

A retailer may also need to understand how a vendor manages access, security policies, risk, incident response, business continuity and the controls surrounding the systems that process or handle its data.

This is why security certifications and independent assessments matter during vendor evaluation.

They provide evidence that specific security or control requirements have been examined against a defined framework or standard.

But the word specific is important.

A certification is not a blanket statement that a company is "secure."

It is evidence about a defined scope.

ISO 27001: Is the Organisation Managing Information Security Systematically?

ISO/IEC 27001 focuses on an organisation's Information Security Management System, or ISMS.

ISO describes ISO/IEC 27001 as the international standard for establishing, implementing, maintaining and continually improving an ISMS. It uses a risk-management approach to information security and covers the confidentiality, integrity and availability of information.

In practical terms, ISO 27001 is about the management system around information security, not simply one application or one security tool.

That can include areas such as:

• Information security policies
• Risk assessment and treatment
• Access management
• Security responsibilities
• Asset management
• Incident management
• Business continuity
• Supplier relationships
• Ongoing monitoring and improvement

For a retailer evaluating a technology provider, ISO 27001 can therefore provide useful evidence that information security is being managed as an organisational discipline rather than treated as a collection of isolated technical controls.

What ISO 27001 does not mean

It does not mean that a vendor is immune to cyberattacks.

It also does not mean every product the company offers automatically falls within the certification's scope.

That is why retailers should ask to see the scope of the certification and understand which organisation, locations, systems or activities are covered.

ETP's ISO 27001 certification

ETP Group announced its ISO/IEC 27001:2022 certification in July 2025. ETP states that the certification covers its Information Security Management System and reflects its approach to information security, data security and privacy protection.

For a retailer, the useful takeaway is not simply that ETP has an ISO certificate.

It is that the certification provides independent evidence around the information-security management framework within the defined certification scope.

SOC 1 vs SOC 2: What Is Being Examined?

SOC reports can be confusing because the names sound similar while their purposes are different.

The distinction becomes important when a retailer is assessing a technology provider that operates systems or services on its behalf.

SOC 1 Type 2

SOC 1 is primarily concerned with controls relevant to a service organisation's customers' internal control over financial reporting.

That makes it particularly relevant where a service provider's systems or processes can affect financial reporting.

The "Type 2" part is also important.

A Type 2 examination looks at the design of relevant controls and their operating effectiveness over a specified period, rather than simply considering whether controls were suitably designed at a point in time.

For a retailer, this can be relevant when evaluating technology providers involved in processes that feed into financial or transaction-related reporting.

SOC 2 Type 2

SOC 2 is different.

It evaluates controls relevant to the AICPA Trust Services Criteria, which can cover areas including:

• Security
• Availability
• Processing integrity
• Confidentiality
• Privacy

A SOC 2 Type 2 examination provides an opinion on the operating effectiveness of relevant controls over a specified period and includes testing performed by the service auditor.

That makes SOC 2 particularly relevant to conversations around how a technology service protects and manages information.

Why the "Type 2" matters

This is one of the easiest details to overlook.

There is a difference between showing that controls are suitably designed and providing evidence about how those controls operated over a period.

For technology buyers, that distinction can make a Type 2 report useful when assessing a vendor's ongoing control environment.

ETP's current certifications page lists both SOC 1 Type 2 and SOC 2 Type 2 among its certifications.

PCI DSS and PCI SSF Address a Different Part of Retail Security

Retailers also need to look closely at payment security.

This is where PCI DSS and the PCI Software Security Framework (PCI SSF) come into the picture.

They are related to payment security, but they address different areas.

PCI DSS

The Payment Card Industry Data Security Standard, or PCI DSS, provides technical and operational requirements designed to protect payment account data.

PCI SSC states that PCI DSS applies to entities that store, process or transmit cardholder data or sensitive authentication data, as well as entities that can affect the security of the cardholder data environment.

For retailers, this brings the conversation directly to payment environments.

Questions include:

• How is payment data handled?
• Where does sensitive payment information go?
• How is it protected?
• What controls surround payment processing?
• How are vulnerabilities assessed?
• How are access and authentication managed?

ETP announced that its ETP Mobile Store V5.5 R10 achieved PCI DSS v4.0.1 certification in July 2025. ETP states that the certification involved independent validation covering areas including payment-data handling, vulnerability assessments, penetration testing and authentication controls.

PCI SSF

PCI SSF is more specifically focused on payment software security.

PCI SSC describes its Secure Software Standard as establishing security requirements for software vendors and developers to help ensure payment software is securely designed and managed, while protecting the integrity of payment transactions and the confidentiality of payment data.

This is particularly relevant when evaluating retail POS and payment software.

ETP's ETP V5.5 R10 Omni-Channel POS solution achieved PCI SSF v1.2 certification in 2024.

The distinction is useful:

PCI DSS asks broader questions around protecting payment account data and the relevant environment. PCI SSF focuses on the security of payment software.

A retailer may need to consider both depending on its architecture, responsibilities and compliance requirements.

What These Certifications Tell You About a Retail Technology Provider

The easiest way to understand the certifications is to stop treating them as competing badges.

They answer different questions.

The important point is that more certifications do not automatically mean a vendor is better.

A retailer should ask whether the certification is relevant to the system being purchased and the risk being evaluated.

Certification Is Evidence, Not a Substitute for Due Diligence

This is perhaps the most important part of the discussion.

A certification should not end the security conversation.

It should make the conversation more informed.

For example, if a retailer is evaluating a cloud retail platform, the security team may still want to understand:

• What systems are covered by the certification?
• What is outside the scope?
• Where is customer data hosted?
• How is access controlled?
• How is privileged access managed?
• How are security incidents handled?
• How often are vulnerabilities assessed?
• How are patches managed?
• What are the backup and recovery arrangements?
• Which third parties or subprocessors are involved?
• What security responsibilities remain with the retailer?
• What evidence is available from the latest assessment?

The same principle applies to payment systems.

A PCI certification is valuable, but the retailer still needs to understand how its own payment environment is configured and where its responsibilities begin and end.

Security is a shared responsibility.

Look at the Scope, Not Just the Logo

A security badge on a vendor's website can be a useful starting point.

It should not be the end of the evaluation.

Imagine a retailer is considering two technology providers.

Provider A lists six security certifications.

Provider B lists three.

At first glance, Provider A may appear to have the stronger security posture.

But then the retailer discovers that Provider A's certifications cover a limited product or environment, while Provider B's relevant certification covers the service being evaluated.

The comparison changes.

This is why procurement and security teams should ask for the underlying documentation and review the scope.

Look for:

1. What is covered?
Which company, product, service, environment or process?

2. What period is covered?
This is especially important for Type 2 assessments.

3. Who performed the assessment or certification?
Understand whether the evidence comes from an independent assessment or certification process.

4. What criteria were used?
ISO, SOC and PCI each answer different questions.

5. What is excluded?
The exclusions can be as important as the included systems.

What Retailers Should Ask a Technology Vendor

Security questionnaires can become enormous, but a focused set of questions can reveal a lot.

Before selecting an enterprise retail technology provider, ask:

About certifications

• Which security certifications and independent assessments do you currently hold?
• What is the scope of each one?
• When was each certification or assessment completed?
• Is the certification current?

About data

• What types of customer and transaction data does the platform process?
• Where is the data hosted?
• How is data protected in transit and at rest?
• How is access to customer data controlled?

About operations

• How are security incidents detected and handled?
• How are vulnerabilities identified and remediated?
• How frequently are security controls reviewed?
• How are third-party providers assessed?

About payments

• Does the relevant POS or payment software have applicable PCI validation?
• Which PCI standard applies to the specific product?
• What responsibilities remain with the retailer?

These questions move the conversation from "Do you have a security certificate?" to "How does your security model apply to the system we are buying?"

That is a much more useful conversation.

What ETP's Security Certifications Mean for Retailers

ETP Group's current certifications page lists ISO, SOC 1 Type 2, SOC 2 Type 2, PCI SSF Validated and PCI DSS Validated, alongside other compliance credentials.

These credentials cover different aspects of security and compliance rather than representing one generic "security certification."

ETP's ISO/IEC 27001:2022 certification relates to its Information Security Management System.

Its PCI credentials address payment and payment-software security. ETP V5.5 R10 has PCI SSF v1.2 certification, while ETP Mobile Store V5.5 R10 has PCI DSS v4.0.1 certification.

For retailers evaluating enterprise technology, that distinction matters.

A retail platform may sit at the intersection of customer data, transactions, payments, stores, e-commerce and other connected systems. Security therefore needs to be considered across the relevant layers rather than reduced to a single compliance badge.

The Better Question to Ask About Retail Security

Security certifications are useful because they give technology buyers something concrete to evaluate.

But they are only useful when you understand what they actually cover.

ISO 27001 tells you about an information security management system.

SOC 1 and SOC 2 provide different forms of assurance around defined control environments.

PCI DSS focuses on protecting payment account data.

PCI SSF addresses security requirements for payment software.

None of them should be treated as a universal guarantee.

For retailers, the better approach is to look at the combination of standards, scope, controls, evidence and operational practices behind a technology provider.

That is how security becomes part of a sound technology decision rather than a box-ticking exercise.

And when retail systems increasingly connect payments, customer data, stores, e-commerce and operational platforms, that distinction matters well beyond the IT department.

Conclusion

For enterprise retailers, security should not be a checkbox added at the end of a technology evaluation.

It should be part of the evaluation from the start.

Certifications can help because they provide independent evidence against defined standards and criteria. But their real value comes from understanding what that evidence actually covers.

The question is not:

"How many security badges does this vendor have?"

It is:

"Do the standards, controls and evidence cover the risks that matter to our business?"

That is the question that turns security certification from a marketing badge into useful evidence for a technology decision.

FAQs

What is the most important security certification for a retail technology provider?

There is no single certification that is most important for every retailer. ISO/IEC 27001, SOC reports, PCI DSS and PCI SSF address different areas of risk. The relevant certification depends on the systems involved, the data being processed and the retailer's compliance requirements.

What does ISO 27001 mean for a retail technology company?

ISO/IEC 27001 demonstrates that an organisation has established an Information Security Management System designed to manage information-security risks. It focuses on the management of information security rather than certifying that every individual product is secure.

What is the difference between SOC 1 Type 2 and SOC 2 Type 2?

SOC 1 focuses on controls relevant to a service organisation's customers' internal control over financial reporting. SOC 2 focuses on controls relevant to selected Trust Services Criteria such as security, availability, processing integrity, confidentiality and privacy. Type 2 reports provide assurance about operating effectiveness over a specified period.

What is the difference between PCI DSS and PCI SSF?

PCI DSS provides requirements for protecting payment account data and applies to organisations that store, process or transmit relevant payment data or can affect its security. PCI SSF focuses specifically on security requirements for payment software.

Does having a security certification mean a retail software vendor cannot be breached?

No. Certifications and independent assessments demonstrate compliance or control effectiveness against defined criteria and scopes. They do not guarantee that a company will never experience a security incident.

What should retailers check when reviewing a vendor's security certification?

Retailers should check the standard, certification or report type, scope, assessment period, systems covered, exclusions and the responsibilities that remain with the retailer. They should also request appropriate supporting documentation as part of their vendor-risk process.