Can one ISO 27001 certificate cover several sites?
Yes, one ISO 27001 certificate can cover several offices, plants or data centers, provided they operate under one information security management system (ISMS) and the clause 4.3 scope defines them as part of that system. The certification body, not the organization or its implementation partner, decides how the audit is sampled, how many audit days are needed and whether the sites qualify. Those decisions follow ISO/IEC 27006-1:2024, which takes precedence over the Global ACI multi-site document (Global ACI-TECH-3-001 (M)) wherever the two address the same point. The answer is not the same for every organization. It depends on total headcount, shift patterns, which sites are central and which are local, and whether each site performs the same ISMS activities or only a subset.
Start by asking the customer or contract owner exactly what they need certified. A request for "one certificate across all offices" may cover a headquarters with central IT, a regional plant that runs its own access reviews and a data center that is only a hosting location. Each of those roles changes the audit time and the sampling approach. Ask the certification body for its written multi-site procedure and for a worked estimate based on your headcount, including every person doing work under your control across all shifts, wherever they sit. Confirm whether the body treats any site as having few or no physical sites, because the certificate and audit report must then state that activities are conducted remotely. Budget for the cost components: the certification body's audit days, travel to sampled sites, and internal time to keep site records consistent. The first two of these recur at each surveillance and recertification audit.
How auditors count people across sites
Certification bodies start from the number of people doing work under the organization's control, wherever they sit, and then adjust that figure for shifts, contractors and remote locations. The cards below walk through each counting rule so that the headcount you submit matches what the auditor will use. The certification body, not the organization or its implementation partner, derives the final audit days from its own calculation.
Starting from total persons under control
The starting point for multi-site audit time is the total number of persons doing work under the organization's control, counted across every site in scope, not the headcount of the site the auditor visits. European Accreditation FAQ 48.5 cites clause C.6 of ISO/IEC 27006-1:2024 for this approach. Check that your headcount list covers every location in the clause 4.3 scope, including sites where no auditor will set foot. Count all persons, not only the office staff.
All shifts count
The total for ISMS audit time includes persons on every shift, not only those working during the day. European Accreditation FAQ 35.3 cites ISO/IEC 27006 for this rule. A data center or operations center running three shifts can therefore carry a headcount several times larger than its day roster suggests. Ask your certification body how it expects shift rosters to be documented in the audit planning file.
Determining the initial number of persons
European Accreditation FAQ 48.6 explains how the initial number of persons is determined under ISO/IEC 27006-1:2024. Before a certification body sets audit time, it needs a documented, defensible headcount for the proposed scope. Confirm with the certification body which date the count refers to, how part-time and seasonal staff are recorded, and whether it accepts a signed headcount statement from the organization.
Contractors doing work under control
Contractors and outsourced staff count when they do work under the organization's control, which is a question of control rather than employment status. Managed service staff operating your systems, or consultants with access to your ISMS processes, may need to be included in the headcount. Agree in writing with your certification body which contractors are counted, and keep a current list that matches your supplier and access records.
Staff at sites with no physical presence
People who work from home or from locations with no physical office still count toward the total, since the count is taken wherever the person is located. IAF MD 29:2024 notes that clients with few or no relevant physical sites must have certificates and audit reports stating that their activities are conducted remotely. Check how your scope describes remote workers and how the certificate wording will read before you commit to a remote-only model.
Audit days come from the body
The number of audit days is calculated by the certification body from its own method, which applies the counting rules above together with factors for multi-site and scope. Your implementation partner can prepare accurate headcount records, but it cannot set or guarantee audit days. Ask the certification body for its written audit time calculation before accepting a quote, and check whether it matches the headcount you supplied.
Sites, remote staff and no-physical-site clients
This model fits an organization with one head office that runs the ISMS and several branch offices where staff do similar work under the same policies. The certification body begins with the total number of persons doing work under the organization's control, wherever they are located, and then decides how much of that work it must sample on site. The organization sets the scope under clause 4.3 and must decide which branches belong to it. Branches that handle the same information with the same controls are usually easier to sample, but the organization still needs one central team that governs risk, the Statement of Applicability and internal audits.
- Central governance: The head office holds the policies, risk register and management review records that apply to every branch.
- Branch records: Each branch keeps its own access reviews, asset lists and training records that the central team can pull for sampling.
- Internal audit coverage: Internal audits must reach every in-scope site over the cycle, with corrective actions tracked centrally.
- Exclusions: Any branch left out of scope needs a written reason tied to the information it does not process.
Before the audit, confirm with the certification body how it will sample branches and which evidence it will request from each one.
Plants, factories and data centers often run local operations with their own equipment, shift patterns and physical controls. The physical and environmental controls in Annex A theme 7 depend on the place where the equipment sits, so an auditor usually wants to see at least some of these sites in person. The people count still starts from everyone doing work under the organization's control, including shift workers and contractors on site. Local operations also raise questions about which systems belong to the ISMS and which belong to an operator or a supplier, so the scope statement must state those boundaries clearly.
- Shift coverage: Records for every shift must show the same controls are operating, because the audit time starting point covers all shifts.
- Operational technology: Plant control networks need an explicit scope decision and a documented interface with the corporate network.
- Physical security evidence: Access logs, visitor records, environmental monitoring and equipment disposal records are the items an auditor is most likely to inspect on site.
- Contractors: Third parties working on site fall under supplier controls, so their access and agreements must be evidenced.
Confirm which sites the certification body expects to visit in person and whether any site visit can be replaced by remote evidence.
Some organizations run almost entirely in cloud accounts or with staff who work from home, and have few or no relevant physical sites. ISO/IEC 27006-1:2024 requires the certificate and audit report of such a client to state that its activities are conducted remotely, as recorded in IAF MD 29:2024. This wording tells customers how the audit was carried out, so the organization should expect it to appear on the certificate. Remote work does not remove the need for controls over devices, home workspaces and access to company systems, and those controls still need evidence.
- Certificate wording: Expect the certificate and audit report to say the activities are conducted remotely.
- Remote evidence: Cloud configuration exports, identity provider logs and device management reports replace many site walkthroughs.
- Home and mobile working: Policies, device requirements and training records must cover staff who work outside any office.
- Physical controls still apply: Any residual physical location, such as a hosting provider's facility or an office used for equipment storage, needs a documented decision on how its controls are assured.
Ask the certification body how it verifies remote activities and what it will accept as proof that the provider's facilities meet the physical controls you rely on.
Scoping decisions that change the certificate
The scope statement under clause 4.3 of ISO/IEC 27001:2022 decides which sites, people, services and processes the certificate covers, so it is the first multi-site decision to settle. The organization sets that scope after it has worked through the external and internal issues in clause 4.1 and the interested parties and their requirements in clause 4.2. A customer or regulator who relies on a certificate is relying on that boundary, so the scope has to follow from those earlier analyses rather than from which offices are easiest to audit. Clause 1 limits what can be left out: the scope can be narrowed by organization, location or service, but excluding any requirement in clauses 4 to 10 means the organization cannot claim conformity. An organization therefore cannot exclude a clause, such as internal audit or management review, because one site does not run it. It can exclude a location or a service line, provided the exclusion is justified and the remaining scope still meets every requirement.
The wording of the scope matters as much as its boundaries. The scope statement on the certificate and in the audit report should name the locations, business units or services in plain terms that a reader outside the organization can check. Wording that suggests the whole company is certified when only one plant or one hosting product line is inside the boundary misleads customers, and certification bodies will expect the statement to match what the auditors actually sampled. Before the certification audit, compare the scope text against the Statement of Applicability, the asset inventory and the list of sites in the audit plan. Ask the certification body to confirm in writing how it will record exclusions and sites with no physical presence, since those details appear on the certificate and are later read by customers.
Adding a site after certification is a scope extension, not a routine update. The organization must revise the clause 4.3 scope, and the certification body must assess the change. ISO/IEC 27006-1:2024 added audit time requirements for scope extensions in clause C.7, so the extra time depends on the new site's people and activities, and it should be quoted before the site goes live. Plan the extension alongside the surveillance audit calendar where possible, and confirm with the certification body whether the extension is handled at a surveillance visit or through a separate audit. For the detailed steps, see the page on extending ISO 27001 certification to new sites, products or services, and for the wording rules a customer will check, see the guide to reading an ISO 27001 certificate.
What a multi-site audit costs and who gets paid
This table compares the four cost components of a multi-site ISO 27001 certification: certification body audit days, internal staff time, implementation partner fees and tooling. Read each row for who is paid, whether the cost is one-time or recurring, and what moves it up or down. No fixed amounts are given because each figure follows from its own quote or written scope.
| Cost component | Who is paid or who bears the cost | One-time or recurring, and what drives it |
|---|---|---|
| Certification body audit days | The accredited certification body, billed for audit time it calculates under ISO/IEC 27006-1 | Initial certification, then recurring surveillance and recertification. Drivers: total persons doing work under the organization's control across all sites and shifts, number of sites sampled, remote versus onsite work, and scope changes |
| Internal staff time across sites | The organization's own employees, paid through existing payroll, not an invoice | Recurring across the cycle. Drivers: number of site owners and local contacts, how many sites need local records, and how often sites change |
| Implementation partner fees | An outside implementation partner, if one is engaged, paid under a written fixed scope | One-time for readiness and evidence preparation, with optional retainers for later support. Drivers: number of sites in scope, existing documentation, and how much evidence must be built from scratch |
| Tooling and infrastructure | Software vendors, cloud providers or hosting costs for ticketing, logging, asset inventory and evidence storage | Usually recurring. Drivers: number of sites feeding evidence into central systems, self-hosted versus subscription models, and retention periods |
| Remote or onsite travel | Auditors, travel providers or the organization, depending on the certification body's terms | Recurring at each audit. Drivers: number of physical sites visited, whether a site can be assessed remotely, and the audit plan agreed with the certification body |
How a multi-site certification runs from scope to certificate
The sequence runs from a defined ISMS scope and site list to a certificate that names every covered site, with each step closing on a written output the certification body can test. Ownership stays with the organization, while the certification body decides the audit and issues the certificate.
Define the ISMS scope and site list
The organization sets the scope of its information security management system under clause 4.3 of ISO/IEC 27001:2022, after considering its internal and external issues (clause 4.1) and the requirements of interested parties (clause 4.2). It lists every site in scope, what each site does, which services or business units it supports, and who works there, including contractors and shift staff. Clause 1 does not allow dropping requirements from clauses 4 to 10, so the scope can narrow by location, service or organization but not by skipping clauses. The output is a written scope statement and a site register that the certification body can check against its own records. Confirm the register is complete before you approach a certification body, because it drives the audit time and sampling plan.
Confirm the certification body applies the multi-site rules
Ask the certification body in writing which documents govern its multi-site audits. Global ACI-TECH-3-001 (M), issued 10 July 2026 and implemented 28 August 2026, governs audit and certification of organizations with several sites under one management system, but it states that scheme-specific rules such as those in ISO/IEC 27006 take precedence. Ask the body to confirm that it applies ISO/IEC 27006-1:2024 to your certification, since IAF MD 29:2024 required accredited bodies to apply it to all clients by 31 March 2026. The output is a written confirmation of the governing documents and the body's accreditation status, which you can check later in the IAF CertSearch database.
Agree the sample and audit days
The certification body calculates audit time and decides which sites it will visit. For multi-site organizations, ISO/IEC 27006-1:2024 clause C.6 generally starts from the total number of persons doing work under the organization's control wherever they are located, including all shifts, as explained in European Accreditation FAQ 48.5 and FAQ 35.3. The body then sets how many sites it samples, based on the risk and the similarity of activities at each site. Ask the body to show the calculation, the list of sites it proposes to visit, and the reasons for any site it excludes. The output is a written audit plan and a quote that matches the scope and headcount you supplied in step one.
Run the stage 1 documentation review
The certification body reviews your documented ISMS to decide whether it is ready for a full assessment. Expect the reviewer to check the scope, the policies, the risk assessment and the Statement of Applicability, and to confirm how the central function controls the ISMS across sites, including who owns each process and how site-level records reach the centre. The stage 1 review produces a written report that states any gaps you must close before stage 2 and any site-specific concerns. The output is that report and a confirmed date for stage 2. The stage 1 review cannot be replaced by an internal pre-audit, so keep the report on file for the next audit.
Run the stage 2 audit across the sampled sites
The certification body tests whether the ISMS works in practice at the central function and at each sampled site. Auditors interview staff at each location, sample records, observe controls such as access, asset handling and incident response, and check that each site follows the central procedures and the scope statement. Some sites may be visited on site while others are reviewed remotely, which must be consistent with the body's remote auditing rules and any reporting limits in ISO/IEC 27006-1:2024. The output is an audit report that records each finding by site, with each nonconformity linked to a clause or Annex A control. You should receive the report and a list of findings before the closing meeting.
Close nonconformities and corrective actions
The organization responds to each nonconformity by finding the root cause, correcting the immediate problem, and changing the process so the failure does not recur at any site. The certification body reviews the evidence and decides whether the corrective action is effective, which can require a further visit or a documentary check depending on the grade of the finding. Major nonconformities must be resolved before the body can recommend certification. The output is an accepted corrective action plan for each finding, with records that show the change was applied at the relevant sites, and a written decision from the body that the nonconformities are closed.
Receive the certificate and plan the cycle
Once the certification body is satisfied, it makes the certification decision and issues the certificate, which must show the scope and the sites covered. Only the independent certification body issues the certificate; your implementation partner or consultant does not. Under ISO/IEC 17021-1, a management system certification cycle lasts three years, with at least one audit, either surveillance or recertification, in every calendar year (European Accreditation FAQ 51.7 and FAQ 37.12). The output is the certificate, a published site list, and a surveillance calendar. Check the certificate against IAF CertSearch and record the next audit dates, because each later audit must sample sites again and any new site needs a scope extension.
What must be in place at every site before the audit
A multi-site ISO 27001 certificate covers one management system run from one center, applied consistently at every in-scope location. The items below are what a certification body will look for at stage 1, and each one can be checked before the auditor arrives.
One ISMS with central governance
All in-scope sites must operate under a single information security management system with one owner, one policy set and one set of objectives. Confirm that a central function sets the rules, that each site has a named contact who reports to it, and that the clause 4.3 scope names every site or states the exclusion rule clearly. Ask who approves changes to the ISMS and whether site managers can alter local procedures without going through that route.
Consistent Statement of Applicability
The Statement of Applicability must be one document covering all sites, with each Annex A control marked applicable or not and justified. Where a control applies differently at a site, the justification should say so rather than create a second statement. Check that the version number, approval date and scope wording match across every location and that no site is working from an older copy.
Internal audit and management review across sites
Internal audits and the management review must reach every in-scope site, not only the head office. Check the audit programme for a sampling plan that covers each location within the cycle, that auditors are independent of the sites they examine, and that minutes of management review record decisions and actions for each site. Missing site coverage in these records is a common reason an auditor raises a finding.
Site-level risk records
Risk assessment and risk treatment must reflect local threats, such as physical access at a plant or power supply at a data center, while following the same method as the central risk register. Confirm each site has a dated risk record that links to the central risk criteria, and that treatment decisions flow into the Statement of Applicability. A site with no local risk record is hard to defend at stage 1.
Consistent evidence location
Auditors sample evidence from every site, so records must sit in one predictable structure. Agree a single repository and folder pattern for policies, access reviews, training records, incident logs and backup test results, with site identifiers in the file path. Test it by asking a staff member at a remote site to produce a named record within a few minutes. If they cannot, the evidence process is not yet ready for the audit.
Current persons-under-control list per site and shift
Audit time for a multi-site certificate starts from the total number of people doing work under the organization's control, counted across all sites and all shifts. Maintain a current list per site and per shift that includes employees, contractors and others whose work is controlled by the organization, with the date it was last updated. Certification bodies use this list to calculate audit time, so an inaccurate count can change the audit plan or the fee.
Multi-site ISO 27001 questions buyers ask
Can one ISO 27001 certificate cover all of our sites?
Yes, a single certificate can cover several sites when they operate under one management system and the certification body accepts the arrangement, but the scope statement must name the sites or locations included. The organization sets its ISMS scope under clause 4.3 of ISO/IEC 27001:2022, after considering its internal and external issues and the requirements of interested parties under clauses 4.1 and 4.2. Scope can be narrowed by organization, location or service, but excluding requirements in clauses 4 to 10 is not acceptable for a conformity claim. The certification body decides whether each site can be included, sampled or audited on its own, so confirm the approach with it before you commit to a structure.
How does a certification body count staff across several sites?
The starting point is the total number of persons doing work under the organization's control, counted across all sites and all shifts, not only the people at the site being audited. European Accreditation FAQ 35.3 cites ISO/IEC 27006 for the all-shift rule, and FAQ 48.5 cites clause C.6 of ISO/IEC 27006-1:2024 for multi-site organizations, where on-site audit time is generally calculated from the total headcount wherever those people are located. Contractors and temporary staff who work under the organization's control usually count as well. Ask the certification body to show how it applied these counts to your headcount, including which people it treats as in scope.
Do staff who only work remotely count toward audit time?
Generally yes, when they do work under the organization's control, because the multi-site counting rule looks at where people are located only as a fact, not as a reason to exclude them. The certification body still needs to know where they work, which systems they access and how their work is governed by the ISMS. Remote-only staff affect the audit approach as well as the count, and they should appear in your records for access control, training and acceptable use. Confirm with the certification body how it treats remote workers, contractors on personal devices and home offices before the audit plan is built.
Does opening a new site require a scope extension?
Usually yes, if the new site will be covered by the certificate, because the clause 4.3 scope must be updated and the certification body must agree the change. ISO/IEC 27006-1:2024 added audit time requirements for scope extensions in clause C.7, so adding a site can increase audit days even when the existing sites are unchanged. The Statement of Applicability may also need revision if the new site introduces different risks or controls. Tell the certification body about planned openings early, since timing against surveillance audits affects how the change is reviewed.
How do Global ACI rules change what the certification body must do?
Global ACI-TECH-3-001 (M), issued on 10 July 2026 and implemented on 28 August 2026, governs how accredited bodies audit and certify organizations with several sites under one management system. The document states that scheme-specific rules such as those in ISO/IEC 27006 take precedence where they apply, so the ISO/IEC 27006-1 requirements on counting people and calculating audit time still control the result. The practical effect is that the certification body must document its sampling and site selection decisions and apply the accreditation rules consistently. Ask your certification body which edition of its procedures applies to your audit and whether it is accredited for multi-site ISMS certification.
Can an implementation partner count as an independent party for multi-site certification?
No, an implementation partner cannot provide the independent assessment that a certification body must perform, because the certification body must remain impartial and free of conflicts of interest under ISO/IEC 17021-1 and ISO/IEC 27006-1. A partner that prepares systems, configures tools, drafts the Statement of Applicability and assembles evidence is doing preparatory work, and that work does not replace the audit. European Accreditation FAQ 49.4 addresses conflict of interest rules for ISO/IEC 27006-1 and is a useful reference when you check independence. Only the certification body issues the certificate, and it decides whether any consultancy involvement creates a conflict.
What must our organization do itself for a multi-site certification?
The organization owns its ISMS, so it must set the scope, decide which risks matter, approve the Statement of Applicability, run its internal audits, hold management review and act on nonconformities. It must also maintain a site list that matches the certificate, keep records showing that each site operates the same management system, and make people at every site available for interviews. Outside help can prepare documents, configure tools and run gap assessments, but the accountable decisions and the evidence of operation must come from your staff. Ask the certification body for its written requirements on site records and headcount before the stage 1 audit.
Who owns the ISMS, who prepares it and who certifies it
The organization owns the ISMS, and that ownership does not split by site. Its leadership sets the information security policy, approves the clause 4.3 scope, accepts residual risk and decides which Annex A controls apply and why, as recorded in the Statement of Applicability. Each site may run its own local procedures, but one management system governs all of them, so the central team must hold the authority to direct site managers, withdraw access and enforce the same policy everywhere. Before anything else, confirm in writing which site decisions stay local and which are made once for the whole organization.
An implementation partner prepares the systems, documentation and evidence, but does not decide for the organization. DeployOpen's role, within a written scope, is to help configure the platforms, draft procedures, collect records from each location and assemble the evidence an auditor will sample. Those deliverables stay under the organization's control. The partner should never sign the Statement of Applicability, approve risk treatment or run the internal audit that the organization must perform on its own management system. Ask any partner to list, by deliverable, which items it produces and which the organization must approve.
Only an accredited certification body audits, reports and certifies. It alone issues the report and the certificate, and it determines the audit time and sites it samples. A firm that helped build the ISMS should not also be the certifier, because the people who designed the controls would be judging their own work. The conflict of interest guidance in European Accreditation FAQ 49.4 explains how certification bodies must manage that risk, and it is worth reading before you sign with any implementer. Ask the certification body to confirm in writing that it has no consultancy relationship with the organization or its implementation partner.
Common multi-site mistakes that add audit days
Most extra audit days in a multi-site ISO 27001 certification come from a small set of avoidable problems: vague scope, inconsistent site counts, incomplete headcount, divergent local practice and evidence that is hard to reach. Each card below names one mistake, why it lengthens the audit, and what to check before stage 1.
Unclear scope wording
The clause 4.3 scope statement decides which sites, services and people the certification body samples. A scope that says "all offices" or "our cloud platform" without naming locations, business units and exclusions forces the auditor to ask questions on every visit. Check that each site and excluded function is named, that exclusions are justified without dropping any requirement from clauses 4 to 10, and that the wording matches the certificate the customer will read.
Sites counted inconsistently
Headcount, site lists and the Statement of Applicability often disagree. One document may list twelve sites, another lists nine, and the asset register points to a thirteenth. Certification bodies start their sampling and audit time from these figures, so every mismatch invites a query and a longer review. Reconcile the site register, the HR roster and the scope before the certification body receives its application.
Shift workers left out of headcount
Audit time starts from the total number of people doing work under the organization's control, counted for all shifts. Night-shift operators, contractors on site and staff at remote locations are easy to forget when the count is built from day-shift payroll. Build the headcount from all shifts and all workers under the organization's control, and document how each group was included so the auditor can confirm it quickly.
Local procedures that diverge
Each site often adapts access rules, backup schedules or incident escalation to local needs. When a local procedure departs from the central ISMS without a documented reason or a risk decision, the auditor must sample each site separately to test it. Maintain one central procedure set, record approved local variations in the risk treatment and Statement of Applicability, and test a sample of sites against the central version before stage 2.
Evidence scattered across site servers
When logs, access reviews, training records and vulnerability reports sit on individual site servers or in local spreadsheets, the central management function cannot show it operates the ISMS across the organization. Auditors then request site visits or extra sampling to collect proof. Centralize evidence in a shared, access-controlled repository or self-hosted system with clear retention, and confirm that each site's records can be exported on request.
Late scope extensions
Adding a site, product or service after certification often happens during a busy surveillance cycle, and the new scope then needs its own audit time, a clause 4.3 update and a revised Statement of Applicability. Bringing new locations in at the last minute can push audits into a rushed window. Plan extensions with the certification body early, check how the ISO/IEC 27006-1 scope extension rules apply, and align the timing with the next scheduled audit where possible.
How DeployOpen prepares multi-site systems and evidence
DeployOpen works on the systems and evidence behind a multi-site ISO 27001 scope, inside the client's own infrastructure. The organization owns its controls and its ISMS, and an independent certification body decides whether the certificate is issued.
How we scope
- Agree a written, fixed scope listing which sites, data centers and business units share the ISMS and which are excluded.
- Map the people doing work under the organization's control at each site, so the certification body can work from a clear headcount.
- Record which sites have no physical presence and which work is performed remotely, so the certificate wording matches reality.
How we build
- Set up one central document set and common controls, with site-level records that show each location applies the same procedures.
- Configure logging, access reviews and backups so evidence from every site can be pulled from one place during an audit.
- Test site-level controls, including internal audits at each location, and log the results against the Statement of Applicability.
How we hand over
- Deliver a documented site register, scope statement, control evidence index and internal audit records for the certification body to review.
- Walk the organization's staff through the evidence owners, review cycle and sample records each site must keep current.
- Provide runbooks for adding or removing a site, so future scope changes follow the same documented route.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover, based on the agreed scope.
- Support can cover preparing evidence ahead of surveillance audits and reviewing changes to sites, people counts or services.
- Confirm with the certification body in writing which evidence it will sample and how it expects remote or site-based access to be arranged.
