Review the complete environment rather than collecting a certification logo.
Evaluate identity and MFA, role-based access, managed endpoints, patching, endpoint protection, network segmentation, encryption, customer-data minimization, recording retention, physical controls, subprocessors, incident response and business continuity.
For outsourced operations, understand the remote or facility environment and how access is terminated when agents leave. Identify cloud vendors, telecom carriers and AI/model providers that may process data.
Certifications are useful evidence but do not replace evaluation of the actual workload and contract.