ISO 27001 Certification: How It Works and How to Verify It

ISO 27001 Certification: How It Works and How to Verify It

ISO 27001 certification is written assurance from an independent certification body that an organization's information security management system (ISMS) meets ISO/IEC 27001:2022. Two facts shape everything else on this page. ISO itself certifies no one, and a certificate is only as strong as the accreditation behind the body that issued it.

This guide is about the ISO 27001 certification itself. It covers who issues certificates and the rules those issuers follow. It shows what a valid certificate must contain and how to check a supplier's certificate yourself.

It ends with how a certificate is kept alive, suspended or lost. If you are building an ISMS from scratch, our ISO 27001 implementation guide covers that work step by step. If you want to know what happens inside the Stage 1 and Stage 2 audits, read the ISO 27001 audit process guide.

TL;DR

• ISO states that it "does not perform certification or issue certificates". Certification bodies issue certificates, and accreditation bodies check that those certification bodies are competent.
• Accredited ISO 27001 certification bodies work to ISO/IEC 17021-1:2015 plus the ISMS-specific ISO/IEC 27006-1:2024, which every accredited body had to be using by 31 March 2026.
• A certificate runs on a three-year cycle: an initial two-stage audit, a surveillance audit in each of the next two years, and a recertification audit before expiry.
• The 2013 edition is gone. Under IAF MD 26, every ISO/IEC 27001:2013 certificate had to "expire or be withdrawn" by 31 October 2025.
• The international recognition network changed on 1 January 2026: Global ACI took over the roles of IAF and ILAC. You still verify certificates through IAF CertSearch or the issuing certification body.

Who this is for

Buyers and vendor-risk teams who receive ISO 27001 certificates from suppliers and need to know whether to trust them. Also founders and security leads who are about to choose a certification body and want to know what they are paying for.

What ISO 27001 Certification Is (and Is Not)

ISO defines certification as "the provision by an independent body of written assurance (a certificate) that the product, service or system in question meets specific requirements" (ISO, certification page). For ISO 27001 certification, the "system" is the ISMS: the policies, risk process, controls, records and management routines an organization uses to run information security.

Three things follow from that definition.

It certifies a management system, not a product. A certificate says the ISMS inside a stated scope meets the standard's requirements. It does not say a product is secure, and it says nothing about parts of the company outside the scope.

Certification is optional. ISO's own ISO/IEC 27001 page notes that organizations implementing the standard "can decide whether they want to go through a certification process." Many implement it without a certificate. The certificate matters when a customer, regulator or partner asks for independent proof.

You are certified to 27001, never to 27002. ISO/IEC 27002:2022 is guidance on the controls, and ISO answers its own question plainly: "Does ISO/IEC 27002 lead to certification? No, ISO/IEC 27002 provides best practice recommendations and cannot be certified to." Our ISO 27001 vs ISO 27002 guide explains how the two documents fit together.

What the 2022 edition contains

ISO/IEC 27001:2022 was published on 25 October 2022 (IAF MD 26).

Clauses 4 to 10 set the management system requirements, and Annex A lists the information security controls the organization must consider.

IAF MD 26 summarises the change from 2013. The control set "decreases from 114 controls in 14 clauses to 93 controls in 4 clauses". Of those, "11 controls are new, 24 controls are merged from the existing controls, and 58 controls are updated." The four themes are organizational, people, physical and technological. Our Annex A controls reference walks through all 93.

One amendment exists. ISO/IEC 27001:2022/Amd 1:2024 added one sentence to clause 4.1, "The organization shall determine whether climate change is a relevant issue", and a note to clause 4.2 (joint ISO-IAF communiqué, February 2024).

IAF and ISO decided that "a full transition programme is not needed" and that "a revised certificate should not need to be issued", because the publication year of the standard did not change (IAF-ISO joint communiqué, February 2024). A 2022 certificate issued before February 2024 therefore does not need reissuing because of the amendment. Certification bodies "should include the new text in their auditing of the organization and its context."

No newer edition of ISO/IEC 27001 has been published or announced as of November 2026. The ISO page lists 27001:2022 with its one amendment as the current version.

Who Is Involved in ISO 27001 Certification

Four kinds of organization sit behind every legitimate ISO 27001 certification. A certificate that blurs their roles, for example one "issued by ISO", is the first thing to question.

ISO writes the standard and stops there

ISO's certification page is explicit: "ISO does not perform certification or issue certificates, and it does not permit anyone to use the ISO logo in connection with certification. Certification is performed by external certification bodies, thus a company or organization cannot be certified by ISO." A certificate with the ISO logo, or one that claims to be issued "by ISO", is a red flag.

Accreditation bodies check the auditors

ISO defines accreditation as "the formal recognition by an independent body, generally known as an accreditation body, that a certification body operates according to international standards." In practice, a national accreditation body audits the certification body: its impartiality, the competence of its auditors, and how it runs certification decisions.

Global ACI connects the accreditation bodies

Until the end of 2025, the International Accreditation Forum (IAF) ran the system that lets accreditation bodies recognise each other's work. It was called the IAF Multilateral Recognition Arrangement (MLA).

That changed on 1 January 2026. Global ACI's FAQ states that it "became fully operational on 01 January 2026, assuming the former roles of the International Accreditation Forum (IAF) and the International Laboratory Accreditation Cooperation (ILAC)". The archived IAF website now says "IAF ceased operations on 01 January 2026."

What this means for a certificate holder:

• Accreditation bodies that were IAF MLA signatories on 31 December 2025 and joined Global ACI "became signatories to the Global ACI MRA for the corresponding approved scopes and dates of approval" (Global ACI FAQ). Our reading: because recognition carried over with the same scopes and dates, a certificate issued under such an accreditation did not lose its accredited status on 1 January 2026.
• The old IAF MLA mark may still appear on certificates during the switch. Global ACI permits it "until the Global ACI MRA Mark is legally available for use in a given economy". The old mark "does not indicate that separate ILAC MRA or IAF MLA recognition frameworks continue to operate."
• For peer evaluations of accreditation bodies, IAF Mandatory Documents "shall remain in force until equivalent Global Accreditation Cooperation Incorporated documents are finalised and adopted", under Global ACI Resolution 2025-25 (document cross-reference table, September 2026).
• Global ACI itself "does not assess and accredit conformity assessment bodies" and "does not issue conformity assessment certificates." It sits above the accreditation bodies, not beside the auditors.

The rules certification bodies must follow

Two standards govern an accredited body that grants ISO 27001 certification:

1. ISO/IEC 17021-1:2015, which "contains principles and requirements for the competence, consistency and impartiality of bodies providing audit and certification of all types of management systems." ISO lists it as reviewed and confirmed in 2020 and shows it under review again, with no replacement edition listed, so the 2015 edition remains current.
2. ISO/IEC 27006-1:2024, published in March 2024, which "specifies the additional requirements for bodies that audit and certify information security management systems (ISMS) in accordance with ISO/IEC 27001." It replaced ISO/IEC 27006:2015. Under IAF MD 29, certification bodies had to use it for all clients no later than 31 March 2026.

If a certification body's documents still cite ISO/IEC 27006:2015 as its accreditation basis in late 2026, ask why.

The ISO 27001 Certification Cycle at a Glance

The path to a first ISO 27001 certification has two halves: building the ISMS, which is your work, and the external audits, which are the certification body's. This table gives the whole cycle in one view and points to the guide that covers each part in depth.

The cycle comes from ISO/IEC 17021-1. An accreditation body's training extract of clause 9.1.3.2 describes the audit programme as a "two-stage initial audit, surveillance audits in the first and second years following the certification decision, and a recertification audit in the third year prior to expiration of certification". It adds that "the first three-year certification cycle begins with the certification decision" (IAS extract of ISO/IEC 17021-1, section 9.1).

For surveillance timing, IAF quotes clause 9.1.3.3 directly: "Surveillance audits shall be conducted at least once a calendar year, except in recertification years. The date of the first surveillance audit following initial certification shall not be more than 12 months from the certification decision date" (IAF FAQ, question 32). European Accreditation adds that a certification body "can have a stricter regime but not an 'easier' one" (EA FAQ 37.12).

How long the build half takes, and what ISO 27001 certification costs, depends on your scope and starting point. Our ISO 27001 certification cost guide breaks down the budget, and the implementation guide covers timelines.

What a Valid Certificate Must Show

ISO/IEC 17021-1 clause 8.2.2 lists what certification documents must identify. The IAS extract of that clause includes:

• "the name and geographical location of each certified client" (or the headquarters and sites for a multi-site certificate)
• "the effective date of granting, expanding or reducing the scope of certification, or renewing certification"
• "the expiry date or recertification due date consistent with the recertification cycle"
• "a unique identification code"
• "the management system standard and/or other normative document, including indication of issue status (e.g. revision date or number) used for audit of the certified client"
• "the scope of certification with respect to the type of activities, products and services as applicable at each site without being misleading or ambiguous"
• "the name, address and certification mark of the certification body"

Source: IAS extract of ISO/IEC 17021-1, section 8.

ISO/IEC 27006-1:2024 adds ISMS-specific points. IAF's summary of the changes notes that for a client "with few or no physical relevant sites", the certification document "shall state that the client's activities are conducted remotely" (IAF MD 29). Certificates also commonly reference the version of the Statement of Applicability that was audited, which lets you see which controls were in play.

How to read the scope line

The scope is the line most buyers skip and the one that matters most. A certificate covering "the provision of cloud hosting services from the Frankfurt data center" says nothing about a support team in another country or a product line not named. Before relying on a supplier's certificate, check three things against the scope:

1. The service you buy is named. If your contract is for product B and the certificate covers product A, the certificate does not cover you.
2. The sites or teams that handle your data are inside it. For remote-first companies, look for the statement that activities are conducted remotely.
3. The edition is ISO/IEC 27001:2022. Any 2013 reference means the certificate is no longer valid (see the transition section below).

If the scope is vague, ask for the Statement of Applicability, or a summary of it, under NDA.

How to Verify an ISO 27001 Certificate

A PDF certificate is easy to fake, and easy to keep showing after the certification behind it has lapsed. ISO gives two routes to check one (ISO, certification page):

"Use the International Accreditation Forum's global database, IAF CertSearch. CertSearch aggregates data from accreditation bodies and certification bodies, allowing you to confirm certification and accreditation status in one place. Certificates can be verified individually, in bulk, or via API; or Contact the relevant certification body, accreditation body, or Global ACI directly to confirm the respective statuses."

Step 1: Search IAF CertSearch. IAF CertSearch still operates under that name after the move to Global ACI. Under IAF MD 28, accredited certification bodies must upload each accredited certificate's number, standard, scope, issue and expiry dates. They must also upload a "Certification status (active, suspended or withdrawn)", and do so "at least once a month".

Step 2: If it is not there, ask the certification body. MD 28 allows exclusions for legal or privacy reasons. A certificate missing from CertSearch is not, on its own, proof of a fake. ISO/IEC 17021-1 clause 8.1.2 requires a certification body to provide, on request, "the status of a given certification" and the "name, related normative document, scope and geographical location" of a certified client (IAS extract, section 8). Global ACI gives the same advice: refer "in the first instance to the conformity assessment body (CAB) shown on the document" (Global ACI FAQ).

Step 3: Check the certification body's accreditation. Look for an accreditation body's mark on the certificate. Then confirm on that accreditation body's website that the certification body is accredited for ISO/IEC 27001. Global ACI warns that "not all accreditation bodies that are members of Global ACI are also signatories to the Global ACI MRA, and therefore the results from their accredited CABs may not be recognised in other economies."

Step 4: Match the details. The legal entity name, scope, standard edition and expiry date on the PDF should match what the database or certification body tells you. A mismatch in any of them is a reason to stop and ask.

A worked example

Here is how the four steps play out on an invented case. A SaaS supplier sends a PDF certificate for ISO/IEC 27001:2022. The scope reads "development and operation of the supplier's analytics platform", and you are buying its separate payroll product. The certificate carries an accreditation mark, and CertSearch shows the same certificate number as active.

Everything checks out except the part that matters to you: the payroll product is not in the scope, so the certificate tells you nothing about it. The right next step is to ask the supplier whether payroll is covered by another certificate or a planned scope extension, and to rely on your own security questionnaire for that product until it is.

If you find a false claim, ISO says complaints "should be addressed to the certification body that certified the organization". False claims of accredited certification can also be reported to the Global ACI Secretariat (ISO, certification page).

Accredited vs Non-Accredited Certificates

A certification body does not have to be accredited. ISO says so directly: "accreditation is not compulsory, and non-accreditation does not necessarily mean the certification body is not reputable" (ISO, certification page). On its 27001 page, ISO adds that a certificate from an accredited body "may bring an additional layer of confidence, as an accreditation body has provided independent confirmation of the certification body's competence."

In practice, three gaps open up when a certificate is not accredited. These are our reading of the rules above, not a statement from ISO:

1. No database entry. IAF MD 28 covers accredited certificates from certification bodies accredited by a recognised accreditation body, so a non-accredited certificate will not appear in CertSearch.
2. No international recognition. The Global ACI MRA is what lets a certificate accredited in one country be accepted in another. A non-accredited certificate sits outside it.
3. No independent check on the auditor. Nobody has confirmed that the certification body meets ISO/IEC 17021-1 and ISO/IEC 27006-1.

If your own procurement policy asks suppliers for accredited certification, these three gaps are the reason to enforce it. If you are choosing a certification body, confirm its accreditation for ISO/IEC 27001 before you sign, not after the audit.

Keeping ISO 27001 Certification: Surveillance, Suspension and Withdrawal

ISO 27001 certification is not a one-time event. It stays valid only while the surveillance and recertification audits happen on schedule and nonconformities are dealt with.

Missed audits and suspension

Certification bodies distinguish suspension (temporary) from withdrawal (permanent).

One large accredited certification body's published procedure defines them this way: "Suspension: Time-limited invalidation of a certificate. Withdrawal: Permanent invalidation of a certificate." It says "a certificate shall not be suspended for more than 6 months". One listed ground is "Surveillance audits and recertification audits not allowed to be conducted according to required frequency" (DNV procedure). That is one firm's procedure. The six-month figure is not unique to it: IAF's FAQ, discussing pandemic conditions, says a suspension "could exceed six months" in those circumstances and points to the note to ISO/IEC 17021-1 clause 9.6.5.4, which suggests six months is the normal limit (IAF FAQ, question 32).

During suspension, the certificate is not valid and the holder should not advertise it. The same procedure tells clients that "use of all advertising matter containing a reference to certification are prohibited during time of suspension." If the failure sits in one part of the organization, DNV's procedure also allows "a reduction in the scope of certification as an alternative to suspension."

Expiry and the six-month window

Recertification must be finished before the expiry date. European Accreditation reproduces ISO/IEC 17021-1 clause 9.6.3.2.4. It covers the case where the recertification audit is not completed, or major nonconformities are not verified as corrected, "prior to the expiry date of the certification, then recertification shall not be recommended and the validity of the certification shall not be extended" (EA FAQ 47.5).

There is a narrow recovery route in clause 9.6.3.2.5: "Following expiration of certification, the certification body can restore certification within 6 months provided that the outstanding recertification activities are completed, otherwise at least a stage 2 shall be conducted." The clause adds that the restored certificate's "expiry date shall be based on prior certification cycle", so a late recertification does not buy extra time. Between expiry and restoration, European Accreditation is clear that "the organization is not certified" (EA FAQ, question 34.2).

The 2013 to 2022 Transition Is Over

The transition from ISO/IEC 27001:2013 to the 2022 edition ran for three years under IAF MD 26. Its key dates:

MD 26 is direct about the end state: "All certifications based on ISO/IEC 27001:2013 shall expire or be withdrawn at the end of the transition period." It also said that a transition audit alone did not reset the clock: "the expiration of its current certification cycle will not be changed." Every transition audit had to cover "the updating of the statement of applicability (SoA)", because Annex A had been restructured.

The practical consequence is simple. In 2026, no valid accredited certificate can reference ISO/IEC 27001:2013. If a supplier sends one, it has expired, been withdrawn, or was never accredited.

Choosing an ISO 27001 Certification Body: Questions to Ask

The certification body's name stays on your certificate for the whole three-year cycle. Questions worth asking before you sign:

1. Which accreditation body accredits you for ISO/IEC 27001, and can I see the accreditation scope? Confirm it on the accreditation body's own website.
2. Are you operating to ISO/IEC 27006-1:2024? Every accredited body should be, as the deadline was 31 March 2026.
3. How do you size audit days, and what will surveillance and recertification cost over three years? Ask for the whole cycle, not just the initial audit. Our cost guide shows what to compare.
4. Do you upload certificates to IAF CertSearch? Your customers will look for you there.
5. How do you handle remote audits for our setup? This matters for remote-first companies, given the 27006-1 rule on stating remote activities.

One independence point catches companies out. To protect impartiality, ISO/IEC 17021-1 clause 5.2.5 says a certification body shall "not offer or provide management system consultancy" (IAS extract, section 5). An auditor who offers to build your ISMS and then certify it is a warning sign. Use separate firms for help building the ISMS and for the certification audit.

Frequently Asked Questions

Who issues ISO 27001 certificates?

Certification bodies do, never ISO. ISO states that "a company or organization cannot be certified by ISO." For international recognition, the certification body should be accredited by a signatory to the Global ACI MRA. That arrangement replaced the IAF MLA on 1 January 2026.

How long is an ISO 27001 certificate valid?

An ISO 27001 certification lasts three years from the certification decision, provided the surveillance audits happen. Under ISO/IEC 17021-1, surveillance audits are required "at least once a calendar year, except in recertification years". The first must fall within 12 months of the decision, and recertification must be completed before expiry.

How do I check whether a company's ISO 27001 certificate is real?

Search IAF CertSearch for the company or certificate number, then confirm with the certification body named on the certificate if it is not listed. Check that the scope covers the service you buy, that the edition is ISO/IEC 27001:2022, and that the status is active rather than suspended or withdrawn.

Is an ISO 27001:2013 certificate still valid?

No. Under IAF MD 26, all ISO/IEC 27001:2013 certifications had to expire or be withdrawn by 31 October 2025.

Does the 2024 climate change amendment mean we need a new certificate?

No. IAF and ISO decided that "a revised certificate should not need to be issued" for the 2024 climate amendments, because the publication year of the standard did not change. Certification bodies should include the new text, including whether climate change is a relevant issue under clause 4.1, when they audit the organization's context.

Is ISO 27001 certification legally required?

Generally no. ISO 27001 certification is voluntary: ISO notes that organizations "can decide whether they want to go through a certification process." It becomes a practical requirement when customers or partners make it a condition of contract. For how it compares with a SOC 2 report, see SOC 2 vs ISO 27001.

Does a certificate cover the whole company?

Only what its scope says. A certificate can cover one product, one site or one business unit. Read the scope line, and ask for the Statement of Applicability if it is unclear.

Where to Go Next

• Building the ISMS: ISO 27001 implementation guide, risk assessment, Statement of Applicability
• Preparing for the audits: internal audit and the audit process guide
• Budgeting: ISO 27001 certification cost
• Choosing between frameworks: ISO 27001 vs SOC 2 vs NIST

Sources

1. ISO, Certification page, accessed 2026-11-02
2. ISO, ISO/IEC 27001:2022, accessed 2026-11-02
3. ISO, ISO/IEC 27001:2022/Amd 1:2024, accessed 2026-11-02
4. ISO, ISO/IEC 27002:2022, accessed 2026-11-02
5. ISO, ISO/IEC 17021-1:2015, accessed 2026-11-02
6. ISO, ISO/IEC 27006-1:2024, accessed 2026-11-02
7. IAF, MD 26:2023, Transition requirements for ISO/IEC 27001:2022, accessed 2026-11-02
8. IAF, MD 29:2024, Transition to ISO/IEC 27006-1:2024, accessed 2026-11-02
9. IAF, MD 28:2023, Uploads to the IAF database, accessed 2026-11-02
10. Joint ISO-IAF communiqués on the climate change amendments, February 2024: amendment text and certification arrangements, accessed 2026-11-02
11. Global ACI, FAQ, accessed 2026-11-02
12. Global ACI, IAF and ILAC document cross-reference table, 14 September 2026, accessed 2026-11-02
13. IAF CertSearch, accessed 2026-11-02
14. IAS, extracts of ISO/IEC 17021-1:2015 section 5, section 8 and section 9.1, accessed 2026-11-02
15. IAF FAQ Task Force, question 32, accessed 2026-11-02
16. European Accreditation, FAQs 37.12, 47.5 and 34.2, accessed 2026-11-02
17. DNV, Procedure for suspension and withdrawal of certificates, accessed 2026-11-02 (one certification body's procedure, cited as an example of practice)

Last reviewed: 2026-11-02. This article was prepared by the Security Compliance Guide Editorial Team. We use AI to draft initial summaries of publicly available cybersecurity compliance documentation, then verify every claim against primary sources before publication. We are not licensed auditors, attorneys, or compliance consultants. For binding decisions, consult a qualified professional. See our editorial standards for full sourcing rules.