Company · Accreditations & Credentials
Credentials We Hold. Frameworks We Implement.
DAAKYI's own corporate credentials, shown separately from the frameworks we help clients implement.
Executive Summary
- 01Certification, attestation, and framework alignment give different levels of assurance, so each credential must be read for what it actually verifies.
- 02Scope, issuer, and dates determine the value of an ISO/IEC 27001 certificate or a SOC 2 report far more than the logo does.
- 03Credentials support compliance with Ghana's Act 1038 and Act 843, GDPR, and HIPAA, but none of them replaces those legal duties.
Held by DAAKYI
DAAKYI Corporate Credentials
Credentials and memberships held by DAAKYI as an organization.
AICPA SOC for Service Organizations
ISO 27001 Certified
BBB Accredited Business
U.S. Chamber of Commerce Member
CSA
Client Implementation Support
Frameworks We Help Clients Implement
Standards and regulations DAAKYI helps clients assess against, implement and evidence.
- ISO/IEC 27001
- ISO/IEC 27701
- ISO/IEC 22301
- ISO/IEC 31000
- SOC 2
- NIST CSF
- PCI DSS
- CIS Controls
- HIPAA
- GDPR
- COBIT
- Ghana Act 1038
- Act 843
Framework logos are areas of client implementation support, not DAAKYI certifications or endorsements.
Perspective
The Context Behind Our Approach
Certification, Attestation, and Alignment
A credential is a claim about a specific scope, issued by a specific party, on a specific date. Certification means an independent body audited a management system against a standard. Attestation means an auditor gave an opinion on controls. Alignment means an organization mapped its practices to a framework without outside verification. Buyers should never treat these as interchangeable. Each carries different assurance, and each answers a different question about risk.
Reading an ISO 27001 Certificate
An ISO/IEC 27001 certificate covers an information security management system, not every system a company runs. The scope statement defines what is included. The Statement of Applicability lists which Annex A controls apply and why. The 2022 edition has 93 controls in four themes: organizational, people, physical, and technological. Implementation guidance comes from ISO/IEC 27002. Ask for the scope and the issuing certification body, then confirm the certificate is current and covers the services you will buy.
What a SOC 2 Report Proves
A SOC 2 report is an auditor's opinion, not a certificate. A Type I report describes whether controls were suitably designed at a point in time. A Type II report also tests whether controls operated effectively over a period. Read the system description, the criteria in scope, and the list of exceptions. The report is usually restricted to customers and prospects under confidentiality. A clean opinion on narrow scope tells you little about systems left outside it.
Frameworks Are Not Credentials
Many frameworks cannot be certified at all. NIST CSF 2.0 organizes cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Organizations use it to structure programs and report their posture, but no body issues a CSF certificate. CIS Controls v8 guides prioritization rather than certifying anyone. PCI DSS is different because validation takes place through an assessment against the standard. The current revision is Version 4.0.1, and its future-dated requirements became mandatory on March 31, 2025.
Legal Duties No Certificate Replaces
Regulation adds obligations that no certificate replaces. Ghana's Cybersecurity Act, 2020 (Act 1038) created the Cyber Security Authority and covers licensing of cybersecurity service providers, Critical Information Infrastructure, and incident reporting. The Data Protection Act, 2012 (Act 843) requires data controllers to register with the Data Protection Commission and to follow eight privacy principles. Under GDPR, breach notification to the supervisory authority is expected within 72 hours where feasible. HIPAA requires administrative, physical, and technical safeguards for electronic protected health information.
Verifying a Provider's Claims
Verification is simple when you know what to request. Ask for the certificate or report itself, not a logo. Check the issuer, the scope, the effective dates, and any exclusions. Match the standard version to the one currently in force. Confirm whether a membership or listing reflects an audit or only enrollment. Then map each credential to your own obligations, so that evidence supports a decision rather than decorating a vendor slide.
A logo shows affiliation. A scoped, dated, independently issued document shows assurance. Ask for the document.
Glossary
Key Terms
- Statement of Applicability
- The ISO/IEC 27001 document that lists which Annex A controls an organization applies, which it excludes, and the reasoning for each.
- Type II Report
- A SOC 2 report in which the auditor tests whether controls operated effectively across a defined period, not only at a single date.
- Certification Body
- An independent organization that audits a management system against a standard and issues the resulting certificate.
Next Step