What must an ISO 27001 certificate show before a customer can rely on it?
A customer, contract or regulator that asks for proof of ISO 27001 needs a certificate that does three things at once: it names the standard with its issue status, such as certified to ISO/IEC 27001:2022, it carries a scope that is neither misleading nor ambiguous, and it shows an expiry or recertification date consistent with the three-year cycle. The certificate should also come from an accredited certification body whose certificate can be verified in IAF CertSearch. Ask for the certificate itself, then check each of these points against it before you accept it. Organizations own their controls, and an implementation partner such as DeployOpen prepares systems and evidence, but only the independent certification body issues the certificate.
The answer changes with the organization. A single office with one set of services produces a short scope statement that is easy to read. A group with several sites, data centers or outsourced operations needs a scope that lists which sites and services are covered and which are excluded, and the exclusions matter as much as the inclusions. Whether accreditation is required depends on the customer's contract or regulator, so confirm that requirement early. Non-accredited certificates exist, and ISO says non-accreditation does not necessarily mean a body is not reputable, but a customer that insists on accreditation will not accept them as proof.
Before you rely on the certificate, run three checks. Confirm the expiry date falls within the cycle, that the scope text matches the services you will be buying, and that the certification body is listed as accredited for ISO/IEC 27001 in IAF CertSearch. Ask the organization for the scope statement and the Statement of Applicability reference, and confirm with the certification body if anything is unclear. Also review how the organization uses the ISO logo, because ISO does not permit its logo in connection with certification. Keep a dated record of these checks, since a certificate that passes today may be withdrawn or suspended later.
Which five elements should a certificate ISO 27001 show?
An ISO 27001 certificate is a short document with a lot of weight, so each element answers a specific question: which standard, which parts of the business, how long it is valid, who issued it and whether that body was accredited. Work through the elements in order and do not accept a certificate that leaves any of them out or blurs them.
Standard reference and issue status
The certificate should name the standard in full, including the year of the edition it was assessed against, such as ISO/IEC 27001:2022. Look for the edition in the body of the certificate, not only in a logo or a footnote. A certificate that cites only the number, or an edition that has been withdrawn, tells you the organization has not moved to the current requirements. Ask the supplier to confirm the edition with the certification body.
Scope statement
The scope describes which business units, sites, services, products or systems the ISMS covers. Read it closely: it should name what is in and, where relevant, what is excluded, and it must not be vague or suggest coverage of more than was assessed. A scope that says the whole company when only one product line was audited is misleading. Compare the scope against the services your contract actually relies on.
Validity, expiry or recertification date
The certificate must show an expiry date or a recertification due date that fits the three-year certification cycle. Certificates with a one-year validity do not conform. Check that the date is in the future and that the organization has scheduled its surveillance audits within the cycle. A certificate that has lapsed or is nearing expiry without a recertification audit booked should be treated as unverified until the supplier confirms otherwise.
Certification body name and accreditation
The certificate should name the certification body that issued it, along with its contact details. Accreditation is shown by the accreditation body's mark or reference, and it is separate from the certificate itself. Ask whether the body was accredited to issue ISO/IEC 27001 certificates at the time of issue, and whether that accreditation covers the standard named on the certificate. Non-accredited certificates can still be genuine, but they give a different level of assurance.
Unique certificate number and issuer details
Each certificate carries an identifying number that the certification body can match to its own records. Note the client name, the registered address, the issue date and any reference to the audit that produced it. Use the number to search the public database of accredited certificates, and confirm that the name and address match the organization you are dealing with. Mismatched names are a common sign of a reused or altered document.
Logo and claims use
Organizations may describe their certification, but the ISO logo is not for certification claims, and a supplier should not present ISO itself as the certifier. Check that marketing material matches the certificate: the standard edition, the scope and the validity should all agree. Any claim that goes beyond the certificate, such as covering sites or products outside the scope, should be questioned before you rely on it.
Why the ISO/IEC 27001:2022 reference matters after the 2013 transition
A certificate is only useful if it names the right version of the standard, so check the edition before anything else. ISO/IEC 27001:2022 is the third edition of the standard, published on 25 October 2022. IAF MD 26:2023 required every certificate to ISO/IEC 27001:2013 to expire or be withdrawn by 31 October 2025, the end of the 36-month transition period. Any certificate you receive today should therefore reference the 2022 edition. ISO/IEC 17021-1 requires a certificate to name the management system standard together with its issue status, so the edition appears on the document itself and should not be inferred from the issue date.
Read the reference in full. ISO asks that standards be cited completely, for example "certified to ISO/IEC 27001:2022", rather than with a shortened form such as "certified to ISO 27001". The short form does not name an edition, so it leaves the reader unable to tell whether the certificate reflects the current controls or the 2013 structure with its 114 controls. Treat any reference to ISO/IEC 27001:2013 on a certificate issued after the transition as a red flag. Ask the supplier why an outdated certificate is still in use, and confirm the status in the public database before accepting it.
The 2024 climate amendment, ISO/IEC 27001:2022/Amd 1:2024, changed clauses 4.1 and 4.2 to address climate change. Do not expect a certificate to list the amendment as a condition of validity, and do not reject a certificate because it omits it. Instead, ask the certification body how it has applied the amendment in its audits of your supplier, and whether the amendment affects the scope or the context-of-the-organization evidence. The answer should come from the certification body in writing, because the certificate itself is unlikely to say.
How to read ISO 27001 scope wording without being misled
A single-site certificate should name the location and the activities inside the boundary, so a reader can tell exactly which people, systems and processes the ISMS covers. The scope statement is the clause 4.3 boundary as the certification body audited it, and it should match the site the customer actually deals with. Ask whether the address on the certificate is the operating site or a registered head office, and whether the activities listed are the ones that happen there.
- Named location: The scope should give the full site name and address, not just a city or a brand name.
- Activities in scope: Look for the specific services, processes or functions covered, such as hosting, development or customer support.
- Exclusions: Any excluded activity should be stated, so a reader does not assume the whole company is covered.
- Vague umbrella wording: Phrases such as "all information security activities" or "global operations" leave the boundary open and should prompt a question.
- Standard reference: The certificate should say "certified to ISO/IEC 27001:2022" with the issue status shown.
Confirm the site address and activities against the organization's own boundary document before you rely on the certificate.
A multi-site certificate covers several locations under one ISMS, so the scope must show which sites are included and how they relate to the central management function. A list of sites is only part of the answer, because a reader also needs to know whether every site is in the sample, whether any site was excluded, and whether the central function is named. Multi-site wording is a common source of ambiguity, so check it closely.
- Site list: The certificate or its annex should list each covered site, with addresses, or point to a schedule that the certification body holds.
- Central function: The scope should identify the head office or central team that manages the ISMS for all sites.
- Site exclusions: Sites that are not covered should be named as excluded, not left out silently.
- Phrases like "and affiliates": Wording such as "and all subsidiaries" or "and partner locations" can extend the certificate to sites that were never audited.
- Sampling language: Ask the certification body how it selected sites for audit, because a certificate that covers many sites does not mean each site was visited.
Ask the organization for its current site list and confirm that every site it names appears on the certificate or in its schedule.
A product or service scope describes what is delivered to customers rather than where it is run. Software vendors and SaaS providers often name a platform or service, and the scope should make clear which production environment, support functions and development activities sit inside the ISMS. Readers need to know whether the certificate covers the service itself or only the company that operates it, because those are different boundaries.
- Named service: The scope should name the product or service precisely, with its version or environment where that matters.
- Supporting functions: Check whether hosting, support, development and data handling are included or excluded.
- Shared infrastructure: If a cloud provider or other third party runs part of the service, the scope should say how that is handled, and the customer should confirm which parts sit under the organization's control.
- Marketing terms: Words such as "enterprise-grade" or "fully secure platform" do not define a boundary and should not appear in a scope statement.
- Product certification claims: A certificate for an ISMS does not certify the product itself, so a scope that implies product certification is misleading.
Ask the organization to show the service boundary in writing and confirm that the certificate describes the same service sold to you.
Some scopes name a team, department or business unit rather than a site or product. This can be valid, but it is often ambiguous, because a reader cannot tell which systems, people or contracts the team controls. An ISMS scope under clause 4.3 must be defined by the organization, yet the wording should still be specific enough that an outsider can understand what is inside and outside the boundary.
- Named unit: The scope should identify the business unit and its legal or organizational position, not only an informal team name.
- Shared services: Check whether IT, HR or security functions that serve the unit are inside or outside the scope, because the unit may depend on them.
- Interfaces: The scope should make clear which external parties or group companies the unit relies on.
- Vague team names: Labels such as "the platform group" or "core team" without further definition signal ambiguity.
- Scope creep: Phrases such as "and related activities" or "including supporting functions" widen the boundary without listing what those functions are.
Confirm that the unit's systems, staff and suppliers match the description, and ask whether a group-wide claim is being made from a narrower certificate.
Every scope must stay within the scope of the certification body's accreditation. European Accreditation FAQ 36.10 cites ISO/IEC 17021-1 clause 8.2.2, which requires the certificate to name the management system standard with its issue status, requires the scope to be neither misleading nor ambiguous, and under an IAF decision bars references to standards outside the accreditation scope. A certificate that mentions another standard as if it were covered by the accredited audit may not be the accredited certificate the reader assumes.
- Standard and issue status: The certificate should read "ISO/IEC 27001:2022" with its full reference, not a shorter form.
- Other standards: Any reference to additional standards, codes or frameworks should be checked against the accreditation scope held by the certification body.
- Accreditation scope document: Ask the certification body for its accreditation scope and confirm that the ISO/IEC 27001 entry covers the sector and activities in the certificate.
- Non-accredited bodies: If the body is not accredited, the certificate cannot carry an accreditation claim, and the scope should not imply one.
- Logo use: ISO does not permit use of its logo in connection with certification, so a logo on a certificate is a question to raise.
Check the scope against the accreditation scope and the certification body's own records before you accept it.
How to check the ISO 27001 certificate dates against the three-year cycle
This sequence lets you confirm that a certificate shows a consistent issue date and expiry or recertification due date, that it sits inside a three-year cycle, and that the certification body still treats it as current. You finish with a dated record you can compare against the certification body's own register.
Record the issue date
Open the certificate and write down the date it was issued, along with the certification body's name and the certificate reference number. Confirm that the certificate names ISO/IEC 27001:2022 with its issue status, because the date only means something against the correct edition. You are done when you have a single issue date and the edition it refers to, copied exactly as printed. If the certificate names ISO/IEC 27001:2013 with no transition status, treat that as a finding to raise with the supplier, since IAF MD 26:2023 required all 2013 certificates to expire or be withdrawn by 31 October 2025.
Find the expiry or recertification due date
Locate the expiry date or the recertification due date on the certificate. Write it down next to the issue date. The certificate should show one of these two dates explicitly, and it should be consistent with a three-year cycle counted from the initial certification decision. You are done when you have both dates and the gap between them is recorded. If neither date appears, the certificate does not show the cycle it depends on, and you should ask the certification body to explain it in writing before you rely on it.
Confirm the validity is not one year
Compare the gap between the issue date and the expiry or recertification due date. A certificate with a one-year validity period does not conform to the three-year cycle in ISO/IEC 17021-1, as European Accreditation's FAQ 51.7 explains under clause 8.2.2 c). Write down the gap in years and months and mark it as consistent or inconsistent. A one-year gap is a reason to question the certificate with the certification body and the accreditation body, not to accept it as a shorter but valid certificate.
Check for a surveillance audit each year
Ask the certification body for the audit history or the audit plan showing a surveillance or recertification audit in each calendar year of the cycle. Under ISO/IEC 17021-1, as explained in European Accreditation FAQ 37.12, at least one audit must take place every calendar year. Write down the date of each audit and tick off each calendar year covered. You are done when every year in the cycle has a dated audit. A gap in any calendar year is a question for the certification body, since it may signal a missed or postponed audit that affects the certificate's status.
Match the dates to the current status
Check the certificate's status in the certification body's own records and, where the body is accredited, in IAF CertSearch. Compare the status, expiry date and scope with what you wrote down in the earlier steps. The IAF CertSearch check confirms validity, that the body was accredited to issue the certificate, and that the accreditation body is a recognized signatory for the standard. You are done when the status, dates and scope match across both sources, and you have noted the date you checked.
Record the outcome and set a recheck date
Write a short record with the certificate reference, the issue date, the expiry or recertification due date, the audit dates by calendar year, the verification result and the date of your check. Mark the certificate as conforming to the three-year cycle, conforming with questions, or not conforming. Set a recheck date ahead of the next surveillance audit so the status is confirmed again before the next audit. This record is the evidence you keep on file for procurement and vendor reviews.
What accreditation behind an ISO 27001 certificate adds for the customer
ISO does not certify organizations. Certification bodies do, and ISO describes a certificate issued by an accredited certification body as adding an independent layer of confidence to a supplier's claim. Accreditation means a separate accreditation body has assessed the certification body and found it competent to issue ISO/IEC 27001 certificates. Accredited ISMS certification bodies work to ISO/IEC 17021-1:2015 together with ISO/IEC 27006-1:2024, the standard that adds ISMS-specific audit rules such as audit time and competence. IAF MD 29:2024 required certification bodies to apply ISO/IEC 27006-1:2024 to all clients by 31 March 2026, so a certificate issued or renewed after that date should reflect the newer requirements. Ask the supplier which edition its auditor applied and confirm it on the certificate or in the audit report summary.
Since 1 January 2026, Global ACI has taken over the roles previously held by the International Accreditation Forum (IAF) and ILAC. Global ACI-FMRA-001 lists ISO/IEC 27001:2022 (ISMS) as a management system certification sub-scope of the Global ACI multilateral recognition arrangement (MRA), assessed against ISO/IEC 17021-1:2015 plus ISO/IEC 27006-1:2024. In practice, this means an accreditation body that is a recognized signatory for that sub-scope can be relied on across participating economies. Before you accept an accredited certificate, confirm two things: that the certification body was accredited for ISO/IEC 27001 specifically, and that its accreditation body is a recognized signatory for that standard. IAF CertSearch checks both points alongside certificate validity.
Accreditation is not compulsory, and a non-accredited certification body is not automatically disreputable. Decide before procurement whether accreditation is a contract requirement. If your customer contract, regulator or internal supplier policy names accredited certification, write that requirement into the agreement and ask for the certificate number and accreditation details. If it does not, a non-accredited certificate may still be acceptable, but you should ask the body which standards it follows, how its auditors are qualified, and whether its results would be recognized by your own assessors. Treat either answer as a due diligence decision for your own organization, not as a question the certification body can settle for you.
Which verification route fits which customer check?
This table compares the four routes ISO describes for checking an accredited ISO 27001 certificate: individual lookup, bulk checks, the IAF CertSearch API and direct contact. Read each row against the number of certificates you need to check and the depth of assurance your procurement or contract requires.
| Route | When it fits | What it confirms | What you still confirm with the supplier |
|---|---|---|---|
| Individual lookup in IAF CertSearch | One supplier or a single certificate you need to check now | Certificate is valid, the certification body was accredited to issue it, and the accreditation body is a recognized signatory for the standard | Scope wording, the sites and processes covered, and the current Statement of Applicability |
| Bulk checks in IAF CertSearch | A supplier base of many certificates for procurement or periodic review | Validity and accreditation status for each listed certificate, checked as a set | Whether each supplier's scope matches the service they provide to you |
| IAF CertSearch API | Recurring monitoring inside your vendor management or GRC tooling | Machine-readable validity and accreditation status, refreshed on each query | Any change notices from the supplier and the expiry or recertification date on file |
| Contact the certification body | A certificate that does not appear in the search, or a question about scope or status | The body's own record of the certificate, its scope, and its current audit status | Whether the body is accredited for the exact scope and that the certificate is not suspended |
| Contact the accreditation body or Global ACI | A doubt about whether the certification body is accredited or recognized | Accreditation status of the certification body and the recognized status of the accreditation body | Whether the accreditation covers ISO/IEC 27001:2022 and the certificate's scope |
Where ISO 27001 certificates get misused in supplier claims
Suppliers rarely invent certificates outright. More often they stretch a real certificate by dropping the edition, widening the scope, showing an expired document or implying accreditation the body does not hold. Each card below names one pattern, the check that exposes it and what to request before you rely on the claim.
Logo used to imply certification
Suppliers sometimes place the ISO logo next to a certification claim, as if the standards body endorsed their ISMS. ISO does not permit use of its logo in connection with certification, and ISO does not certify organizations at all. Certification bodies issue the certificate. Ask for the certificate itself, confirm the issuing body's name, and search it in IAF CertSearch rather than accepting the logo as proof.
Certification named without an edition
A claim such as "certified to ISO 27001" leaves out the edition, so the reader cannot tell which version was audited. ISO asks that standards be referenced in full, for example "certified to ISO/IEC 27001:2022". Ask the supplier which edition the certificate names, and confirm that the certificate shows the issue status of the standard, as required for accredited certificates.
Scope broader than the certified sites
A certificate covers only the sites, services and processes named in its scope statement. Marketing often describes the whole company, a product line or a cloud platform that the certificate never reached. Compare the scope wording on the certificate with every claim the supplier makes, and ask for the scope exclusions. Wording that is misleading or ambiguous does not conform to the certification standard.
One-year validity certificates
Certificates must show an expiry or recertification due date consistent with the three-year certification cycle. A certificate issued with a one-year validity does not conform, even when the body is otherwise reputable. Check the dates printed on the certificate against the cycle, and ask when the next surveillance and recertification audits fall.
Expired certificates still on display
Websites, proposals and security questionnaires often keep showing a certificate after its expiry date or after it was withdrawn. Certificates issued to ISO/IEC 27001:2013 had to expire or be withdrawn by 31 October 2025 under IAF MD 26:2023. Search the certificate number in IAF CertSearch to confirm it is still valid, and request the current certificate and its most recent surveillance result.
Accreditation claims CertSearch cannot confirm
A supplier may say the certificate is accredited when the body or the scope of that accreditation does not appear in the database. IAF CertSearch confirms that the certificate is valid, that the body was accredited to issue it and that the accreditation body is a recognized signatory for that standard. Accreditation is not compulsory for certification, so a missing accreditation is a fact to disclose, not a reason to assume fraud. Ask for the accreditation body's name and the accredited scope.
Who checks what: the organization, the implementation partner and the certification body
The organization that holds the certificate owns its information security management system, its scope and every control it claims. The certificate names that organization and the sites, services and processes inside its scope, so the organization is the party accountable for whether the wording is accurate. Its management also decides what the Statement of Applicability says and whether the risk treatment behind it is real. A certification body can only test what the organization shows it, so the organization carries the burden of being able to explain its scope in plain terms.
- Scope wording: Confirm that the scope on the certificate matches the sites, products and services actually run under the ISMS, and that no excluded business unit is implied as covered.
- Standard reference: Check that the certificate cites ISO/IEC 27001:2022 with its issue status, not just "ISO 27001."
- Certificate dates: Track the expiry date and the surveillance and recertification audits that keep the three-year cycle moving.
- Use of the logo: Make sure marketing materials describe the certificate accurately and do not imply that ISO itself certified the organization.
- Evidence on file: Keep the records that show the scope was reviewed by management and that the certification body approved any changes.
Before sharing a certificate with a customer, ask whether its scope, standard edition and expiry date would still read correctly to a stranger.
An implementation partner such as DeployOpen helps an organization prepare the systems, configurations, documentation and evidence that an auditor will examine. DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside the client's own infrastructure, then helps assemble the records behind them. The partner does not own the controls, does not decide the scope, and does not judge whether the organization conforms. Its role ends at preparation, and the independence boundary is firm: DeployOpen does not issue reports, attestations or certificates, and hiring it does not guarantee a certification outcome.
- Preparation work: Configure logging, access control, backup and monitoring so that the controls named in the Statement of Applicability produce records.
- Documentation support: Draft procedures and evidence indexes that the organization reviews, approves and maintains itself.
- Gap identification: Report where systems or records fall short of the organization's own stated controls, so the organization can decide how to close them.
- Independence limits: Stay out of the certification decision and do not sign or certify any part of the ISMS.
- Fixed scope: Agree the deliverables and timelines in writing before work starts, so both parties can check what was and was not delivered.
Before engaging a partner, ask in writing which deliverables it will produce and confirm that it will not present itself as the auditor or the certifying party.
The certification body is the independent party that audits the organization against ISO/IEC 27001:2022 and decides whether to issue, maintain, suspend or withdraw the certificate. ISO does not certify organizations, and certification bodies that operate under accreditation follow ISO/IEC 17021-1:2015 together with ISO/IEC 27006-1:2024. The body must be independent of the client and of any consultant that helped prepare the ISMS, and its decision rests on its own audit findings rather than on what a partner produced.
- Audit and decision: Plan the stage 1 and stage 2 audits, grade findings, and issue or withhold the certificate.
- Certificate content: Ensure the certificate names the standard with its issue status, describes a scope that is neither misleading nor ambiguous, and shows an expiry or recertification date consistent with the three-year cycle.
- Accreditation: Confirm that the body holds accreditation for ISO/IEC 27001 if the customer requires it, and that the accreditation covers that scope.
- Public verification: Make the certificate checkable in IAF CertSearch, so customers can confirm validity without relying on the organization's word.
- Conflict of interest: Keep audit and consulting roles separate, which is why the body cannot design the ISMS it later audits.
Before accepting a certificate, check it in IAF CertSearch and confirm the accreditation status with the body, not only with the organization.
Frequently asked questions about reading an ISO 27001 certificate
Is an ISO 27001 certificate without accreditation acceptable?
It can be, but it proves less. An accredited certificate comes from a certification body that an accreditation body has assessed against ISO/IEC 17021-1 and the ISO/IEC 27006-1 rules for ISMS certification, which adds an independent layer of confidence. ISO notes that accreditation is not compulsory and that a non-accredited body is not necessarily disreputable, so the decision is a risk judgment. Ask the supplier which certification body issued the certificate, whether that body is accredited, by which accreditation body, and whether the certificate can be found in IAF CertSearch. If your contract or regulator names accreditation, a non-accredited certificate may not satisfy it. Confirm the requirement with your own compliance lead before accepting a certificate.
How long is an ISO 27001 certificate valid?
The certificate sits inside a three-year certification cycle, and it must show an expiry or recertification due date that fits that cycle. Under ISO/IEC 17021-1, the certification body must carry out at least one audit, either surveillance or recertification, in every calendar year of the cycle. A certificate issued with only a one-year validity does not conform to that rule. Check the expiry date printed on the certificate, the date of the most recent surveillance audit, and the date of the next recertification audit. A certificate with an expiry date far beyond three years from the start of the cycle, or no visible due date, deserves a question to the certification body.
Can a customer check an ISO 27001 certificate without a consultant?
Yes. Anyone can check an accredited certificate in IAF CertSearch, one at a time, in bulk or through an API. The check confirms that the certificate is valid, that the certification body was accredited to issue it, and that the accreditation body is a recognized signatory for that standard. You do not need a consultant or the supplier's help to run the search. You will need the certificate number and the certification body's name, both of which should appear on the certificate. If you want to confirm the scope wording or the standard edition, compare them with the certificate itself, since the database entry should match what the certification body issued.
What should a supplier provide to prove its ISO 27001 certification?
Ask for a copy of the full certificate, not a logo or a summary slide. The certificate should name the certification body, the standard with its issue status (for example, ISO/IEC 27001:2022), the scope of the certificate, the dates of issue and expiry, and the accreditation details if the body is accredited. Also ask for the Statement of Applicability reference, the most recent audit date, and the certificate number so you can run the IAF CertSearch check yourself. A supplier that offers only a document it wrote, or a claim that it is "ISO 27001 compliant" without a certification body, has not shown certification. Ask the supplier to confirm that the scope covers the services you are buying, because a certificate for one site or product line does not cover the rest of the business.
Does a certificate to ISO/IEC 27001:2013 still count?
Not as a current certificate. Under IAF MD 26:2023, all certifications to ISO/IEC 27001:2013 had to expire or be withdrawn by 31 October 2025, the end of the 36-month transition period. A customer who receives a 2013 certificate today should treat it as expired or withdrawn unless the certification body confirms otherwise in writing. Ask for a certificate to ISO/IEC 27001:2022, and confirm the transfer or recertification date with the certification body. The 2022 edition changed the Annex A controls from 114 to 93, so a 2013 certificate does not show that the current control set was tested. Check the issue status wording in the certificate, because it must name the edition.
What should I do if CertSearch cannot find a certificate?
Do not assume the certificate is fake, and do not accept it either. First, check the spelling of the certification body and the certificate number, and try the search by certificate number and by organization name. If the search still returns nothing, ask the supplier which certification body issued the certificate and contact that body directly, or contact the accreditation body named on the certificate. ISO also points to the certification body, the accreditation body and Global ACI as routes to verification. A certificate from a non-accredited body will not appear in IAF CertSearch, which is expected. Ask the supplier for written confirmation from the certification body before you rely on the certificate, and record the answer in your third-party risk file.
How DeployOpen works on this
DeployOpen helps organizations prepare the systems and evidence that a certification body will read when it checks an ISO 27001 certificate's scope, dates and accreditation. DeployOpen does not issue certificates or reports; an independent certification body does, and it is that body whose accreditation and scope wording matter to your customers.
How we scope
- We agree the written scope in advance, listing the sites, services and systems the ISMS covers.
- We map the scope statement to the systems that actually run inside it, so the wording describes real boundaries.
- We confirm with your chosen certification body which standard edition and accreditation the engagement will reference.
How we build
- We deploy self-hosted open-source platforms in your own cloud accounts, data centers or air-gapped networks.
- We configure asset inventories and access records so the scope boundary can be traced to specific systems.
- We document certificate-relevant configuration, such as scope boundaries and certificate validity tracking, in your environment.
How we hand over
- We deliver a documented scope register, system inventory and evidence index that your team owns after handover.
- We walk your compliance lead through how to check a certificate in IAF CertSearch and what each field means.
- We provide a calendar of expiry and surveillance dates tied to the three-year certification cycle for your records.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the fixed-scope work closes.
- We can review scope changes, such as new sites or services, before your certification body is asked to extend the certificate.
- Ask us to confirm in the written scope which certification body, accreditation and standard edition are covered.
