To obtain this ISO certificate, a company must demonstrate both the documentation and implementation of controls.