None of these is required. An IT provider can operate without any of them. Getting certified means submitting to an external audit and passing it. Keeping it is harder: ISO certification runs on a three-year cycle, with annual surveillance audits in between and a full recertification audit at the end. Miss the process, and the certification lapses. That's what separates an audited standard from a claim on a website.
Every certification here is checked by TÜV Rheinland, an independent, internationally recognised certification body.