Choosing an ISO 27001 certification body and verifying it

How do you choose an ISO 27001 certification body and confirm its certificate is valid?

Choose a certification body that is accredited to certify information security management systems, then check the issued certificate yourself in IAF CertSearch. ISO does not certify organizations. A certification body issues the certificate after its audit, and ISO advises checking that the body applies the relevant CASCO standard and holds accreditation. Accreditation is not compulsory, and ISO notes that a body without accreditation is not necessarily disreputable. For an ISMS, the accreditation question is whether the body is assessed against ISO/IEC 17021-1 together with ISO/IEC 27006-1, which accredited bodies had to apply to all clients by 31 March 2026. Ask each candidate for its accreditation scope in writing, and confirm that ISO/IEC 27001:2022 appears in it. Your national accreditation body can also confirm the answer.

The right choice depends on your situation. A customer or contract may name the bodies it accepts, or require accreditation outright, so start by asking that customer what it will recognize. Your sector may add expectations, your number of sites and remote locations affects the audit plan, and any existing relationship with a body can raise independence questions. Obtain written quotes from several bodies, and ask whether the certificate will be issued under the three-year cycle with an expiry or recertification date, since a one-year validity does not conform to ISO/IEC 17021-1. Confirm also what happens if you later transfer to another accredited body, because Global ACI-TECH-3-002 (M) allows a valid accredited certificate to move without suspension while the client still meets requirements. DeployOpen prepares systems, controls and evidence for the audit, but it does not issue certificates, and it does not perform the certification audit.

To verify a certificate, search the body's name or certificate number in IAF CertSearch, which aggregates accreditation and certification body data. Check the certificate's scope statement, the sites covered, the issue and expiry dates, and the accreditation body shown. Because the International Accreditation Forum ceased operations on 1 January 2026, and Global ACI took over its role, confirm that the accreditation record is current rather than relying on an older printed copy. If a result is missing or inconsistent, contact the certification body or the accreditation body directly, and ask for a copy of the certificate and the scope before you accept it in a contract.

How to evaluate and select a certification body in five steps

This sequence takes you from defining your scope to signing with a certification body whose accreditation covers ISO/IEC 27001, with each step producing a checkable output you can compare across bidders.

Define your scope and sites first
Before contacting any body, write down the ISMS scope you intend to certify: the products, services, business units, locations, cloud accounts and people in scope. Note which sites are physical and which work remotely, and confirm the list with the executive sponsor. The body needs this to price the audit and to plan the audit days, so an unclear scope produces quotes that cannot be compared. The step is done when you hold a one-page scope statement that the internal owner has signed off.
Shortlist bodies that accept your scope
Ask several certification bodies whether they certify ISO/IEC 27001 (ISMS) for your type of business and your locations. ISO advises evaluating several bodies and checking that each one applies the CASCO standards that govern certification. Your customers and contracts may name specific bodies or accreditation schemes, so record those requirements too. The output is a shortlist of bodies that have confirmed in writing that they can take your scope, with a named contact for each.
Confirm accreditation for the ISMS scope
For each shortlisted body, confirm that its accreditation covers ISO/IEC 27001 and names the body's accreditation scope. Check with the national accreditation body in your country or search the body in IAF CertSearch, which ISO points to as the database for accredited certificates. Accreditation is not compulsory, and a non-accredited body is not automatically disreputable, but an accredited certificate is easier for customers to verify. The output is a written accreditation check, saved with the date you made it.
Request written proposals with the audit plan
Send the same scope statement to every shortlisted body and ask for a written proposal. Each proposal should state the stage 1 and stage 2 audit approach, the audit days and the people or sites it assumes, the cycle of annual audits and the recertification approach, and how the body handles remote or multi-site work. Ask for the timing of each audit as a written commitment rather than an estimate, and confirm that any timelines are firm before you rely on them. The output is a set of proposals you can line up side by side.
Check independence and competence
Ask each body how it sets auditor competence criteria, how it assigns auditors with ISMS and sector knowledge, and how it manages conflicts of interest. Under ISO/IEC 27006-1, a body may not provide internal ISMS reviews to a client it certifies, and the body must be independent of whoever performs the client's internal ISMS audit. Ask whether the body or its group has offered consulting for your ISMS, because that would be a conflict. The output is written answers on independence and competence that you can keep on file for your own review.
Compare quotes on a like-for-like basis
Place the proposals in one table with the same scope, the same audit days, the same travel and the same assumptions about remote work. Compare what is included in the audit fee, what recurs each year and what is charged for extra audit time or re-audits. Confirm who pays for travel and who sets the audit dates. The output is a comparable quote for each body, with its assumptions listed, so that a lower price is not hiding a smaller audit.
Sign a contract that matches the written scope
Choose a body from the comparison and sign a contract that repeats the scope statement, the accreditation scope, the audit plan and the cycle of annual audits. Ask that the contract state how a transfer to another accredited body would be handled, since accredited certification can move between accredited bodies under Global ACI rules if the client still meets the requirements. Keep a copy of the accreditation check with the contract. The output is a signed contract and a file that lets you verify the certificate later.

How to verify an ISO 27001 certificate in IAF CertSearch

A certificate is only useful if it matches the contract it is meant to support. The cards below cover what to check on the certificate itself, how to confirm it independently, and the cases where a document that looks valid is not. Each check connects back to the certification body you are assessing.

Confirm the accredited certification body

Check that the certificate names the body that issued it and that the body holds accreditation for ISO/IEC 27001 (the ISMS sub-scope). ISO notes that accreditation is not compulsory and that a non-accredited body is not automatically disreputable, so the question is what the certificate claims. Ask the certification body or the national accreditation body to confirm the accreditation status in writing before you rely on the document.

Match scope and sites to the contract

Compare the scope statement and the list of sites on the certificate with the services, locations and systems named in your contract. A certificate that covers a head office but not the data center or support team you rely on does not answer the customer requirement. Look for exclusions that remove the parts of the business that handle your data.

Check the expiry and recertification date

Under ISO/IEC 17021-1 clause 8.2.2 c), a certificate must show an expiry or recertification due date consistent with the three-year cycle. A certificate issued with a one-year validity does not conform, so treat it as a warning sign. Confirm the date in the register and ask when the next recertification audit is planned.

Reject expired 2013 editions

Certificates to ISO/IEC 27001:2013 had to expire or be withdrawn by the end of the IAF MD 26:2023 transition period. A supplier that presents an older edition certificate as current is offering a document that no longer represents its position. Confirm that the certificate references the 2022 edition and is listed as valid today.

Use the right verification route

IAF CertSearch lets you look up a certificate individually, download data in bulk, or query it through an API. If the register shows nothing, contact the certification body, the accreditation body or Global ACI directly, and record the date and the person who confirmed the status. Procurement teams should keep that record with the vendor file.

Check remote-only certificate wording

Organizations with few or no relevant physical sites must have certificates and audit reports stating that their activities are conducted remotely. If your supplier is a software or SaaS company operating without offices, look for that statement. Its absence can mean the certificate was issued on a scope that does not match how the supplier actually works.

Impartiality rules that limit who can advise and who can certify

The certification body is the only party that issues the ISO/IEC 27001 certificate, and its independence is the core of the system. Under clause 5.2.2 of ISO/IEC 27006-1, as explained in European Accreditation FAQ 49.4, a certification body may not provide internal ISMS reviews to a client it certifies. It must also remain independent of whoever performs the client's internal ISMS audit. The standard sets no two-year mitigation period for this conflict, so a body cannot clear the problem by waiting. Auditors may point out opportunities for improvement during an audit, but they must not recommend specific solutions, because recommending a fix would turn the auditor into part of the implementation.

No internal reviews for certified clients: The body cannot perform the internal ISMS review for a client it is certifying.
Independence from internal auditors: The body must stay separate from whoever runs the client's internal audit.
No two-year mitigation period: Waiting out the conflict does not make the body eligible to certify.
Opportunities for improvement only: Auditors may flag where the ISMS could improve but must not prescribe the solution.
Accreditation scope: Confirm the body's accreditation covers ISO/IEC 27001 under the relevant scope.

Before you sign, ask the body in writing how it handles conflicts of interest and whether any staff member has advised you on the ISMS.",

What competence criteria a certification body should show

ISO/IEC 27006-1:2024 no longer sets fixed experience numbers for ISMS auditors, so the body itself decides how it qualifies people. The cards below cover what to request before signing, so you can judge whether its stated criteria are real.

Own competence criteria

Since the 2015 edition of ISO/IEC 27006-1 dropped fixed experience figures such as four years of full-time workplace experience, each certification body sets its own competence criteria for ISMS auditors. European Accreditation FAQ 49.1 confirms that the body must set and demonstrate those criteria. Ask for the written criteria document and check that it names the ISO 27001 knowledge, audit skills and technical areas it expects, rather than a vague statement that staff are qualified.

Auditor qualification records

Ask for the qualification record of each auditor and technical expert who would work on your audit, not only the lead auditor. A usable record shows training completed, audit experience on management systems, and the dates and scope of recent audits. Confirm in writing that the named people will conduct your audit and that any replacement will meet the same criteria before stage 1 begins.

Sector and technical experience

An auditor who knows ISO 27001 but not your technology stack, such as cloud platforms, self-hosted infrastructure or regulated data flows, may miss what matters in stage 2. Ask which sectors and technologies the team has audited and whether the body can add a technical expert for specific areas. Confirm that the expert's competence is recorded in the same way as the auditor's.

How the body demonstrates competence

Competence must be shown, not asserted. Ask how the body monitors auditor performance, such as file reviews after audits, observed audits and feedback from clients, and how it removes an auditor whose performance falls short. Ask the accreditation body how it assessed these arrangements. Your readiness work should feed into this discussion, not replace it.

Independence from your preparation

Competence and independence go together. Clause 5.2.2 of ISO/IEC 27006-1, as explained in European Accreditation FAQ 49.4, means a certification body may not provide internal ISMS reviews to a client it certifies. Ask whether the people you hire to prepare your ISMS could be the same people who audit it, and confirm the body's rule in writing before you commit.

Can you switch ISO 27001 certification bodies without losing certification?

Yes, if your certificate comes from an accredited body and you still meet the requirements. Global ACI-TECH-3-002 (M), issued on 10 July 2026, lets an organization transfer valid accredited certification to another accredited body. The body that issued the certificate may not suspend or withdraw it simply because you are moving. That protection only applies while you still meet the certification requirements, so a transfer does not reset your audit obligations or excuse outstanding nonconformities. Confirm that your current certificate is accredited and that it is still valid before you start, because an unaccredited certificate does not carry the same transfer route.

Before you approach a receiving body, confirm that its accreditation covers ISO/IEC 27001 under the Global ACI arrangement and that its scope includes your sector and the size and location of your sites. Ask the receiving body how it will handle the transfer review, what documents it will need from the current body, and whether it will want to see your most recent audit report. Plan the timing around your annual audit cycle. Every calendar year needs an audit, so a transfer that lands just before a surveillance audit can create a tight schedule with two bodies in the same year. Agree the date with both bodies in writing.

A transfer keeps the three-year cycle in place. The certificate you receive must show an expiry or recertification due date consistent with that cycle, so a receiving body cannot issue a certificate with a short, one-year validity and call it a transfer. Ask the new body to confirm the expiry date and the next audit due date in writing, and keep that confirmation with your certificate records. Also check that the scope on the certificate matches your current ISMS scope, since a scope change during a transfer can trigger extra review time and cost that you should raise in your quote.

Mistakes that cause rework when choosing or checking a body

Most rework in ISO 27001 certification comes from a few predictable errors made at selection and checking time, before any audit starts. Each mistake below is cheap to avoid and expensive to unwind once a certificate has been issued on the wrong basis.

Trusting the PDF certificate alone

A certificate file can be copied, edited or simply out of date, so it proves little on its own. Search the certificate holder and certification body in IAF CertSearch before signing anything, and confirm that the scope, sites and status on the database match the document you were sent. Ask the certification body directly if the entry is missing or unclear. Keep a dated record of the check for your procurement file.

Accepting an unconforming expiry date

Under ISO/IEC 17021-1, a certificate must show an expiry or recertification due date that fits the three-year cycle, with an audit in every calendar year. A certificate issued with a one-year validity does not conform, and customers who read the expiry date will question it. Check the expiry date on the certificate and in the database, and ask how the surveillance schedule will be set before you commit.

Relying on a withdrawn 2013 certificate

All certificates to ISO/IEC 27001:2013 had to expire or be withdrawn by 31 October 2025, the end of the transition period set by IAF MD 26:2023. A supplier offering a 2013 certificate today is offering a document that no longer counts. Require a certificate against ISO/IEC 27001:2022, and confirm in the database that the 2013 entry has been withdrawn or has expired.

Choosing a body outside its accreditation

Accreditation applies to specific scopes, and a body may hold accreditation for some services, sectors or locations but not others. If your ISMS covers several sites, remote staff or a particular service, ask the body to show that its accreditation covers that scope and the sites in question. Confirm this with the national accreditation body or in the certification body's scope listing, not only from its sales material.

Hiring a consultant who also audits

A consultant who performs your internal ISMS audit or a pre-audit cannot also be relied on as independent by the certifier. ISO/IEC 27006-1 requires a certification body to stay independent of whoever performs the client's internal ISMS audit, and a body may not provide internal ISMS reviews to a client it certifies. Separate the roles in the contract: one party prepares the ISMS, a different party runs the internal audit, and the certifier audits independently.

Questions buyers ask before selecting a certification body

Is accredited certification required for ISO 27001?

No. ISO states that accreditation is not compulsory and that a certificate from a non-accredited body does not necessarily mean the body is not reputable. In practice, many customers and contracts ask for an accredited certificate, so the requirement usually comes from the buyer, not from the standard. Before you choose a body, ask your customers or the contract owner in writing whether they accept only accredited certificates, and which accreditation body they recognize. Then select a body that meets that answer.

Is a certificate from a non-accredited body worth anything?

It can be, but its value depends on who is asking. Accreditation is an independent check that the certification body is competent and impartial, and it is the basis on which buyers can rely on the certificate. A non-accredited certificate may still satisfy an internal governance decision or a customer willing to review the audit itself. Ask the body to show its accreditation status, to explain how it assessed competence, and to state in writing whether its certificates are recognized by the customers you need to satisfy.

How do I verify that an ISO 27001 certificate is valid?

Check the certificate against the certification body's own register and against IAF CertSearch, which ISO points to for accredited certificates. Confirm the certificate number, the scope, the issue and expiry dates, and the accreditation body's logo and reference. Look for an expiry or recertification due date consistent with the three-year cycle. Remember that the ISO logo cannot be used in connection with certification, so a logo alone proves nothing. Where a certificate is not listed, ask the certification body or accreditation body to confirm it directly.

Can the consultant who helped us build the ISMS also certify us?

No. The certification body must be independent of the work it certifies. Under clause 5.2.2 of ISO/IEC 27006-1, a certification body may not provide internal ISMS reviews to a client it certifies, and it must be independent of whoever performs the client's internal ISMS audit. European Accreditation's FAQ 49.4 explains this rule and notes that no two-year mitigation period applies. Ask any candidate body to confirm in writing that it has not provided consulting or internal audit services to you, and keep the consultant and the certifier as separate engagements.

Can we choose a certification body ourselves without outside help?

Yes. ISO advises organizations to evaluate several certification bodies, check that each uses the relevant CASCO standard, and confirm its accreditation. The organization makes this decision and signs the contract, so selection does not require a consultant. Compare at least several bodies on accreditation scope for ISO/IEC 27001, auditor competence in your sector, the audit plan and days proposed, the scope they will accept, and their process for handling nonconformities. Request all terms in writing before signing. An implementation partner can help prepare the evidence, but it does not issue the certificate.

What does a certification body need from us before it can start?

It needs a defined scope, a documented information security management system, and evidence that the organization has operated it. The body will request the scope statement, the Statement of Applicability, the risk assessment and treatment records, internal audit and management review records, and a list of sites and people in scope. Under ISO/IEC 17021-1, a certificate must show a validity period consistent with the three-year cycle. Ask the body which documents it expects at stage 1, how it will plan audit time, and how remote or multi-site work will be handled.

How do we switch to a different certification body?

Under Global ACI-TECH-3-002 (M), issued 10 July 2026, an organization can transfer valid accredited certification to another accredited body. The issuing body may not suspend or withdraw the certificate because the client is transferring, provided the client still meets the requirements. Ask the new body for its transfer procedure in writing, confirm what evidence it needs from the current body, and confirm that the current certificate remains valid during the handover. Keep the existing cycle dates so the next audit obligations do not lapse.

What to ask for in a certification body proposal

A written proposal from a certification body should state, in terms you can check, what it will certify, against which standards, and how it will get there. Ask first for the accreditation scope: the body's accreditation certificate, the accreditation body that issued it, and the exact scope under which it may certify ISO/IEC 27001:2022 management systems. Ask for the accreditation reference and confirm the body's name and address match the accreditation record. The proposal should also name the audit standards it will apply, which for an accredited ISMS body means ISO/IEC 17021-1:2015 together with ISO/IEC 27006-1:2024. Ask the body to confirm this in writing, because a body that cannot name these standards is not offering an accredited ISMS audit, whatever its marketing says.

The proposal should show audit days as a calculation, not a lump sum. Ask how many audit days each stage, surveillance audit and recertification audit will take, and which inputs drive that number: the people in scope, the number and type of sites, and any outsourced processes. Your scope decisions set those inputs, so review the ISO 27001 ISMS scope guidance before requesting numbers. Ask whether the body will use remote auditing for any part of the work, which parts, and how it will record that approach in the audit report and certificate. Ask who will perform the audit, how the body confirms that person's competence, and how it will keep the independence rules in mind if your team also uses the same firm for consulting. Explain that the final quote follows from your written scope, and that the drivers of audit fees are covered on the cost page.

Finally, ask the body to describe its certification decision process and its transfer terms in writing. The proposal should say who reviews audit findings, who signs the certification decision, and how long that decision usually takes after stage 2. For transfers, ask whether the body will accept an existing accredited certificate from another accredited body and what documents it will need. Under Global ACI-TECH-3-002 (M), an issuing body may not suspend or withdraw a valid certificate only because the client is transferring, provided the client still meets the requirements, so ask the body to confirm how it applies that rule. Confirm how the certificate and any cycle dates will be stated, and keep the proposal on file, since it becomes the reference for disputes about scope, price and timing.

How DeployOpen prepares evidence for your certification body

DeployOpen works on the systems and evidence behind an ISO 27001 certification, not the certification decision itself. Independent certification bodies issue certificates, so our role is to prepare self-hosted open-source platforms, controls and records that your chosen body can test.

How we scope

We agree the written scope with you before work starts, covering which systems and sites your ISMS evidence must span.
The scope document lists the certification bodies and accreditation checks you will complete, so verification steps are owned and dated.
Engagements are fixed-scope, with deliverables and timelines confirmed in writing before any work begins.

How we build

We configure self-hosted platforms inside your own cloud accounts, data centers or air-gapped networks to produce audit-ready logs and records.
We document how your team checks a certificate in IAF CertSearch and confirms accreditation with the national accreditation body.
We prepare impartiality and independence records so your internal auditors and any consultant stay separate from the certification body.

How we hand over

You receive documented evidence packs, configuration records and runbooks that your staff can present to an auditor directly.
We provide a written checklist for requesting transfer records and confirming a certificate's scope and expiry date.
Your organization keeps ownership of every control, decision and certificate, and the independent body issues all reports.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after the certification decision.
A retainer can cover updating evidence for surveillance and recertification audits across the three-year cycle.
Support scope, response expectations and fees are agreed in writing, with no prices published before a quote follows the scope.