Certification

ISMS certification rests on a three-layer conformity assessment chain. ISO does not certify anyone. National accreditation bodies, operating under ISO/IEC 17011 and in Europe under Regulation (EC) 765/2008 (in Denmark DANAK), accredit certification bodies; the certification bodies audit and certify organisations. A certification body for ISO/IEC 27001 must meet ISO/IEC 17021-1:2015, the generic requirements for bodies certifying management systems, plus ISO/IEC 27006-1:2024, which adds ISMS-specific rules on auditor competence, audit time and the audit process. Accredited certificates are recognised internationally through the IAF Multilateral Recognition Arrangement; certificates from unaccredited bodies are legal but carry little weight in tenders and supplier assessments.

Initial certification is a two-stage audit. Stage 1 reviews the ISMS documentation, scope, risk assessment and Statement of Applicability and evaluates readiness, including whether internal audit and management review have been performed. Stage 2, normally on-site or partly remote, tests whether the ISMS is implemented and effective by sampling evidence across clauses 4-10 and the Annex A controls declared applicable. Audit time is calculated from tables in ISO/IEC 27006-1 based mainly on the number of persons doing work under the organisation's control, adjusted for complexity and the number of sites. Major nonconformities must be corrected and verified before the certificate is issued; minor ones need an accepted corrective action plan.

The certificate is valid for three years. Surveillance audits take place at least annually, the first within twelve months of the certification decision, and each covers a subset of the ISMS plus fixed items such as internal audit, management review, corrective actions and use of the certification mark. A recertification audit before expiry starts a new cycle. Serious findings in a surveillance audit can lead to suspension or withdrawal. The 2013 edition could no longer be certified after 31 October 2025, so current certificates are against ISO/IEC 27001:2022.

The most important thing to read on a certificate is its scope. An organisation can certify a single data centre, product line or department, so a supplier's certificate may not cover the service actually purchased; the certificate should also reference the version of the SoA. Certification of an ISMS is also different from certification of persons under ISO/IEC 17024 (for example lead auditor credentials), from product certification such as Common Criteria or the EU EUCC scheme under the Cybersecurity Act, and from assurance reports such as ISAE 3402 or SOC 2, which describe control operation over a period rather than conformity to a management-system standard. Likewise, NIS2 Art. 24 lets member states require ICT products, services or processes certified under European cybersecurity certification schemes; it does not concern ISO 27001 certification of the entity itself.