Preparing for and getting through ISO 27001 certification audits: readiness checklists, nonconformities, audit days, multi-site and remote audits, the certificate's scope, accreditation and switching certification bodies.
A readiness checklist for the ISO 27001 certification audit: performance evaluation records, Statement of Applicability, what stage 1 reviews and reports, the interval before stage 2, why a pre-audit cannot replace stage 1, and what stage 2 tests.
How certification auditors grade ISO 27001 findings and what happens next: the ISO/IEC 17021-1 definitions of nonconformity and major nonconformity, the 6-month limit to close majors after stage 2, recertification rules, and corrective action under clause 10.2.
How certification bodies work out ISO 27001 audit time: people doing work under the organization's control as the starting point, the square-root rule for identical activities, multi-site and remote factors, scope extensions, and reviews at each surveillance audit.
Certifying several offices, plants or data centers under one ISO 27001 certificate: the Global ACI multi-site document and the ISO/IEC 27006-1 rules that take precedence, counting people across sites, sites with no physical presence, and scoping decisions.
When ISO 27001 audits can be done remotely: the mandatory Global ACI document on using ICT in audits, ISO/IEC 27006-1 reporting on remote auditing, certificates for organizations without physical sites, and what still needs a site visit.
What an ISO 27001 certificate must show and what customers should check: the standard and its edition, scope wording that cannot mislead, expiry within the three-year cycle, the accreditation behind it, verification in IAF CertSearch and logo rules.
How to add sites, services or business units to an existing ISO 27001 certificate: updating the clause 4.3 scope, audit time for scope extensions under ISO/IEC 27006-1, multi-site rules, timing with surveillance audits, and updating the Statement of Applicability.
The difference between accredited and non-accredited ISO 27001 certificates: what accreditation means, the standards accredited bodies follow, the Global ACI arrangement, what IAF CertSearch can and cannot verify, and why some customers insist on accreditation.
How to move an ISO 27001 certificate to another certification body: the pre-transfer review, which certificates cannot be transferred, how the cycle continues, what the current body may not do, and independence rules for the new body.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.