A customer asked for ISO 27001: what to do first
The first step is to confirm in writing what the customer will accept. Ask whether they need a certificate, which scope it must cover, and whether the certificate must come from an accredited certification body. ISO does not certify organizations, and only an accredited certification body can issue an ISO/IEC 27001 certificate. Some customers accept a report or a statement of applicability plus evidence in place of a certificate, and others name a specific certification body or require a certificate that is verifiable in the IAF CertSearch database. Get these answers in the contract or RFP clarification log before you commit budget or dates, because a certificate that names the wrong scope or the wrong issuer will not satisfy the requirement.
The earliest realistic path runs through a stage 1 audit, then a gap period, then a stage 2 audit. In stage 1 the certification body reviews your documented ISMS and readiness, and the time between the two stages lets you resolve the concerns it raises. Neither the standard nor the accreditation rules set a maximum interval, so the real timeline depends on your ISMS maturity, the scope you choose and the certification body's schedule. Before stage 2, the performance evaluation activities in clauses 9.1 to 9.3 and the corrective action process in clause 10.2 must have operated for long enough to produce records. Ask prospective certification bodies for their stage 1 and stage 2 availability and for a written audit plan. Treat any date a salesperson quotes without a scope review as an estimate, not a commitment.
Your organization owns its controls and its ISMS. An implementation partner such as DeployOpen can prepare systems, configuration baselines and evidence for the auditor, but it cannot issue the certificate or sign off the audit. Only the independent certification body does that. Plan for what you can share before the certificate exists: a scope statement, the current statement of applicability, the risk treatment summary and selected evidence can be shared under a non-disclosure agreement, while the certificate itself follows only after a successful stage 2. Agree that wording with the customer now, and state the certification status accurately in questionnaires and proposals, using the full standard reference, ISO/IEC 27001:2022.
How a customer verifies an ISO 27001 certificate
A certificate only helps a buyer if it was issued by a body that is itself accredited, for the right standard version, scope and sites. The cards below cover the verification routes ISO names and the details to compare against the service the customer actually buys.
Confirm the issuing body is accredited
Start by identifying the certification body named on the certificate and checking that it holds accreditation for ISO/IEC 27001 certification. A certificate from a body without accreditation may look identical on paper but carries no independent assurance. Ask the supplier which accreditation body granted it and confirm the status directly, since the accreditation check matters more than the certificate's appearance.
Search the certificate in IAF CertSearch
IAF CertSearch lets a buyer look up an accredited certificate individually, in bulk or through an API, which suits procurement teams checking several suppliers. Search by the organization name or certificate number and compare the result with the copy the supplier sent. A mismatch in name, dates or standard reference is a reason to pause the review and ask for clarification.
Verify directly with the certification body
If the database does not show the certificate, or the buyer wants confirmation from the source, contact the certification body that issued it. Ask it to confirm the certificate is valid, the expiry date, and whether any suspension or withdrawal is pending. Direct confirmation is also the route to use when the supplier's copy looks altered or incomplete.
Check the standard version and expiry
Confirm the certificate refers to ISO/IEC 27001:2022, not the 2013 edition, because certifications to the 2013 edition had to expire or be withdrawn by 31 October 2025. Check the issue and expiry dates and the surveillance pattern, since a certificate near expiry or with an overdue audit gives weaker assurance. Buyers should also confirm the full standard reference is written out.
Compare the certificate scope with the service
The certificate scope lists which products, services, teams and sites the management system covers. Buyers should check that the scope includes the service they are purchasing, its hosting locations and the support teams that will handle their data. A certificate covering only corporate offices does not cover a product delivered from elsewhere, and the buyer can ask for the scope to match the service in the contract.
Read the Statement of Applicability with the scope
The certificate confirms that an accredited body audited the management system against the stated scope, but the Statement of Applicability shows which Annex A controls apply and which were excluded. Buyers should ask for it under appropriate confidentiality terms and check that exclusions make sense for the service. Exclusions for controls relevant to the purchased service are a point to raise before signing.
The earliest realistic path through stage 1 and stage 2
The sequence turns a customer's ISO 27001 request into a certification decision, and each step produces a record the certification body will read. No step can be skipped, and the timing of the steps depends on how quickly the organization closes its own findings.
Scope the ISMS and complete the risk assessment
Leadership decides which products, services, locations and teams fall inside the ISMS boundary, then the organization identifies its information security risks and decides how each one will be treated. The output is a defined scope statement, a risk assessment method, a risk register and a draft Statement of Applicability that records which Annex A controls apply and why. Before moving on, confirm the scope with the customer, since a certificate only covers what was scoped in. Ask your certification body to review the scope early, because a boundary that excludes a service the customer uses will not satisfy the request.
Implement controls and run the ISMS in operation
The organization puts its policies and controls into practice across the scoped environment, and the control owners begin producing records every day: access reviews, change tickets, training completions, vulnerability scans and incident logs. Certification bodies look for evidence that the ISMS has operated over time, not just that documents exist, so the operating period must be long enough to generate a credible record. Your team should keep a dated evidence repository for each control. The step is complete when each control in the Statement of Applicability has a named owner and a record showing it working.
Complete internal audit, management review and corrective action
Before the certification audit, the ISMS must have gone through its performance evaluation. Internal audit under clause 9.2 checks the ISMS against the standard and the organization's own rules, management review under clause 9.3 is a documented meeting where top management considers the ISMS performance, and clause 10.2 requires the organization to record each nonconformity and its corrective action. The output is an internal audit report, minutes from management review, and a corrective action log. Auditors will ask for all three, so the step is not finished until each has been completed and each finding has a closed or planned action.
Book the certification body and agree the audit plan
The organization selects an accredited certification body, signs a contract, and receives an audit plan that sets out the stage 1 and stage 2 dates, the audit team and the sites or systems in scope. Ask the certification body for its written schedule and its accreditation status before signing, because it determines the timing of every later step. Confirm that the body operates to ISO/IEC 17021-1 with ISO/IEC 27006-1, which accredited ISMS bodies must apply to all clients by 31 March 2026 under IAF MD 29:2024. The step is done when the audit dates and the scope in the contract match what your team is preparing.
Pass the stage 1 document review
The stage 1 audit checks whether the ISMS is documented and ready for a full assessment. The auditor reviews the scope, policies, risk assessment, Statement of Applicability, and evidence of internal audit and management review, and may visit the premises or hold interviews to understand the organization. The auditor records any concerns, and the report states which items must be resolved before stage 2. Stage 1 does not confirm that controls work in practice. Your output is the stage 1 report and a list of open items with the timeframe the certification body expects for each.
Resolve stage 1 concerns during the gap period
Between stage 1 and stage 2, the organization closes the concerns the auditor raised, updates documents and extends records where needed. The standard and the accreditation rules set no maximum interval between the two stages, but a long gap can mean the ISMS has changed or the auditor needs to revisit scope, so ask the certification body how it treats a delayed stage 2. Keep a log that shows each concern, the change made, and the date. The step is complete when the certification body confirms in writing that the stage 1 items are resolved and stage 2 can proceed.
Complete the stage 2 audit and close nonconformities
Stage 2 is the main certification audit, on site or remote, where the auditor tests whether the ISMS is implemented and effective against the scope, sampling controls and records across teams and systems. The auditor issues findings, and each major nonconformity must be corrected with its corrective action verified. Under ISO/IEC 17021-1, if the certification body cannot verify corrections and corrective actions for every major nonconformity within six months after the last day of stage 2, it must conduct another stage 2 before recommending certification. Plan the corrective work so that every major finding can be verified inside that window. The step closes when the certification body makes its recommendation and the certificate decision is issued.
Share evidence and verify the certificate
Once the certificate is issued, the organization can give customers a copy that names the certification body, the scope, and the standard in full as ISO/IEC 27001:2022. Customers can verify the certificate independently in IAF CertSearch or by contacting the certification body. Before the certificate exists, the organization can share its scope statement, Statement of Applicability, and policy summaries under a non-disclosure agreement, but it must not describe itself as certified. The step is done when the customer has checked the certificate or confirmed the certification body's status in writing.
Options when the contract date comes before certification
The customer accepts that the certificate will arrive after signing, provided the organization commits in writing to a certification audit on a set schedule. This works best when the organization has a credible plan and a certification body already engaged. The customer is relying on your word and your timetable, so the commitment must be specific enough to be checked later.
- Named standard and version: Confirm the commitment refers to certification to ISO/IEC 27001:2022, with the scope the customer expects, not a general statement about intent.
- Dated milestones: Agree the stage 1 and stage 2 windows, and what happens if the stage 2 audit slips.
- Remedy clause: Ask what the customer may do if certification is not achieved by an agreed date, such as termination rights or a reduced scope of data.
- Interim evidence: Agree which documents you will share in the meantime, such as the Statement of Applicability draft and internal audit results.
Risk stays with the organization: if the audit is delayed or a major nonconformity is found, the commitment is breached. Check that the certification body's own timetable and the stage 1 concern window are realistic before you sign.
The customer accepts an independent assessment report from another framework, such as a SOC 2 report, in place of an ISO certificate for now, with an ISO roadmap attached. The Federal Reserve's proposed third-party risk guide for community banks (91 FR 58438) lists SOC 2 and ISO reports among independent assessments a bank may review when assessing a cybersecurity vendor. Whether any given customer accepts such a report is the customer's decision, and the guide does not require it.
- Scope of the report: Confirm which services, locations and periods the report covers, and whether it matches the service the customer is buying.
- Report type and issuer: Confirm the report comes from an independent CPA firm or certification body, not an internal document labeled as an assessment.
- ISO roadmap: Put the certification target and the certification body's name in writing, so the roadmap is a commitment and not a promise.
- Gap disclosure: Agree how controls not covered by the report will be explained, with the Statement of Applicability as the reference.
The organization carries the risk that the customer rejects the substitute at procurement or later. Ask the customer's procurement or risk team for their acceptance criteria before you assume the report will be enough.
The customer requires an issued ISO/IEC 27001:2022 certificate before the contract is signed. This leaves no room for a planned timetable, so the organization must either hold the certificate already or decline the timing. Ask whether the requirement is strict or whether the customer would accept one of the other options in this section.
- Verify the certificate: Ask the customer to check it in IAF CertSearch or with the certification body, and confirm the scope covers the service being bought.
- Confirm the standard reference: The certificate should state ISO/IEC 27001:2022, not an expired 2013 edition, since the transition to the 2022 edition ended on 31 October 2025.
- Check the accreditation: Confirm the certification body is accredited and the certificate appears in the accredited database.
- Timing for the sales cycle: Identify whether the certificate can be issued in time for the contract date, based on the certification body's written plan.
Risk sits with the sales team if the certificate arrives late and the deal is lost, so bring legal and sales into the decision early. Do not offer a certificate you do not yet hold, and do not describe pending audits as certification.
Who owns each part of the work
When a customer asks for ISO 27001, four parties touch the work, and each owns a different piece. Keeping those roles separate tells you what to buy, what to keep in-house and who signs what. None of them can stand in for the others.
The organization owns its controls
Your company decides the scope of the ISMS, the risk criteria, the Statement of Applicability and every policy it adopts. Management must approve these decisions and be able to explain why each control applies or is excluded. A partner can draft documents, but the choices and accountability stay with your leadership, and that is what an auditor will question first. Confirm that a named executive will own the ISMS before you sign anything.
The implementation partner prepares evidence
An implementation partner such as DeployOpen plans, configures and documents systems, controls and evidence inside your own cloud accounts, data centers or air-gapped networks. Typical work includes hardening, logging, backup procedures and records that show controls operate over time. The partner does not issue reports, attestations or certificates, and hiring one does not guarantee a certification result. Ask for the written scope and deliverables before work begins.
The consultant advises but stays independent
A consultant can advise on gaps, review the management system and run internal audits, but should not also perform the certification audit for the same client. Under the accreditation rules, a body that helps design the system can lose independence when it later audits that system. Ask any advisor whether they have any relationship with the certification body you plan to use, and how they handle conflicts of interest.
The accredited certification body audits
Only an accredited certification body performs the stage 1 and stage 2 audits and decides whether to issue the certificate. It works to ISO/IEC 17021-1 with ISO/IEC 27006-1 applied to ISMS work. Check that the body holds accreditation for ISO/IEC 27001 before you contract, because a certificate from an unaccredited body carries no independent assurance. Your customer can verify the result in IAF CertSearch.
Customer contract responsibilities
Read the customer's contract and RFP wording before promising a certificate, a date or a specific standard version. Some customers accept a readiness letter, a SOC 2 report or a completed questionnaire in place of certification, and others will not. Assign one person to confirm in writing what the customer will accept, and record every commitment made in the bid. Ambiguity here causes more delays than the audit itself.
Questions buyers ask when a customer requires ISO 27001
Is ISO 27001 certification optional when a customer asks for it?
Certification itself is optional under the standard, but your customer may make it a contract condition. ISO explains that some organizations implement ISO/IEC 27001 only for its best practices, while others certify to reassure customers and clients that its recommendations are followed. Your first step is to ask the customer, in writing, what they will accept: a certificate from an accredited certification body, a specific scope, a Statement of Applicability, or an independent report. Confirm whether a certificate issued in the process of certification is acceptable or whether they require one already in hand. The answer decides whether you pursue certification or a lighter assurance route.
What happens in a stage 1 and stage 2 ISO 27001 audit?
Stage 1 is a documentation and readiness review. The certification body checks that your ISMS documents exist and that the organization is prepared for the stage 2 audit. Stage 2 tests whether the ISMS is implemented and operating in practice, including evidence from the performance evaluation activities in clauses 9.1, 9.2 and 9.3 and nonconformity handling under clause 10.2. Before stage 2, your internal audit and management review must have actually run. Ask the certification body for its audit plan and the sampling it will apply, since these drive the effort on your side.
How long can the gap between stage 1 and stage 2 be?
The gap has no maximum set by the rules, so the interval is agreed between you and the certification body. European Accreditation FAQ 49.3 confirms that initial certification consists of stage 1 and stage 2 audits, with time between them for the client to resolve concerns raised in stage 1. In practice, the gap should be long enough to fix the gaps stage 1 found, and short enough that the ISMS does not go stale. Plan with your auditor for the date of stage 2 when you book stage 1, and ask how the body handles a delay that you cause.
What happens if major nonconformities are not closed within six months?
If the certification body cannot verify corrections and corrective actions for every major nonconformity within six months after the last day of stage 2, it must conduct another stage 2 before recommending certification. This rule, cited in European Accreditation FAQ 36.14 from ISO/IEC 17021-1, means a slow fix can restart the audit work and extend the timeline. Drivers include how quickly root causes are identified, whether evidence is retained, and how many findings are open at once. Close major nonconformities with documented root cause analysis and objective evidence, and agree a corrective action plan with the body early.
How does a customer check an ISO 27001 certificate in IAF CertSearch?
The customer can verify an accredited certificate in IAF CertSearch, either one at a time, in bulk or through an API. They can also contact the certification body or the accreditation body directly. ISO notes that Global ACI has assumed the roles of IAF and ILAC since 1 January 2026, and ISO still points to IAF CertSearch for checking accredited certificates. Ask your certification body to confirm that your certificate is listed and that the scope statement matches what you sold. A certificate that cannot be found in the database should not be treated as accredited.
Can we do ISO 27001 certification without outside help?
Yes, the organization can prepare its ISMS and evidence internally, provided it has the competence and time to do so. Outside help is optional. The rule to keep in mind is the separation of roles: the organization owns its controls, an implementation partner can prepare systems and evidence, and only an independent certification body issues a certificate. Your internal team must still run the ISMS, make the risk decisions, and answer auditor questions in person. Judge outside help by what it actually delivers, its written scope, and whether it is independent of the certification body you choose.
What work must our organization provide during certification?
Your organization must own and operate the ISMS. Expect to provide a defined scope, an information security policy, a risk assessment and risk treatment process, a Statement of Applicability, and records of internal audits, management reviews and corrective actions. Auditors will also ask for access to people, systems and records, and for staff who can explain how controls work day to day. Ask the certification body for a document request list before stage 1, and ask your customer which of these artifacts they want to see before the certificate exists.
How DeployOpen prepares your systems and evidence
DeployOpen's role in a customer-driven ISO 27001 project is preparation, not certification. Before any work starts, the scope is agreed in writing: which self-hosted open-source platforms are in the ISMS, which controls the team will implement or harden, which evidence will be produced, and what the deliverables and timelines are. Most engagements are fixed-scope, so the written scope is the basis for the quote, and no price is set until that scope is clear. Ask for the scope document to name the systems, the Statement of Applicability inputs and the handover items before you sign.
DeployOpen then works inside your own infrastructure, whether that is your cloud accounts, data centers or air-gapped network. The work covers implementing and hardening the platforms, configuring logging and access controls, setting up backups and documenting how each control operates, so that the evidence an assessor will sample already exists when stage 1 begins. The organization still owns its controls, its risk decisions and its Statement of Applicability. DeployOpen prepares the systems and the records, and your staff must be able to explain and operate them after handover.
DeployOpen does not issue audit reports, attestations or certificates. Only the independent certification body that your customer accepts can issue an ISO/IEC 27001:2022 certificate, and it must be accredited for that purpose. Keep this separation in the contract: DeployOpen's documentation is an input to the audit, and the audit outcome belongs to the certification body. Confirm the certification body's independence from the implementation work before you engage either party.
