Drummond Certification vs Continuous Validation
Which does your AS2 connection need? Drummond Certification and continuous validation answer different questions. This page lays out what each one tests, what each one costs, and when to choose each, fairly and without a sales pitch.
Facts about Drummond Group's program are cited from Drummond's own AS2 certification page.
What Drummond Certification is
Drummond Certification is a paid, third-party conformance program run by Drummond Group, an accreditation body with over 25 years of B2B interoperability testing experience. It tests whether an AS2 software product conforms to the AS2 specification (RFC 4130) and interoperates with other certified products in a structured multi-party test event. Products that pass earn the Drummond Certified seal and are listed in the public AS2 Interoperability Product Directory.
Importantly, Drummond certifies a product, not a specific live partner connection. It is recognized industry authority, and Drummond states that major retailers including Walmart, Target, and Amazon require trading partners to use a Drummond-certified AS2 solution.
Strengths
- Independent third-party authority. Drummond Group has run B2B interoperability testing for over 25 years and is the body trading partners recognize.
- Required for certain contracts. Drummond's own program page states that major retailers including Walmart, Target, and Amazon require trading partners to use a Drummond-certified AS2 solution.
- Spec conformance across the matrix. Certification tests a product against multiple other certified implementations in a full-matrix exchange, not just one peer.
- Market signal. Certified products earn the Drummond Certified seal and are listed in the public AS2 Interoperability Product Directory, which procurement teams check.
Limitations
- Point-in-time snapshot. Certification is earned at a test event and reflects the product version tested that day. It does not monitor your live connection afterward.
- No drift detection. A certificate expiring, a cipher being downgraded, or a partner changing its MDN configuration between events will not be caught by certification.
- Weeks to months of lead time. Drummond publishes that pre-certification takes two to six months and the certification event itself runs ten to twelve weeks.
- Engagement-based pricing. Drummond does not publish a price list; cost is quoted per engagement and profile, so contact Drummond for a figure.
What Continuous Validation is
Continuous validation is ongoing, automated testing of a specific live AS2 connection. AS2 Certify sends a real test AS2 message to your partner endpoint and grades the full round trip, covering TLS, certificate validity, encryption, signing, the MDN receipt, payload integrity, and latency. The full 8-step methodology runs the same way on every plan.
It re-runs on a schedule (for example weekly) or after any partner configuration change, so it catches the things a one-time conformance test cannot: a certificate nearing expiry, a cipher being downgraded, or an MDN configuration that drifted since the last test.
Strengths
- Catches drift in real time. Re-running on a schedule surfaces certificate expiry, cipher downgrades, and MDN misconfigurations as they happen, not at the next quarterly event.
- Fast. A full round-trip test against a live endpoint returns a graded report in minutes, which makes it practical for partner onboarding and post-change verification.
- Affordable and accessible. The diagnostic runs on every plan including Free, with no engagement fee and no multi-week scheduling.
- Ongoing by design. Scheduled retests keep the validation current as certificates, configurations, and partner endpoints change over time.
Limitations
- Not a third-party certification. AS2 Certify is the testing tool, not an accreditation body, so a passing grade is not the same as a Drummond seal.
- Not sufficient where Drummond is contractually required. If a trading partner mandates a Drummond-certified solution, continuous validation cannot substitute for it.
- Self-attested. The grade reflects a test run by the operator's own tool against its own endpoint, not an independent audit of the product.
- Validates one live connection, not the product. It confirms a specific endpoint works today, not that the software conforms to RFC 4130 across the full interoperability matrix.
Side-by-side comparison
Ten dimensions. Neither column is uniformly better; each approach is built for a different question.
| Dimension | Drummond Certification | Continuous Validation |
|---|---|---|
| What it validates | An AS2 software product's conformance to the spec and interoperability with other certified products. | A specific, live partner endpoint's health on a real round-trip AS2 exchange. |
| Who runs it | Drummond Group, an independent third-party accreditation body. | The operator, using AS2 Certify as the testing tool (self-attested). |
| Third-party authority | Yes. Earns the Drummond Certified seal. | No. Produces a graded report and optional AS2 Verified badge, not an accreditation. |
| Frequency | Once per test event. GDSN data pools recertify every two years; events run twice a year (Q2 and Q4). | Ongoing. Runs on demand or on a schedule (for example weekly), and after any partner config change. |
| Time to result | Ten to twelve weeks for the certification event; two to six months of pre-certification before it. | Minutes for a full graded round-trip against a live endpoint. |
| Cost model | Engagement-based, quoted per profile. Drummond does not publish pricing; contact Drummond for a quote. | Free tier available; paid plans add scheduled monitoring and historical reports. |
| Drift detection | None between events. Certification is a snapshot of the tested product version. | Core strength. Catches cert expiry, cipher downgrades, and MDN misconfig as they happen. |
| Partner / contract requirement | Required by some partners. Drummond lists Walmart, Target, and Amazon as requiring certified solutions. | Not a contractual certification. Useful for operational confidence, not for satisfying a Drummond mandate. |
| Scope | Product-level spec conformance across a matrix of implementations. | Connection-level health: TLS, certificates, encryption, signing, MDN, payload integrity, latency. |
| Best for | Vendors selling AS2 software who need recognized, contract-satisfying proof of interoperability. | Operators who need ongoing confidence that a production connection still works today. |
Drummond timing and event details are sourced from Drummond's AS2 certification page. Continuous validation reflects AS2 Certify's 8-step methodology.
When to choose each
The clearest way to decide is to ask which question you are trying to answer.
Choose Drummond Certification if
- A trading partner contractually requires a Drummond-certified AS2 solution.
- You need independent third-party authority that procurement teams recognize.
- You are a vendor selling AS2 software and must demonstrate spec conformance.
Choose Continuous Validation if
- You need ongoing operational confidence in a live production connection.
- You are cost-sensitive or need to validate during rapid partner onboarding.
- No partner contractually requires a Drummond certification for your use case.
Choose both if
- You sell AS2 software (Drummond certifies the product)
- and you also operate production connections (continuous validation keeps them healthy).
- The two answer different questions: "is the product spec-conformant?" vs "does this connection work today?"
A common pattern for AS2 software vendors is to hold a Drummond Certification for the product and run continuous validation on the production connections they operate. For a deeper look at what the ongoing check covers, see the AS2 certificate validation checklist and the AS2 Verified badge that a passing continuous test can earn.
Frequently asked questions
What is Drummond Certification?
Drummond Certification is a paid, third-party conformance program run by Drummond Group. It tests whether an AS2 software product conforms to the AS2 specification (RFC 4130) and interoperates with other certified products in a multi-party test event. Products that pass earn the Drummond Certified seal and are listed in the public AS2 Interoperability Product Directory. It certifies a product, not a specific live partner connection.
Is Drummond Certification required for AS2?
It depends on your partners. AS2 itself is an open IETF protocol (RFC 4130) that anyone can implement, so no certification is required to use AS2 in general. However, Drummond Group states on its own program page that major retailers including Walmart, Target, and Amazon require trading partners to use a Drummond-certified AS2 solution. If your trading partner mandates it, you need it; if not, you do not.
What's the difference between Drummond Certification and continuous validation?
Drummond Certification is a point-in-time, third-party test of whether an AS2 product conforms to the spec, run at scheduled test events. Continuous validation is ongoing, automated testing of a specific live partner connection, run on demand or a schedule. Drummond answers "is this product spec-conformant?"; continuous validation answers "does this connection work today, and has anything drifted since last week?" They are complementary, not substitutes.
How much does Drummond Certification cost?
Drummond does not publish pricing. Cost is quoted per engagement and depends on the transport profile and optional profiles you select, so contact Drummond Group directly for a quote. Continuous validation, by contrast, runs on every AS2 Certify plan including a free tier, with paid plans adding scheduled monitoring and historical reports.
Run continuous validation on your connection
If your use case calls for ongoing operational confidence rather than a product certification, run a real AS2 round trip against your endpoint. Free to start, no engagement fee.