Does an accredited ISO 27001 certificate matter for your customers?
ISO does not certify organizations; certification bodies do. ISO's own guidance says accreditation is not compulsory and that a non-accredited body does not necessarily lack reputation. An accredited ISO/IEC 27001 certificate is one issued by a certification body whose accreditation was assessed against ISO/IEC 17021-1:2015 plus ISO/IEC 27006-1:2024. When a customer questionnaire or contract clause asks for certification, the first step is to read the exact wording: does it ask for an ISO/IEC 27001 certificate, for an accredited one, or for evidence of an independent audit? Those three requests lead to different decisions about which body to hire. Whether accreditation matters depends on what the customer, contract or regulator requires, not on the certificate alone. Your organization owns its controls and its Statement of Applicability. An implementation partner can prepare systems, policies and evidence, but only the independent certification body issues the certificate, and the accreditation attaches to that body's authority to issue it. Ask the customer or regulator which of these they need, and ask prospective certification bodies to state their accreditation body and scope in writing before you sign anything.
Customers who insist on accreditation usually do so because they want a verifiable, independently assessed assurance chain. Before you commit, confirm the body's accreditation status with its national accreditation body or in IAF CertSearch, and check that the accreditation covers ISO/IEC 27001:2022 in the relevant scope. A certificate that cannot be checked in that database may still be valid for some purposes, but it will not satisfy a requirement that specifically calls for an accredited certificate. Ask your customer whether they accept certificates from non-accredited bodies before you invest in an audit, because switching bodies later is a separate project.
What accreditation adds to an ISO 27001 certificate
Accreditation is an independent check on the certification body, not on your information security. An accreditation body assesses whether a certification body is competent to audit and certify against ISO/IEC 27001 and whether it stays impartial while doing so. ISO advises buyers to evaluate several certification bodies, to check that the body uses the relevant CASCO standard, and to check its accreditation. The practical question for your organization is simple: does the body that issued your certificate hold accreditation for ISO/IEC 27001:2022, and does that accreditation cover the scope you are asking for?
Accredited bodies work to ISO/IEC 17021-1:2015, which sets requirements for bodies certifying management systems, including impartiality, competence, audit planning and decision making on certification. For information security work they also apply ISO/IEC 27006-1:2024, which adds rules specific to auditing and certifying an ISMS against ISO/IEC 27001. Among other things, it governs how the certification body determines the audit time it needs, which is one of the places where a body that is merely careful and a body that is accredited can differ in practice. When you compare proposals, ask each body which edition of ISO/IEC 27006 its audit plan follows and how it calculated the audit days. A body that cannot answer that clearly should be questioned before you sign.
ISO is clear that non-accreditation does not necessarily mean a certification body is not reputable, so an unaccredited certificate is not automatically worthless. What accreditation adds is an independent layer of confidence: a third party has examined the body's competence and impartiality against a published standard, and that examination is repeated over time. Customers that require accreditation usually want that assurance to be verifiable, so confirm the certificate in IAF CertSearch and check the accreditation body named on it. Whether a non-accredited certificate satisfies a particular customer or contract is a question to settle with that customer in writing before the audit starts.
How the Global ACI arrangement changed who accredits certification bodies
Accreditation for ISO 27001 certification bodies now runs through Global ACI rather than the IAF. The cards below separate what changed on 1 January 2026, what stayed the same for verification, and what a buyer should confirm before relying on an accredited certificate.
IAF ceased, Global ACI took over
The International Accreditation Forum ceased operations on 1 January 2026, and Global Accreditation Cooperation Incorporated (Global ACI) took over its role on the same date. The change concerns the body that coordinates accreditation bodies, not the standard itself. When you read older documents that name the IAF, treat them as describing the arrangement that preceded Global ACI, and confirm the current governing body on the Global ACI site.
IAF CertSearch still the check
ISO still points to IAF CertSearch as the place to check accredited certificates. Use it to confirm that a certificate is valid, that the certification body was accredited to issue it, and that the accreditation body is a recognized signatory for ISO/IEC 27001. Ask the supplier for the certificate number and the certification body name, then run the check yourself instead of relying on a PDF or logo.
ISO 27001 as a Global ACI sub-scope
Global ACI-FMRA-001, version 3.3, lists ISO/IEC 27001:2022 (ISMS) as a management system certification sub-scope of the Global ACI multilateral recognition arrangement. This is the document that places ISMS certification inside the recognition framework. Buyers do not need to read it in full, but a procurement file should note that ISO 27001 accreditation is recognized under this structure.
Assessed against 17021-1 and 27006-1
Accreditation of ISO/IEC 27001 certification bodies is assessed against ISO/IEC 17021-1:2015 together with ISO/IEC 27006-1:2024. The first sets general requirements for bodies certifying management systems. The second adds requirements specific to information security, including how audit time is determined. A body accredited only to the general standard, without this sub-scope, is not accredited for ISO 27001 work.
Confirm signatories with your national body
Before relying on a certificate, confirm with the national accreditation body in the certification body's country which signatories cover that body for ISO/IEC 27001. The accreditation scope lists the standards, the edition and the accreditation body that granted it. Ask the certification body for its accreditation certificate and scope document, and compare the scope against the standard named on the ISO 27001 certificate.
Existing certificates need checking, not assuming
Sources supplied for this topic do not describe any change to certificates already issued by accredited bodies, so do not assume one. Check each certificate in IAF CertSearch and confirm the edition it names. Certificates to ISO/IEC 27001:2013 had to expire or be withdrawn by 31 October 2025, so any certificate still citing the 2013 edition needs a closer look.
When customers insist on accreditation and when they accept any certificate
When a regulated buyer or public sector contract names accreditation, the usual reason is that the buyer must show its own regulator or auditor that its suppliers were certified by a body that was independently checked against recognized rules. The customer wants assurance that the certificate was issued under a verified process, not only that a body says so. The requirement is usually written into the tender, the master agreement or a security schedule, and it may name the accreditation body or simply say accredited. Ask the customer to confirm in writing which accreditation body or arrangement it accepts, which standard the certificate must cite, and whether a certificate issued under a Global ACI member's accreditation is acceptable. Then check the certificate in IAF CertSearch before signing.
- Exact wording: Ask for the clause or schedule that contains the requirement and whether it refers to ISO/IEC 27001:2022 or an older edition.
- Accepted accreditation: Confirm whether the buyer accepts accreditation from its national accreditation body and any other accreditation bodies.
- Proof method: Ask whether the buyer will verify the certificate itself, through IAF CertSearch or by requesting a copy from the body.
- Timing: Confirm the date by which the certificate must be valid, since a certificate issued after the deadline may not satisfy the contract.
- Scope: Confirm that the certificate scope covers the services the buyer will receive.
If the requirement is unclear, ask the buyer's procurement or legal team for a written interpretation before the bid closes, and do not assume that a certificate from a non-accredited body will be accepted.
Many procurement questionnaires ask only for evidence of a valid ISO/IEC 27001:2022 certificate. The usual reason is that the buyer wants to confirm that an independent body has assessed the supplier's information security management system, and the buyer's own risk process accepts that outcome without further detail. In this situation the question is usually whether a valid certificate exists, not which body issued it. Still, the buyer may read the certificate's scope, expiry date and accreditation mark, so the answer should match what the certificate says. Ask the buyer to confirm in writing that a certificate from any competent certification body is acceptable, that the standard is cited in full, and whether the buyer needs a copy of the certificate or only the answer.
- Standard reference: Answer with the full reference, such as certified to ISO/IEC 27001:2022, and avoid shorthand that a reviewer may question.
- Scope match: Confirm that the certificate scope covers the service in question, not only the head office.
- Expiry: Check the validity period against the contract dates, since certificates run in a three-year cycle with annual audits.
- Logo use: Ask whether the buyer expects the certification mark on proposals, and confirm the rules that apply.
- Evidence format: Confirm whether a PDF copy or a verification link is enough.
If the questionnaire answer conflicts with the certificate, correct the answer before submission, because an inaccurate statement about certification is a more serious problem than a missing one.
Some smaller customers accept a certificate from a body they have already vetted. Their reason is usually practical: they have checked a body's competence, reviewed its process and decided that its certificates are credible for their purposes. ISO's own guidance says that accreditation is not compulsory and that a non-accredited body is not necessarily disreputable, so this is a legitimate choice for the customer to make. The organization's role is to make the vetting easy, by providing the certification body's name, its standard references and the certificate itself. Ask the customer to confirm in writing which body it has vetted, what criteria it used, and whether the certificate needs to come from that body specifically.
- Named body: Ask the customer whether the approval applies to one certification body or to any body.
- Vetting criteria: Ask what the customer checked, such as the body's standard references and its accreditation status.
- Change of body: Confirm what happens if the organization later moves to another body during the cycle.
- Documentation: Offer the certification body's contact details and the certificate scope so the customer can complete its own review.
- Re-review: Agree when the customer will recheck the certificate, for example at each surveillance audit.
If the customer's acceptance is informal or unclear, ask for it in writing, because a verbal approval may not survive a later change of supplier, body or contract.
Accredited and non-accredited certificates compared
This table compares accredited and non-accredited ISO 27001 certificates across who assesses the certification body, the standards it follows, how the certificate is verified, and what the customer can check. Read it as a decision aid: both routes need a competent certification body, and either certificate covers only the scope it states.
| Aspect | Accredited certificate | Non-accredited certificate |
|---|---|---|
| Who assesses the certification body | A national accreditation body or a signatory to the Global ACI arrangement checks the certification body against recognized standards. | No accreditation body has checked the certification body for ISO 27001 work. The buyer must judge its competence directly. |
| Standards the body is assessed against | ISO/IEC 17021-1:2015 plus ISO/IEC 27006-1:2024 for ISO/IEC 27001 work. | No accreditation assessment applies. Ask the body which standards it applies and whether it uses ISO/IEC 27006-1:2024. |
| How the certificate is verified | Check the certificate in IAF CertSearch, which confirms validity, the body's accreditation and the accreditation body's standing for ISO/IEC 27001. | Verify directly with the certification body. There is no independent accreditation record to search. |
| What the customer can check in IAF CertSearch | Certificate validity, the issuing body's accreditation for ISO/IEC 27001, and whether the accreditation body is a recognized signatory. | Nothing reliable in IAF CertSearch for the certificate itself. Confirm the body's competence and credentials through other evidence. |
| Scope limits | The certificate covers only the scope written on it. Sites, products or services outside that scope are not covered. | The same rule applies. The scope on the certificate defines what is certified, whatever the accreditation status. |
| Competent certification body still required | Accreditation does not replace the body's own competence, impartiality and audit quality. | A non-accredited body still needs to be competent and independent. ISO notes non-accreditation does not necessarily mean a body is not reputable. |
| Organization-side cost drivers | Audit time, scope, number of sites and evidence readiness drive the fee. Ask whether the quote follows the audit time rules in ISO/IEC 27006-1. | Audit time, scope, number of sites and evidence readiness drive the fee. Ask how the body's pricing and audit time compare with accredited bodies. |
| When each option fits | Customers, regulators or contracts that require accredited certification or independent confirmation of the certificate. | Internal programs, lower-assurance needs or customers that accept a certificate without accreditation. Confirm acceptance with the customer first. |
How to verify an accredited ISO 27001 certificate in IAF CertSearch
This sequence tells a customer or procurement team whether an ISO 27001 certificate is valid, whether the body behind it was accredited to issue it, and whether the scope matches what they are buying, with a dated record of the check.
Obtain the certificate and its certificate number
Ask the supplier for the current certificate itself, not a logo or a summary slide. The certificate should name the standard and edition, the scope, the issue and expiry dates, the certification body and the accreditation body or accreditation mark. Record the certificate number exactly as printed, because the search depends on it. The step is complete when you hold a copy of the full document and have noted the certificate number, the organization name and the expiry date. If the supplier cannot produce the certificate, treat that as the first finding of the review.
Identify the certification body and accreditation body
Read the certificate for the name of the certification body that issued it and the accreditation body that accredited that body. These are two different organizations. The certification body makes the audit decision, and the accreditation body checks that the certification body is competent to make it. Write both names down. If the certificate names no accreditation body, you have an answer to whether the certificate is accredited, and the rest of the sequence confirms it. ISO's own guidance is that accreditation is not compulsory, so a missing accreditation mark is a finding to evaluate, not automatically a disqualifier.
Search IAF CertSearch by certificate or body
Open IAF CertSearch and search either by certificate number and organization name or by the certification body. IAF CertSearch lets anyone check accredited certificates one at a time, in bulk or through an API, so a single lookup suits a procurement file. The output is a result record for the certificate, or no result. A no result answer does not prove fraud on its own, since the certificate may be non-accredited or the name may differ slightly in the database, but it means you cannot confirm accreditation through this route and should continue with the body's own records.
Confirm validity, accreditation and signatory status
From the result record, confirm three things: the certificate is valid, the certification body was accredited to issue this certificate, and the accreditation body is a recognized signatory for ISO/IEC 27001. The database check covers these points together, so a result that passes only one of them should not be read as an accredited certificate. Compare the standard, the edition and the expiry date on the record with the copy you hold. Any mismatch in certificate number, organization name or dates goes back to the supplier for explanation before you rely on the certificate.
Compare the certificate scope with the services bought
Read the scope statement on the certificate line by line against the services, sites, products or systems you are buying. A certificate covers only what its scope describes, so check whether the named business units, locations and services include the ones that will process your data or run your service. Look for exclusions and for wording that is broader or narrower than the marketing claim. The step is complete when you can state in writing which parts of the supplier's operation the certificate covers and which parts it does not. Gaps should be raised in the contract, not assumed away.
Record the check date and the evidence
Save the date of the check, the search terms used, a copy or screenshot of the result record, and the name of the person who performed the check. Keep this record with the supplier file so that a later reviewer can see what was confirmed and when. Repeat the check at the next certificate renewal or surveillance milestone, because a certificate that is valid today may be suspended or withdrawn later. This record is what turns a one-time lookup into evidence your own assurance process can rely on.
Treat the search as one check among several
A successful CertSearch result confirms the accreditation position of the certificate at the time of the search. It does not test the supplier's controls, confirm that the audit covered the systems you depend on, or show that the supplier met the requirements in practice. Use the search alongside the scope review, the supplier's most recent audit summary where it is available, and your own due diligence questions. Where a supplier relies on a certificate issued through a body outside the accreditation arrangements, ask the body directly what it can confirm and under which standard it operates.
What IAF CertSearch cannot tell you about an ISO 27001 certificate
IAF CertSearch answers a narrow question: is this certificate valid, was the certification body accredited to issue it, and is the accreditation body a recognized signatory for that standard. A positive result does not tell you how good the audit was, whether the controls behind the certificate are adequate, or whether the scope fits the service you are buying. The database confirms the status of the paperwork, not the quality of the management system it describes. Treat it as the first check in a longer review, not the review itself.
The scope is where customers most often get caught out. A certificate can be valid, issued by an accredited body and correctly listed in the database while its scope excludes the platform, data center, team or product your contract depends on. Read the scope statement word for word, check which sites and services it names, and compare it against the systems that will hold or process your data. Also check the expiry date against the three-year cycle, and confirm with the supplier which surveillance audit is due next. A certificate that is valid today can lapse or be withdrawn later, so ask how the supplier will tell you if its status changes.
The check also says nothing about whether the organization meets its own obligations under clauses 9 and 10 of the standard, such as internal audits, management review and corrective action after nonconformities. Those are assessed at each audit, and the outcome of the last audit is not published in the database. If the answer matters to your decision, ask the supplier for the most recent audit summary, any open nonconformities and the corrective actions taken, and confirm with the certification body which of those documents it will share. Your own due diligence, not a database lookup, is what covers these questions.
How to check a certification body before you sign
A certificate is only as useful as the body behind it, and accreditation is one of several things to verify. The cards below cover the checks that matter most: who accredits the body, what it is accredited for, how it manages independence, how it sets audit time, who else is advising you, and what you are paying for.
Confirm accreditation independently
Ask the body for its accreditation certificate, then verify it yourself with the national accreditation body or in IAF CertSearch. The check confirms the certificate is valid, that the body was accredited to issue it, and that the accreditation body is a recognized signatory for that standard. Do not rely on a logo in the body's marketing material.
Confirm the accredited scope
Accreditation is granted for specific standards, so ask for the scope that covers ISO/IEC 27001:2022. For information security management system audits, the body should assess against ISO/IEC 17021-1 together with ISO/IEC 27006-1:2024. A body accredited for other management systems alone cannot issue a valid ISO 27001 certificate, even if it is accredited.
Ask how conflicts of interest are handled
Ask for the body's written conflict of interest policy and how it applies the independence requirements in ISO/IEC 27006-1:2024. Ask who decides on a conflict, and whether the body will refuse an audit where it has already provided consultancy to you. Accreditation assessors look at this area closely, so a clear answer is a good sign.
Ask how audit time is set
Ask how the body determines audit time under ISO/IEC 27006-1:2024, which includes an annex on how audit time is determined. Ask for the calculation for your scope, including the number of people doing work under your control, sites and remote factors. A body that quotes a flat day rate without a documented basis is harder to defend in an accreditation review.
Keep the auditor separate from your advisers
Confirm that the consultant or implementation partner you use to prepare is not the body that will audit you. A body that also designed your controls may have a conflict it must disclose or manage. Ask the body to confirm in writing which advisers it has worked with for your organization, and keep preparation and certification as separate contracts.
Ask for a written quote tied to scope
Ask for a written quote that names the scope, sites, number of people in scope, audit stages and the surveillance and recertification audits across the three-year cycle. Ask which costs are one-time and which recur, and what changes the price if the scope grows. A quote that lists only a headline figure makes later disputes harder to resolve.
Who owns the controls, who prepares evidence and who certifies
Your organization owns the information security management system. That means the scope, the risk assessment and risk treatment decisions, the Statement of Applicability, the controls themselves and the management review. No outside party can accept these decisions on your behalf, and an assessor will test whether senior management actually makes and records them.
- Scope and context: Your leadership defines the boundary of the ISMS and the interested parties and requirements that shape it.
- Risk decisions: Your team chooses how each risk is treated and records the reasons, including any Annex A control it excludes.
- Operating controls: Your staff run the controls day to day, such as access reviews, training, change approvals and supplier checks.
- Management review and improvement: Leadership reviews performance, approves corrective actions and owns the outcome of internal audits.
- Accountability for evidence: Your people must be able to explain and produce the records that show each control operated over time.
Check that a named owner in your organization signs off each control and each risk decision, and that no document is written solely by a consultant and left unadopted.
An implementation partner helps you prepare. DeployOpen, for example, plans, builds and documents self-hosted open-source platforms inside your own infrastructure, and prepares systems, documentation and evidence for an assessment. The partner works for you, but it cannot make your decisions and it cannot issue any report or certificate. Only an accredited certification body can do that.
- Systems and configuration: The partner builds or hardens the platforms that run controls, such as logging, access management and backups, in your environment.
- Documentation drafts: The partner can draft procedures and records that your team reviews, edits and adopts.
- Evidence preparation: The partner sets up the collection of logs, tickets and configuration records that show controls operating.
- Readiness support: The partner can run internal gap reviews before the certification audit, and it reports findings to you.
- Limits of the role: The partner must not act as the certification body, must not sign off its own work as an audit result, and must not advise on certifications it would later issue.
Ask for a written scope listing deliverables and responsibilities, and confirm which decisions remain with your staff.
The certification body is the independent party that plans and performs the audit, reviews nonconformities and issues the certificate. For a certificate to carry accreditation, the body must be accredited to ISO/IEC 17021-1:2015 together with ISO/IEC 27006-1:2024 for information security management systems. ISO advises checking the accreditation of any body you consider.
- Audit planning and execution: The body sets the audit plan, selects the auditors and tests your controls against the standard.
- Nonconformity decisions: The body grades findings and decides whether they are closed before certification.
- Certificate issue and maintenance: Only the body issues, maintains, suspends or withdraws the certificate.
- Independence: The body must not design or implement the systems it audits, and its own impartiality must be safeguarded.
- Accreditation status: The body's accreditation can be checked in IAF CertSearch and through the national accreditation body.
Before you sign, confirm the body's accreditation scope covers ISO/IEC 27001:2022 and that its auditors are not the same people who helped you prepare.
Questions buyers ask about accredited ISO 27001 certification
Is accreditation legally required for ISO 27001 certification?
No. ISO states that accreditation is not compulsory for certification to ISO/IEC 27001. Whether you need an accredited certificate depends on what your customers, contracts or regulators require. Some buyers write the requirement into procurement rules, and some regulatory regimes name accreditation explicitly, so check the wording of each obligation with the party asking for it. Ask the requesting party in writing whether they accept a non-accredited certificate before you choose a body.
Is a non-accredited ISO 27001 certificate worthless?
No. ISO advises that non-accreditation does not necessarily mean a certification body is not reputable. What matters is whether the body is competent, impartial and works to the relevant standards, and whether your customers accept its certificate. Ask the body which CASCO standard it applies, how it manages conflicts of interest, and who audits its auditors. A certificate from a body without accreditation can still be credible, but some buyers will not accept it, so confirm acceptance before you commit.
How do I find an accredited ISO 27001 certification body?
Start with the national accreditation body in your country, which can tell you which certification bodies hold accreditation for ISO/IEC 27001. You can also search the IAF CertSearch database, which lists accredited certificates and the bodies that issued them. ISO recommends evaluating several bodies and checking that each one uses the relevant CASCO standard and holds valid accreditation. Compare scope, audit time estimates and the auditors' experience in your sector before you sign.
What changed with Global ACI on 1 January 2026?
The International Accreditation Forum (IAF) ceased operations on 1 January 2026, and Global Accreditation Cooperation Incorporated (Global ACI) took over its role on the same date, bringing together the work of IAF and ILAC. For ISO/IEC 27001, the Global ACI multilateral recognition arrangement lists the standard as a management system certification sub-scope, assessed against ISO/IEC 17021-1:2015 plus ISO/IEC 27006-1:2024. ISO still points to IAF CertSearch for checking accredited certificates, so use that database for verification. Ask your certification body which accreditation body it holds accreditation from and confirm that its certificate is listed.
Can my organization check its own ISO 27001 certificate?
Yes. You can check an accredited certificate yourself using the same steps your customers would use. IAF CertSearch lets you verify a certificate one at a time, in bulk or through an API. The check confirms that the certificate is valid, that the certification body was accredited to issue it, and that the accreditation body is a recognized signatory for that standard. Check the standard edition, the scope wording and the expiry date on the certificate against the database entry, because a mismatch in any of these is a common reason a customer rejects a certificate.
How does accreditation affect the cost and effort of certification?
Accreditation usually changes the price and the workload through the certification body's own rules, not through a separate fee you pay to the accreditation body. Accredited bodies must follow the ISO/IEC 17021-1 and ISO/IEC 27006-1 requirements, which shape how they plan audits, document decisions and assign audit time, so the audit file can be more detailed. The main drivers are the number of people in scope, the number of sites, the complexity of your processes and the scope you request. Ask each body for a written quote that breaks out audit days, stage 1 and stage 2 time, and any surveillance and recertification effort over the three-year cycle.
Can DeployOpen issue or guarantee an accredited ISO 27001 certificate?
No. DeployOpen is a Chainscore Labs company that plans, implements and hardens self-hosted open-source platforms in your own infrastructure. We prepare systems, controls and evidence for an ISO 27001 assessment, but we do not issue audit reports, attestations or certificates. Only an independent certification body can issue an ISO 27001 certificate, and whether that certificate is accredited depends on the body you choose. Your organization owns its controls and its choice of certification body, so confirm the body's accreditation with the national accreditation body or IAF CertSearch before the audit.
How DeployOpen prepares your ISO 27001 evidence for an accredited audit
DeployOpen is a Chainscore Labs company that plans, implements and documents self-hosted open-source platforms inside your own infrastructure. We prepare the systems, controls and evidence that an accredited certification body will review, while the certification decision stays with that independent body and your organization owns its controls.
How we scope
- We agree the written scope with you before work starts, including which systems, sites and services the ISMS covers.
- We confirm with your chosen certification body whether it holds accreditation for ISO/IEC 27001:2022 before scoping begins.
- Engagements are fixed-scope, so deliverables and timelines are written down and agreed in advance.
How we build
- We configure self-hosted platforms so the controls in your Statement of Applicability produce logs, records and configuration evidence.
- We document how each Annex A control is implemented, owned and tested, so an auditor can trace it to a system.
- We run internal checks against the evidence list so gaps appear before the certification body's stage 1 review.
How we hand over
- You receive documentation covering systems, configurations, control records and the evidence locations an auditor will request.
- We walk your team through the evidence set so your staff can answer auditor questions without us in the room.
- Your team keeps ownership of the controls, the Statement of Applicability and every record after handover.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers to keep evidence current between audit cycles.
- We can help your team prepare for surveillance audits, which accredited bodies schedule at least once every calendar year.
- DeployOpen prepares systems and evidence only. Audit reports and certificates are issued by independent certification bodies.
