What does an ISO 27001 certificate prove to a customer?
When a customer, contract or regulator asks for ISO 27001, the certificate shows that an external certification body audited your information security management system against ISO/IEC 27001:2022 and issued a certificate for a defined scope. ISO itself does not certify organizations and does not issue certificates, so the certifying body is the party whose work the customer is relying on. The certificate is evidence that a management system was tested at a point in time, not a guarantee that every system, control or incident in the organization is secure.
Three things change how much weight a given certificate deserves. The first is the accreditation of the certification body, since accredited ISMS bodies work to ISO/IEC 17021-1 and ISO/IEC 27006-1, while ISO notes that accreditation is not compulsory and that a non-accredited body is not necessarily disreputable. The second is the scope printed on the certificate, which defines which business units, sites, products or services are covered and is the first thing a customer should compare against the service they are buying. The third is whether the certificate is still inside its three-year cycle, supported by annual audits. Confirm all three with the certification body and in the IAF CertSearch database before you rely on the document.
The organization owns its controls and the decisions behind them, including its risk assessment, Statement of Applicability and management review. An implementation partner can prepare systems, configuration evidence and documentation, but it cannot issue the certificate or stand in for the auditor's judgment. When you explain the certificate to a customer, state the certifying body, the accreditation status, the scope and the certificate's validity dates, and be clear about what the scope excludes.
What the certificate covers and what it leaves out
An ISO 27001 certificate confirms that an accredited body found the organization's management system conforming to the standard within a stated scope. The cards below separate what that confirmation establishes from what buyers still need to request, test or negotiate on their own.
A management system, not a product
The certificate attests to how the organization runs information security: its policies, risk process, roles, reviews and corrective actions. It does not certify that a specific product, service, cloud platform or application is secure. Buyers who need assurance about a particular system should ask for the evidence behind that system, such as configuration records, access reviews and penetration test reports, alongside the certificate.
Only the stated scope
The certificate names the scope of the ISMS, usually a set of products, services, sites or business units. Anything outside that boundary is not covered, even if it belongs to the same legal entity. Check the scope wording on the certificate against the service a buyer actually receives, and confirm that the sites or hosted environments that store their data fall inside it.
The organization's own requirements
The audit tests whether the organization meets the requirements it set for itself, measured against ISO/IEC 27001:2022. Those requirements come from its risk assessment and its stated information security objectives, so two certified organizations can have different control choices and still both conform. Ask a supplier to explain how its risk assessment drove its controls rather than assuming the certificate settles the question.
Protecting confidentiality, integrity and availability
The ISMS exists to keep information confidential (only authorized people can access it), intact (reliably stored and not erased or damaged) and available when needed. These three properties are the purpose the system serves. A certificate shows that the system is designed and operated to protect them, not that any of the three has been achieved in every incident or period.
Controls selected through the Statement of Applicability
Annex A lists 93 controls, which are guidance-based reference points rather than a fixed checklist. The organization decides which apply, records each inclusion or exclusion in its Statement of Applicability, and justifies the choice. Buyers should read that document, or ask for its summary, to see which controls the supplier chose and which it excluded.
No guarantee against breaches
Certification does not promise that no breach will occur. It confirms a process for finding, treating and learning from risk, including incidents. Ask the supplier for its incident history handling, its breach notification commitments in the contract, and how it has closed corrective actions after past events. Those answers reveal more about operational security than the certificate alone.
Who issues, checks and relies on the certificate
The organization owns its information security management system. It decides the scope, writes the policies, performs the risk assessment, produces the Statement of Applicability, runs the internal audit and management review, and operates the controls every day. Certification is a decision the organization requests, but it does not grant that decision to itself or to anyone it hires.
- Owns the ISMS: the organization is accountable for every clause and control it claims, whoever helped build them.
- Chooses the certification body: it selects and contracts an accredited body and hosts the audits.
- Supplies evidence: records, logs, access reviews and meeting minutes must come from real operations, not from documents written for the audit.
- Does not issue certificates: an internal statement of compliance is not a certificate, and it should not be presented as one.
- Controls the certificate's use: it may publish the certificate and its scope, but must reference the standard in full, such as "certified to ISO/IEC 27001:2022".
Before you rely on any claim, confirm that the organization can show the scope, the certificate, and the most recent audit records.
An implementation partner helps the organization prepare its systems, controls and evidence. It may draft the scope, configure tooling, document procedures, run a gap analysis and coach staff. The work is advisory and technical. The partner does not sign off on conformity, and its involvement does not change who owns the result.
- Prepares systems and evidence: for example, configuring logging, access controls or backup records so the organization can show them to an auditor.
- Documents controls: drafting procedures that the organization reviews, approves and adopts.
- Does not issue reports or certificates: neither DeployOpen nor any consultant can issue a certificate or attestation.
- Should stay independent of the auditor: a partner that also audits the same ISMS creates a conflict of interest, which the certification body must manage.
- Is paid for scoped work: the written scope, deliverables and timeline define the fee, and any recurring support is a separate agreement.
Check that the partner's contract states what it delivers and what the organization must still do itself.
The certification body is the only party that makes the certification decision. It audits the ISMS against ISO/IEC 27001:2022, reports nonconformities, reviews corrective actions and issues the certificate that names the standard, its issue status and the scope. ISO itself does not carry out certification, so the certification body is the party a buyer should be asking about.
- Makes the decision: a certificate exists only once the body has completed the audit and taken the decision.
- Operates to recognized rules: accredited bodies follow ISO/IEC 17021-1 and ISO/IEC 27006-1:2024, which IAF MD 29:2024 required them to apply to all clients by 31 March 2026.
- Maintains the cycle: ISO/IEC 17021-1 sets a three-year cycle with an audit in every calendar year.
- Keeps its scope accurate: under ISO/IEC 17021-1 clause 8.2.2, the certificate's scope must not be misleading or ambiguous.
- Stays impartial: it cannot be the consultant who built the system.
Ask the body for its accreditation status and the scope of that accreditation before signing.
An accreditation body assesses certification bodies against recognized standards and confirms that they are competent to certify. Accreditation is not compulsory, and ISO notes that a non-accredited body is not necessarily disreputable. Accreditation matters because it lets a buyer check competence without re-auditing the supplier. Since 1 January 2026, the Global Accreditation Cooperation Incorporated (Global ACI) has assumed the roles of the International Accreditation Forum (IAF) and ILAC. ISO still points to IAF CertSearch for checking accredited certificates.
- Accredits certification bodies: it assesses the body, not the organization being certified.
- Does not audit your ISMS: an accreditation body does not certify your organization or review your controls.
- Operates the recognition arrangement: Global ACI coordinates the multilateral arrangement that accreditation bodies rely on.
- Publishes verification records: the IAF CertSearch database lists accredited certificates, and the accreditation body can confirm a certificate on request.
- Sets the accredited scope: a certificate may not reference standards outside the scope of accreditation.
Confirm the accreditation body's name and the certification body's accredited scope, not just the logo on the certificate.
The buyer relies on the certificate to decide whether to trust a supplier, and it should verify the certificate instead of accepting a PDF at face value. Verification checks that the certificate exists, that it was issued by an accredited body, that it covers the service the buyer is purchasing, and that it is still valid. A certificate also tells the buyer only about the scope printed on it, not about the rest of the organization.
- Verify through IAF CertSearch: the database supports individual, bulk and API checks, and ISO also lists contacting the certification body or accreditation body.
- Read the scope: confirm the sites, services and exclusions named on the certificate match the contract.
- Check the standard and issue status: the certificate must name ISO/IEC 27001:2022, not a superseded edition. Under IAF MD 26:2023, all ISO/IEC 27001:2013 certifications had to expire or be withdrawn by 31 October 2025.
- Do not treat a report as a certificate: an independent assessment that is not a certification must be described as such.
- Ask for the Statement of Applicability: where it is shared, it shows which Annex A controls the organization claims.
Before relying on a certificate, record the verification date and the certification body's contact details in your supplier file.
Accredited versus unaccredited certification bodies
An accredited certification body has been assessed by an accreditation body against the requirements for certifying management systems. For information security, those requirements are ISO/IEC 17021-1:2015 plus ISO/IEC 27006-1:2024, which IAF MD 29:2024 required bodies to apply to all clients by 31 March 2026. Accreditation therefore tells a buyer that someone independent has checked the body's competence and processes, not just its marketing. ISO itself describes accreditation as adding an independent layer of confidence, but it is not compulsory. ISO advises buyers to evaluate several certification bodies, confirm that each uses the relevant CASCO standard, and check its accreditation status before signing anything.
Accreditation is not the whole answer, though. ISO states that non-accreditation does not necessarily mean a body is disreputable, so a buyer who sees an unaccredited certificate should judge the body directly rather than dismiss it. Ask the body which accreditation body it holds, or whether it holds one at all, and in which scope. Ask which standards it applies to ISMS audits, whether its auditors have ISMS competence records, and how it sets audit time under ISO/IEC 27006-1:2024. Ask how it manages conflicts of interest and whether it has ever provided consultancy to the organizations it audits. Request its impartiality policy and a sample certificate so you can compare the wording against the certificate you will eventually receive.
Verification is the step buyers most often skip. Check any accredited certificate in IAF CertSearch, which ISO points to for verification, and confirm that the certificate names ISO/IEC 27001:2022, its issue status and a scope that matches the services you rely on. If the body is unaccredited, ask for written evidence of its standing and for references from customers you can contact yourself. Keep the verification result in your third-party risk file, and record the date you checked it, because accreditation and scope can change during the three-year cycle.
Which kind of ISO 27001 assurance fits which buyer decision
This table compares three forms of ISO 27001 assurance a buyer may be offered: an accredited certificate, a certificate from an unaccredited body, and an implemented but uncertified claim. Read each row for what the form proves, how to verify it, and the contract wording it can satisfy, then check every claim against the exact requirement in your own contract.
| Assurance option | What it proves | How the buyer verifies it | When it fits a contract requirement |
|---|---|---|---|
| Certificate from an accredited certification body, scope covers the service | An accredited body audited the ISMS to ISO/IEC 27001:2022 and found it conforms within the stated scope, at the date of the certificate | Search the certificate in IAF CertSearch, or ask the certification body or accreditation body to confirm it; check the named standard, issue status and scope | Contracts that require certification to ISO/IEC 27001:2022 for the specific service, sites or products listed in the scope |
| Certificate from a body that is not accredited | A certification body issued a certificate, but its competence and impartiality have not been independently assessed by an accreditation body | Confirm the body's identity and the certificate details directly with the body, then check the CASCO standard it says it follows and whether any accreditation claim is real | Contracts that ask for a certificate but do not require accreditation; buyers should confirm the contract accepts it before relying on it |
| Implemented, uncertified claim supported by evidence | The organization says its ISMS is implemented against the standard and can show records, but no third party has certified it | Request the ISMS documents, the Statement of Applicability, risk assessment, internal audit and management review records, and any independent assessment report | Early vendor reviews or questionnaires that ask for evidence of controls rather than a certificate; not usually sufficient where the contract names certification |
| Scope on the certificate matches the service you buy | The certified scope names the business units, sites and services covered, so only those are assured | Compare the scope wording on the certificate with the services in your statement of work and with any subcontracted parts | Any contract, because a certificate that excludes the purchased service gives no assurance for it |
| Certificate issued under an earlier edition | The certificate may reference ISO/IEC 27001:2013, which had to expire or be withdrawn by 31 October 2025 under IAF MD 26:2023 | Check the issue status named on the certificate and confirm the current version with the certification body | Usually not acceptable for new contracts; confirm the contract wording names the 2022 edition |
| Certificate within the three-year cycle | The certificate reflects the most recent audit, and annual audits continue during the cycle | Confirm the certificate's validity dates and ask for the latest surveillance audit outcome | Long-term vendor relationships where the buyer needs ongoing assurance rather than a one-time check |
| Contract wording requires the certification body to be accredited | Accreditation adds an independent check of the certification body itself, which ISO describes as an added layer of confidence | Verify accreditation through IAF CertSearch and the accreditation body listed for the certificate | Regulated buyers and contracts that state accredited certification explicitly; confirm the requirement with legal counsel |
| Certificate expired, withdrawn or suspended | Nothing current; the earlier certification no longer represents the ISMS | Check the status in IAF CertSearch and ask the certification body for a current letter of status | Not a valid basis for a contract that requires current certification |
How the three-year cycle keeps a certificate meaningful
The sequence runs from an initial certification audit to a decision, then through annual audits to a recertification, so that a current certificate reflects a management system that has been checked again and again rather than once.
Complete the initial certification audit in two stages
The certification body runs stage 1 to review the documented ISMS, including the scope, policies and Statement of Applicability, and then stage 2 to test whether the controls operate in practice. The output is a stage 1 report that identifies readiness gaps and a stage 2 report that lists any nonconformities. You know this step is done when the body has no open findings that block a decision. Ask the chosen body to confirm the interval between stages and how findings are reported, because these depend on its own process and on your organization's readiness.
Close nonconformities and submit evidence
Your organization, not the consultant or the body, owns the corrective actions. Each nonconformity needs a documented root cause, a corrective action and evidence that the fix works. The certification body reviews this evidence before it can move to a decision. The output is an accepted set of corrective action records. Confirm with the body how long it allows for closing nonconformities, since its rules set that limit and it can differ by finding type.
Receive the certification decision
A certification decision is made by a person at the certification body who did not carry out the audit, so that the decision is separate from the audit team. If the decision is positive, the body issues the certificate, which must name the standard with its issue status, carry a scope that is neither misleading nor ambiguous, and reference only standards within the body's accreditation scope. You know the step is complete when the certificate is listed in the body's records and can be verified by customers.
Pass the first annual audit in the following calendar year
Under ISO/IEC 17021-1, the certification body must perform at least one audit, either surveillance or recertification, in every calendar year of the cycle. The surveillance audit samples the management system, including internal audit results, management review, risk treatment progress and handling of nonconformities from the previous audit. The output is a surveillance report and any new findings. A certificate that is valid for only one year does not conform to the standard's cycle, so confirm the audit calendar with the body at the outset.
Pass the second annual audit in the next calendar year
A second surveillance audit takes place in the following calendar year, again sampling the ISMS across its scope and checking whether the organization still maintains its risk assessment, Statement of Applicability and internal audit programme. The output is a further surveillance report and a record that the management system continues to operate. Ask the body how it selects sites, controls and records for sampling, because this affects the preparation effort on your side.
Complete the recertification audit before the cycle ends
Before the three-year cycle ends, the certification body runs a recertification audit that reviews the whole management system, including the scope and any changes to the organization, the risk assessment and the effectiveness of controls over the cycle. The output is a recertification decision and, if positive, a new certificate that starts a fresh three-year cycle. Confirm with the body the timing window for this audit, the fees and whether a lapse would require a new initial audit.
Confirm the certificate status with buyers
Customers and partners can check whether the certificate is current by searching the IAF CertSearch database or by asking the certification body or accreditation body directly. The output is a verified record showing the standard, the scope, the issue status and the expiry. Because the certificate reflects the cycle, a certificate that has lapsed or been withdrawn should not be presented as current, and buyers should confirm the scope matches the services they buy.
How to read the scope printed on an ISO 27001 certificate
The first thing to read on an ISO 27001 certificate is the standard it names. The certificate must identify the management system standard together with its issue status, and ISO asks that standards be referenced in full. A certificate that says certified to ISO/IEC 27001:2022 tells you which edition was assessed. A shorthand such as "certified to ISO 27001" leaves the edition open, and a certificate issued against the 2013 edition after its transition period ended on 31 October 2025 is no longer a valid basis for a current claim. Check the edition and the issue status against the certification body's record in IAF CertSearch before accepting the document.
The scope statement is the part that most often misleads. ISO/IEC 17021-1 clause 8.2.2 requires that the scope must not be misleading or ambiguous. Under an IAF decision, the certificate may not reference standards outside the scope of accreditation, so a body cannot attach an accredited ISO/IEC 27001 claim to activities it was not assessed for. European Accreditation FAQ 36.10 explains how scopes of certification are read. The practical test is whether a reader who knows only the certificate could tell which services, products, sites and business units the ISMS covers.
Compare the certificate scope line by line with the contract. List the services, products, hosting locations, offices and supplier-managed components the customer is buying, then find each one on the certificate. For anything missing, ask the organization in writing what is excluded and why, and whether the exclusion is justified in its Statement of Applicability. Illustrative example: a SaaS vendor sells a platform hosted in two regions, but its certificate names only one region and one product line. The buyer should ask whether the second region is outside the ISMS, and whether the customer data processed there is covered by any other assurance.
Common misreadings of an ISO 27001 certificate
A certificate is a short document with a lot of implied meaning. The six misreadings below are the ones buyers and procurement teams make most often, and each comes down to reading the certificate as broader than the certification body actually tested. Each card gives the correct reading and the check to run before relying on the certificate.
Certificate proves a product
ISO/IEC 27001 certifies a management system, not a product or service. The certificate says the organization's information security management system within a defined scope met the standard at audit time. It does not say that a specific application, platform or cloud deployment is secure. Ask which products, processes and sites sit inside the ISMS scope, and request the product-level evidence (penetration tests, configuration baselines, architecture reviews) separately.
Scope covers the whole company
The certificate lists a scope, and that scope is often narrower than the legal entity. A business unit, a single site or a subset of services may be certified while the rest of the company is not. Clause 4.3 lets the organization define the boundary, but the certificate must describe it accurately and must not be misleading. Read the scope line word for word and compare it with the services and locations you are buying from.
Accepting without checking status or accreditation
A certificate must name the standard and its issue status, and the scope must not be ambiguous. Confirm that the cited edition is ISO/IEC 27001:2022, not the withdrawn 2013 edition, and that the issuing body is accredited for ISMS certification. ISO notes that accreditation is not compulsory, so an unaccredited body is not automatically disreputable, but its certificate carries less independent assurance. Verify the certificate in IAF CertSearch or with the accreditation body before relying on it.
Ignoring the three-year cycle
A certification runs on a three-year cycle, with an audit in every calendar year: surveillance audits in between and a recertification audit before the cycle ends. A certificate that is near expiry, or was issued without the annual audits being completed, may not reflect current operation. Check the certificate's validity dates and ask when the next surveillance audit is due. A lapsed certificate is not a current one, even if the PDF still looks valid.
Confusing readiness with certification
A consultant's gap analysis or readiness report shows how close current practice is to the standard. It is not a certification report and cannot be used as one. Only the certification body issues a certificate, after its own stage 1 and stage 2 audits. A readiness report, even a thorough one, carries no assessor's decision. Ask for the certification body's audit report and certificate, and treat any pre-audit or readiness document as internal preparation.
Certificate replaces contract security clauses
A certificate does not replace the security obligations in a contract. It shows that a management system exists and was audited at a point in time, but it does not set data handling terms, breach notification windows, audit rights, subprocessor rules or service levels. Read the certificate's scope against what the contract requires, and keep the contractual security clauses in place. Where a customer needs evidence beyond the certificate, request the Statement of Applicability and the relevant control evidence under the contract.
Questions buyers ask about ISO 27001 certification
Does ISO 27001 certify a product or a company?
ISO 27001 certifies an organization's information security management system, not a product, service or individual. The certificate states that the organization's ISMS, within a defined scope, was assessed against the requirements of ISO/IEC 27001:2022. A product can sit inside that scope, but the product itself is not certified. Buyers should read the scope on the certificate to see which business units, sites, systems and services are covered. Anything outside that scope is not covered by the certificate, regardless of how mature it is. Confirm the exact scope wording with the certification body before relying on it in a contract.
Who issues an ISO 27001 certificate?
Only an external certification body issues an ISO 27001 certificate. ISO itself does not certify organizations or issue certificates. The certification body audits the organization, makes the certification decision and signs the certificate. The organization owns its controls and its ISMS. An implementation partner, consultant or internal team can prepare the systems, policies and evidence, but none of them can issue the certificate or the audit report. If a vendor offers to issue an ISO 27001 certificate on its own letterhead, treat that as a red flag and ask for the certification body's name and accreditation details.
Is an accredited certification body required for ISO 27001?
Accreditation is not compulsory under ISO, but most customers and contracts expect a certificate from an accredited body. ISO advises buyers to check that the body follows the relevant conformity assessment standard and that its accreditation is valid. ISO also notes that a non-accredited body is not necessarily disreputable. The practical difference is that an accredited certificate carries independent verification by an accreditation body, which many procurement teams require. Ask the certification body which accreditation body accredits it, and confirm that the accreditation covers ISO/IEC 27001 for the sector and scope you need.
How long does an ISO 27001 certificate last?
Under ISO/IEC 17021-1, a management system certification cycle lasts three years. Within that cycle, the certification body must carry out at least one audit in every calendar year, either a surveillance audit or the recertification audit before the cycle ends. A certificate valid for only one year does not conform to that standard. Certificates to ISO/IEC 27001:2013 had to expire or be withdrawn by 31 October 2025, the end of the transition period under IAF MD 26:2023, so any certificate a vendor presents should name the 2022 edition. Ask the certification body for its audit calendar across the cycle.
How can a buyer verify an ISO 27001 certificate?
Buyers can verify a certificate issued by an accredited body in the IAF CertSearch database, which ISO continues to point to for checking accredited certificates. Searches can be run individually, in bulk or through an API. You can also contact the certification body or the accreditation body directly. When you check, confirm the certificate names ISO/IEC 27001:2022 with its issue status, that the scope matches the services you are buying, and that the certificate is current. A certificate that cannot be found in the database is not proof of certification, even if a PDF looks convincing.
Can an implementation partner issue or guarantee an ISO 27001 certificate?
No. An implementation partner cannot issue an ISO 27001 certificate, and no legitimate partner can guarantee one. Certification depends on an independent audit by an external certification body, which makes its own decision based on evidence. A partner can plan the implementation, configure systems, prepare policies and evidence, and support the organization through readiness work. DeployOpen works this way: it prepares systems, controls and evidence for assessments but does not issue audit reports, attestations or certifications. Independent auditors and certification bodies do that work.
What does the organization itself need to do for certification?
The organization must own its ISMS, which means it decides its scope, performs its risk assessment and risk treatment, writes the Statement of Applicability, runs its own internal audits and management reviews, and treats its nonconformities. Staff must follow the controls in daily work, and leadership must demonstrate commitment and resource the programme. Outside help can accelerate preparation, but accountable owners must be named inside the organization. Ask any partner which tasks it expects your team to perform, because the answer shapes how much of the effort stays internal and how much you pay for outside support.
How DeployOpen prepares systems and evidence for an ISO 27001 audit
DeployOpen works on the systems and evidence behind an ISO 27001 certification, not on the certificate itself. We plan and implement self-hosted open-source platforms inside your own infrastructure so that the controls you own can be shown to an independent certification body. The organization keeps accountability for its ISMS, and the certification body decides whether the certificate is issued.
How we scope
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
- We help define which systems, sites and people fall inside the ISMS boundary you propose to certify.
- Written scope names the platforms, controls and evidence sources we will prepare, and what stays with your team.
How we build
- We implement and configure self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks.
- We set up logging, access control and backup routines so that control evidence is produced as systems run.
- We test the configured controls against your own documented requirements before any certification body is involved.
How we hand over
- You receive documentation of configurations, control mappings and evidence locations your staff can maintain.
- We prepare evidence packs that show how each in-scope control operates, for your review and for the auditor to sample.
- Your internal team is trained to run, explain and update the platforms after the engagement closes.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the initial engagement.
- Retainers can cover evidence refresh ahead of surveillance and recertification audits, at a scope agreed in writing.
- Confirm with the certification body which evidence it expects, since audit sampling and reporting are its decisions, not ours.
