How do you extend an ISO 27001 certificate to a new site or service?
To bring a new site, product or business unit inside an existing ISO 27001 certificate, the organization must change its clause 4.3 scope, update its Statement of Applicability and agree a scope extension with its certification body. The certification body then decides what audit work is needed and issues any reissued certificate. The organization owns its controls and the scope decision. An implementation partner such as DeployOpen can prepare the systems, risk records and evidence for the new area, but it does not issue the certificate, and neither does anyone other than the independent certification body.
Clause 4.3 of ISO/IEC 27001:2022 requires the organization to set the boundaries and applicability of its ISMS, taking into account the internal and external issues in clause 4.1 and the interested party requirements in clause 4.2. Start by writing down what the new site or service is, who works in it, which systems and data it touches, and which shared services it depends on from the existing scope. Then review the risk assessment and risk treatment for the new area, because the Statement of Applicability under clause 6.1.3 d) must reflect the controls chosen for it. Confirm with the certification body which documents it expects in the scope extension request, since its requirements differ in detail.
Do not ask for a fixed duration or fee at this stage. Audit time for a scope extension is calculated by the certification body under ISO/IEC 27006-1, and the starting point is the total number of people doing work under the organization's control within the scope, across all shifts. The number of sites, the amount of change the new area brings to the management system and how much the system has matured all move the result. When you request a quote, ask the body to state the audit days it calculates, the assumptions behind them, whether the work is on site or remote, and how the extension is timed alongside the next surveillance audit.
What happens from the scope decision to the reissued certificate
The sequence turns a decision about new sites, products or services into a revised scope, an agreed audit plan and a certificate that the certification body has reissued against the updated scope. Each phase has a written output that the next phase depends on.
Decide what joins the ISMS
Leadership and the ISMS owner decide which sites, services, products or business units the certificate should cover, and record why. The inputs are the business case, the processes and people involved, and the interested party requirements that drive the change under clauses 4.1 and 4.2. The output is a decision record that names each addition and states whether it is in or out of scope. You know this step is done when the decision record is approved and signed by the people accountable for the ISMS.
Update the clause 4.3 scope and related documents
The ISMS owner rewrites the scope statement under clause 4.3 so it describes the new boundaries, including any exclusions and the reasons for them. The risk assessment and risk treatment plan are reviewed for the new assets, suppliers and locations, and the Statement of Applicability required by clause 6.1.3 d) is revised to reflect any control changes. The output is a revised scope statement, a revised SoA and updated risk documentation. You know this step is done when every document cites the same scope wording.
Notify the certification body and supply updated client data
The organization tells its certification body in writing that it wants to extend the certificate and sends the revised scope, the SoA and the updated information the body needs to plan time, such as the number of people doing work under its control for all shifts and the sites or locations involved. The certification body confirms the application and the information it needs. Ask the certification body for its planning lead time in writing before you commit to a date. The output is a confirmed extension application and an accepted data set.
Agree the scope extension audit time
The certification body calculates the audit time for the extension using ISO/IEC 27006-1, including the scope extension rules added in its 2024 edition, and proposes a plan. The organization reviews the calculation, asks how each factor was applied, and confirms whether any part can be assessed remotely under the certification body's rules. The output is a written audit time proposal and, once accepted, an audit plan that lists the sites or activities to be sampled and the auditors assigned. You know this step is done when the plan is signed off by both parties.
Prepare the new scope for the extension audit
The organization makes the added sites, services or products ready for assessment. Internal audits and management review should cover the new scope, the risk treatment decisions should be traceable to the SoA, and operational records such as access reviews, incident logs, training and change records should exist for the new areas. The output is a set of evidence packs organized by control and location. Because a surveillance-style audit must include continuing operational control, the evidence should show the controls working, not only the documents. You know this step is done when the internal audit findings for the new scope are closed or recorded.
Carry out the extension audit on site, remotely or in a mix
The certification body performs the extension audit as planned, which may be on site, remote or a combination, depending on the scope and the rules that apply to the locations involved. Auditors interview staff, sample records and observe controls in the new scope. Any nonconformities are recorded and discussed at the closing meeting. The output is an audit report with findings and, where applicable, a nonconformity record with the response timeline the certification body sets. You know this step is done when the report is issued and the organization has accepted the findings.
Respond to findings and await the certification body decision
The organization responds to any nonconformities with root cause analysis and corrective action in the form the certification body requires, and provides objective evidence that each action is implemented. The certification body reviews the response and any evidence needed, then makes its certification decision. Only the certification body can make this decision. The output is a written decision record that either confirms the extended scope or sets out what remains open. You know this step is done when the decision record is received.
Receive the reissued certificate and verify it
If the decision is positive, the certification body reissues the certificate showing the updated scope wording, the standard edition and the dates. The organization checks that the scope matches the revised clause 4.3 statement exactly, that the expiry date still follows the three-year cycle, and that the certificate can be found in the IAF CertSearch database. The output is the reissued certificate, which the organization shares with customers and updates in its contracts and questionnaires. You know this step is done when the certificate has been verified and the old certificate is withdrawn from use.
How a clause 4.3 scope change reaches the rest of the ISMS
Clause 4.3 is where a scope change starts, but it is rarely where the work ends. The organization sets the boundary of its information security management system only after it has considered its internal and external issues under clause 4.1 and the requirements of interested parties under clause 4.2. Adding a site, a product or a service therefore means revisiting those inputs first: which customer contracts, regulators and suppliers now bear on the new area, and which of them place requirements on it. A scope change that skips this step produces a scope statement that looks right on paper but does not match what the business actually runs.
The larger effect comes through risk. A new location or service brings its own assets, threats, data flows and dependencies, so the risk assessment under clause 6.1.2 has to cover them, and the risk treatment under clause 6.1.3 has to decide how each significant risk is handled. The Statement of Applicability, which clause 6.1.3 d) requires, must then show the controls selected for the expanded scope and the reasons for including or excluding each Annex A control. Confirm with your certification body which evidence it will expect for each newly in-scope control, since some controls will apply to the new area only in part.
Operational consequences follow from the risk and Statement of Applicability updates. New staff in the added area need the same screening, training and access reviews as existing staff, and new suppliers need the same due diligence and contract terms. Internal audit should sample the new area before the certification body does, and management review should record the expanded scope, the new risks and any decisions about resourcing. Ask your certification body early how these changes will be presented at the next surveillance audit, because the auditor will test whether the ISMS works in the new area, not only whether the documents have been updated.
What makes a scope extension take more or less audit time
Certification bodies set audit time from the size and complexity of what is being added to the certificate. The cards below cover the drivers that move that number up or down, and what the organization can prepare before the audit team asks for its estimate.
Persons doing work under control
The starting point for ISMS audit time is the total number of persons doing work under the organization's control, counted across all shifts (European Accreditation FAQ 35.3). Adding a site or business unit adds those people to the count, so the audit plan grows with headcount, including contractors and shift workers. Before the audit, prepare a dated list of people by site and by role, with shift patterns, and confirm with the certification body which groups it counts. Ask for the basis of the estimate in writing.
Number and type of new sites
Each new location adds travel, opening and closing meetings, and site sampling, so the number of sites and their type matter as much as their size. A data center or plant with its own controls usually takes more time than a small office that relies on central services. Confirm with the certification body how it treats sites with no physical presence, and document which controls are run from the head office and which are run locally.
Share of work auditable remotely
The portion of work that can be assessed through remote means affects how much time must be spent on site. Remote assessment is possible only where the certification body's rules and the Global ACI document on the use of ICT in audits allow it, and IAF MD 29:2024 requires certificates for clients with few or no relevant physical sites to state that activities are conducted remotely. Ask which processes need an on-site visit, and prepare system access and recorded evidence in advance.
Maturity of the new area
A new area that already runs documented, tested controls generally needs less audit effort than one that is being set up for the first time. Under ISO/IEC 17021-1, every surveillance audit must include continuing operational control, so an area with immature operations will draw more sampling of records and activity. Before the audit, document the existing controls for the new area, show a completed risk assessment and at least one internal review, and identify gaps honestly.
Changes to suppliers and cloud services
New suppliers, hosting providers or cloud accounts bring their own controls into the scope, and auditors often need to see how those services are governed and monitored. A change in cloud provider or a new outsourced operation can add sampling and evidence requests beyond the new sites themselves. List every supplier and cloud service that supports the new area, with contract terms and security responsibilities, before requesting the audit time estimate.
Planned time reviewed at each surveillance
The estimate is not fixed once the scope is agreed. The certification body obtains updated client data at each surveillance audit and reviews the planned audit time at least at every surveillance and recertification audit, so that it reflects changes in the organization and in system maturity (European Accreditation FAQ 38.19). Expect the figure to move as headcount, sites and suppliers change, and record each change against the scope and Statement of Applicability updates.
Add to the existing certificate or issue a separate one
This table compares extending the current ISO 27001 certificate with keeping a separate ISMS and certificate for a new business unit. Read each row against your own structure: if the new site or service runs on the same ISMS and leadership, extension usually fits, and if it has its own management system or legal entity, a separate certificate may fit better. The certification body makes the final call, so confirm the chosen option in writing before work starts.
| Question | Extend the existing certificate | Issue a separate certificate |
|---|---|---|
| When it fits | New site or service runs under the same ISMS, policies, risk assessment and top management | New business unit has its own management system, leadership and, often, its own legal entity |
| Scope wording | Clause 4.3 scope is updated to name the added sites or services | Each certificate has its own clause 4.3 scope, with no overlap in what it claims |
| What the certification body needs | Updated scope, revised Statement of Applicability and evidence the new area is under the same ISMS | Separate application, stage 1 and stage 2 audits, and its own audit time calculation |
| Audit time | Scope extension time is assessed under ISO/IEC 27006-1, so ask the body how it applies | Full audit time for the new ISMS, planned from the people doing work under its control |
| What the organization owns | Decision on scope, ownership of controls, risk treatment and management review for the added area | Own ISMS, own policies, own management review and own internal audit programme |
| What the implementation partner prepares | Scope documentation, gap analysis of the new area, evidence mapping and internal audit support | Full ISMS set-up for the new unit, including risk assessment, policies and evidence collection |
| Ongoing cost and effort | Usually one shared surveillance and recertification cycle, with extra audit time for the new area | Separate surveillance and recertification cycles, each with its own audit time and fees |
| Main risk | Scope creep or unclear boundaries that the auditor later questions | Duplicated controls and inconsistent evidence across two certificates |
How new sites, services and acquisitions change the extension
A new physical site is the most direct case. The organization first decides whether the site handles information within the ISMS, which follows from the context and interested party reviews required by clauses 4.1 and 4.2 and the scope set under clause 4.3. If the site is in scope, the scope statement must name it, and the certification body audits it before the certificate changes. The audit time question arises because the certification body has to recalculate effort for the added people and activities.
- Scope statement: Name the site, its address and the processes it runs, so the wording does not suggest coverage the audit never tested.
- Statement of Applicability: Review each Annex A control against the site's assets, locations and risks, and record the result under clause 6.1.3 d). Physical and environmental controls often change most here.
- Audit time: The starting point is the number of people doing work under the organization's control at the site, across all shifts, plus time for any new processes. Ask for the calculation in writing.
- Multi-site effect: If the new site makes the organization multi-site, the Global ACI multi-site document applies, and ISO/IEC 27006 rules take precedence where they set scheme-specific requirements.
- Certificate: The updated certificate must list the covered sites. Confirm whether the body issues a revised certificate or a new one, and the effective date.
Check whether the extension audit runs separately or combines with the next surveillance audit, because that choice changes the schedule.
A new product or service run from sites already in scope changes what the ISMS covers, even though the location stays the same. The scope statement may need to name the service, since the certificate should describe the activities the audit tested. The Statement of Applicability often changes more than the scope, because new processes bring new risks, suppliers, data flows and technical controls. The certification body still needs to see the service operating under the management system, including the operational controls that surveillance audits examine.
- Scope wording: Describe the service in terms a customer could check. Broad phrases that imply the whole company is certified are a common source of customer confusion when only one product line is in scope.
- Risk assessment first: Run the risk assessment for the new service before editing the Statement of Applicability, so each control inclusion or exclusion traces to a recorded risk.
- Operational evidence: Auditors expect records of the service running under the ISMS, such as incident handling, access reviews and change approvals, not only policies that describe them.
- Audit time: The starting point stays the people doing work under the organization's control. The calculation depends on how many staff run the service and whether they work at sites already audited.
- Surveillance sampling: Because every surveillance audit must include continuing operational control, the new service is likely to be sampled at the next visit once it is in scope.
Confirm with the certification body whether the change needs a separate extension audit or can be handled at the next surveillance audit, and get that answer in writing.
An acquisition adds people, systems and sometimes sites that were never audited under the acquirer's ISMS. The first decision is whether the acquired unit joins the existing certificate, receives its own certificate, or stays outside scope until integration is complete. The scope statement must state clearly which entities are covered, since a certificate that names a group without limits can mislead customers. The acquired unit's controls and risks must be assessed before its inclusion is recorded in the Statement of Applicability.
- Scope decision: Choose between immediate inclusion, inclusion after integration, or exclusion. Document the reasons, because the certification body will ask for them and may challenge them.
- Gap analysis: Compare the unit's access, supplier, incident and change processes against the ISMS. Systems that still run separately often produce the largest findings.
- Statement of Applicability: Add or justify each control for the acquired unit's assets and locations, and note any controls delivered through the parent's shared services.
- Audit time: The certification body counts the people working under the organization's control in the acquired unit. It may plan a larger audit while systems remain unintegrated.
- Legal entities: Confirm whether the acquired company is a separate legal entity and how the certificate will describe it, so the certificate matches the actual corporate structure.
Ask the certification body early whether it expects a pre-extension review, and plan integration milestones against the surveillance schedule.
Some organizations deliver services through remote work, cloud platforms and distributed staff, with few or no relevant physical sites. The scope still has to describe what is covered, but the site question changes to how the certificate records activities conducted remotely. IAF MD 29:2024 requires certificates for clients with few or no relevant physical sites to state that activities are conducted remotely. The certification body also needs to see how remote work is controlled, because the audit still tests whether the system operates.
- Certificate wording: The certificate must state that activities are conducted remotely, so customers reading it understand that there is no single office to visit.
- Scope definition: Describe the activities and the teams that perform them rather than a physical address. Name any cloud or hosting providers that fall inside the scope.
- Statement of Applicability: Give closer attention to controls on remote working, endpoint devices, home networks, and supplier access to cloud environments.
- Remote audit method: Confirm which parts of the audit the body can run remotely under its own arrangements and ICT rules, and which parts need direct observation.
- Multi-site rules: Where the organization still operates several locations, the Global ACI multi-site document applies, and ISO/IEC 27006 scheme rules prevail where they differ.
Ask the certification body how it will verify that remote activities are controlled, and what it will sample, before you agree the scope.
Where scope extensions stall and how to avoid each delay
Scope extensions rarely fail on the audit day itself. They stall earlier, when the scope statement, the Statement of Applicability, the staff count, the certification body and the surveillance plan fall out of step with each other. The cards below cover six of the most common points where that happens and a practical check for each.
Scope changed without the SoA
The clause 4.3 scope statement is reworded to include the new site or service, but the Statement of Applicability is left as it was. Clause 6.1.3 d) requires the SoA to justify which Annex A controls apply, so the new area's controls and exclusions must be reasoned in it. Keep a written scope change record that lists the old and new scope wording, the SoA revision that matches it, and the approver. Check both documents against each other before any submission.
New area certified before controls operate
The new site or service is added to the certificate scope while its controls are still being designed or have no operating records. Certification auditors test operation, and ISO/IEC 17021-1 requires audits to include continuing operational control, so a newly added area with no history gives the auditor little to sample. Agree an operating period with the certification body first, then run the new controls long enough to generate access reviews, incident records, training and risk review evidence before requesting the audit.
People count estimated, not counted
Audit time for an extension starts from the number of people doing work under the organization's control, counted across all shifts. Estimates taken from headcount reports or org charts often miss contractors, shift workers and staff at the new location. Build the count from payroll, identity directory and contractor registers, and record the date and method used. Ask the certification body which population it will accept as the starting point, since the answer changes the audit days quoted.
Certification body told after go-live
The new site, product or service starts operating and is only reported to the certification body later. Because the certification body must update client data and review planned audit time, a late notice can leave the audit plan, fee quote and certificate wording out of date. Notify the certification body in writing before the change takes effect, and state the proposed effective date, the scope wording, and whether the change is an addition at an existing site or a new site.
Remote auditing assumed, not confirmed
Teams plan the extension audit around remote review of the new area because it seems faster, without confirming how the certification body performs it. Remote methods are governed by the certification body's own procedures and the Global ACI rules on use of ICT in audits, and some elements still need a site visit. Ask the certification body which activities it accepts remotely, what tools it uses, how it records evidence, and which parts of the new area it will inspect on site.
Surveillance plan leaves new area out
The next surveillance audits are planned from the old scope, so the new site or service is not sampled for most of the three-year cycle. Under ISO/IEC 17021-1, a surveillance audit happens in each calendar year of the cycle, and the planned audit time is reviewed at each one. Ask the certification body to add the new area to the surveillance sampling plan explicitly, and keep a register that shows which areas each audit covered so no part of the scope goes unchecked.
Questions buyers ask about scope extensions and audit time
Does a new site have to be audited on site?
Usually yes for a site where the work is physically done, but the answer depends on what the site does and how the certification body applies its multi-site rules. The certification body decides whether the new site needs a visit, a remote check or a sample-based approach, and it records that decision in its audit plan. Global ACI-TECH-3-001 governs multi-site audits, but scheme-specific rules in ISO/IEC 27006-1 take precedence. Ask the certification body to state in writing which sites it will visit, which it will sample and which it will review remotely, and why.
How is audit time calculated for a scope extension?
Audit time starts from the number of people doing work under the organization's control for all shifts in the added scope, then adjusted for factors such as the complexity of the processes, the locations involved and whether the work is done remotely. ISO/IEC 27006-1:2024 added specific audit time requirements for scope extensions in its clause C.7, which the certification body applies when it estimates the extra days. The certification body should show you the headcount it counted, the factors it applied and the resulting days in its written quote. Ask what happens if the headcount changes between the quote and the audit.
Can a scope extension wait until the next surveillance audit?
It can in some cases, but the certification body decides, and it cannot be assumed. Extensions are often handled at a dedicated audit, or combined with a surveillance audit if the timing and evidence allow. Every surveillance audit must include continuing operational control of the system, and the certification body reviews the planned audit time at each surveillance and recertification audit to reflect changes in the organization. Confirm with the certification body whether the new scope will be assessed at the next surveillance visit or at a separate audit, and what evidence it needs before that visit.
What must the organization give the certification body for an extension?
The organization must supply an updated scope statement, an updated list of sites and people in the added scope, and a revised Statement of Applicability showing how the new activities are covered by the risk assessment and the controls. It should also provide evidence that the new scope operates under the management system, such as internal audit and management review records that include the added activities. Ask the certification body for its application form and document list before you start, because the requirements vary by body and by the type of extension.
Can an implementation partner prepare the evidence for a scope extension?
A partner can prepare systems, procedures, records and documentation for the added scope, including updating the clause 4.3 scope statement, the risk treatment and the Statement of Applicability, and running internal audits and management review. The organization still owns its controls and must be able to show they operate. Only the certification body decides whether the extension is granted, and the partner cannot issue or reissue a certificate or confirm the outcome of the audit. If you use the same firm for implementation and for audit preparation, check that the certification body accepts that arrangement.
Is the certificate reissued after a scope extension, and how should customers check it?
The certificate is reissued by the certification body only after it has reviewed the extension and is satisfied with the outcome, and the new certificate shows the updated scope. Do not rely on the old certificate or on a letter from the implementation partner. Customers should check the scope wording, the standard edition, the expiry date and the accreditation behind the certificate, then verify it in the IAF CertSearch database that ISO points to for accredited certificates. Ask the organization for the reissued certificate and confirm that the scope on it matches the services you are buying.
What drives the cost of a scope extension?
The main drivers are the number of people in the added scope, the number and type of sites, whether the work can be checked remotely, how much new documentation and evidence the extension needs, and whether it coincides with an existing audit. Costs have two parts: the internal effort to update the management system, which you pay in staff time and any external help, and the certification body's audit fee, which follows its quote for the added audit time. Ask the certification body for a written quote that separates the audit days from any travel, report and certificate charges, and ask the implementation partner for a fixed-scope proposal listing its deliverables.
What to check before you engage a certification body or consultant
A scope extension changes what the certification body must audit and what your consultant must prepare. The checks below separate the body that issues the certificate from the partner that prepares systems and evidence, so you know who is accountable for each deliverable.
Confirm accreditation for ISMS certification
Ask the certification body which accreditation body accredits it for ISO/IEC 27001 certification, and confirm that the accreditation covers ISMS certification specifically. Check the certificate and the body's listing against the IAF CertSearch database, which ISO still points to for checking accredited certificates. An accredited body must operate to ISO/IEC 17021-1 together with ISO/IEC 27006-1, so ask when it applied the 2024 edition to your file.
Request the written scope audit time method
Ask for the certification body's documented method for calculating audit time when you add a site, service or business unit. ISO/IEC 27006-1:2024 added specific audit time rules for scope extensions, so the method should show how the body counts people in the new scope and how it adjusts time for remote or multi-site elements. A vague answer about "a days-based estimate" is a reason to ask again before you commit to a quote.
Check the independence policy
Ask whether the certification body has a written independence policy covering consultants it has previously seen, trained or certified, and what it does when the consultant who prepared your scope later sits on the audit team. The certification body must stay independent of the work that goes into your system, so a consultant should not design the controls that the same body then certifies without clear separation. Ask for the policy in writing.
Verify experience with the new sites or services
Ask the consultant for examples of scope extensions it has prepared for, specifically the type of site, product or service you are adding, such as a new data center, a SaaS product or an outsourced function. Ask which of those projects involved changes to the Statement of Applicability and how the consultant handled supplier and third-party controls for the new scope. Request references you can contact, and treat unverifiable claims as unverified.
Limit the consultant to preparing evidence
Confirm in the contract that the consultant prepares systems, records, the revised scope and the Statement of Applicability, but does not issue reports, certificates or attestations. Only the certification body decides conformity and issues the certificate. Your own staff must own the controls and the decisions about the scope, and the contract should say so. A consultant that promises a certificate outcome has overstated its role.
Agree who does what before signing
Before you sign, ask in writing who writes the revised scope statement, who updates the Statement of Applicability and the risk treatment record, who attends the audit and who answers auditor questions on the new site. Ask how the consultant will hand over evidence and whether your team will review it before submission. Clear answers to these questions set the responsibilities for each deliverable and the fixed scope agreed before work starts.
How DeployOpen prepares a scope extension for certification audit
DeployOpen works on extending an ISO 27001 certificate to new sites, products or services by preparing the systems, controls and evidence that the new scope needs before the certification body audits it. The organization keeps ownership of its ISMS and its scope decisions, and only the accredited certification body decides whether the extension is granted.
How we scope
- We agree a written scope that names each new site, service or business unit and the systems that support it.
- We confirm with you how many people work under your control at each new location, since that count drives audit time.
- We identify which clause 4.3 wording changes are needed and which existing controls already cover the added scope.
How we build
- We extend the asset inventory, access model and logging so the new scope is covered by the same controls as the original scope.
- We update the risk assessment and the Statement of Applicability for the added scope, with reasons for each control's status.
- We test the new controls in your environment and record the results so the auditor can see operating evidence, not just design.
How we hand over
- We deliver the updated scope statement, Statement of Applicability, risk treatment records and a list of evidence locations for each control.
- We prepare an evidence pack for the new sites or services and walk your team through where each record is kept.
- We document open items and the actions to close them, so your team can answer certification body questions without us.
How we support
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- Ongoing support, upgrades and continuous testing are available as a retainer for surveillance audit preparation.
- Confirm with your certification body how it will treat the extension, including audit time and whether a remote or on-site visit is needed.
Sources and further reading
- ISO/IEC 27001:2022 preview (contents, introduction and clauses 1 to 4.2) ↗
- European Accreditation FAQ 35.3: ISMS audit time and persons in scope ↗
- European Accreditation FAQ 48.5: ISMS multi-site audit time ↗
- IAF MD 29:2024 Transition requirements for ISO/IEC 27006-1:2024 ↗
- Global ACI-TECH-3-001 (M): multi-site audit and certification ↗
- European Accreditation FAQ 51.7: certification cycle ↗
