Companies publish specifications based on out-of-box performance data. The type of information given to the public varies from one manufacturer to another. Even the way specs are generated is not standard. The general rule is four-corner performance: sequential reads, sequential writes, random reads and random writes.
Two methods for determining sequential performance come from easy-to-use software with a GUI interface. ATTO at a queue depth of four or 10 is the old-school method. The utility won't let you test with a single outstanding command though, reporting throughput numbers not often seen in the real world. SanDisk and a few other companies no longer use ATTO and instead prefer CrystalDiskMark to show sequential read and write performance.
Random IOPS can be measured a number of ways. Most companies use Iometer with 4KB blocks at a queue depth of 32. Again, the results appear impressive, but share very little with the drive's real world behavior. We'll go into more depth on this shortly.
There are a few things to keep in mind when it comes to the specifications found on manufacturer websites and product packages. We've already touched on real-world performance and how you shouldn't expect to get relevant data from the company selling you its drive. After all, a typical use case doesn't exist. Even on the same machine, workloads vary from data to day. You especially can't compare one vendor's specs with another's. They use different configurations to generate their data, introducing variance.