An ISO 27001 certificate is only as credible as the organization that issued it. Anyone can print a certificate. What gives one weight is a chain of oversight: a certification body that follows defined rules, and an accreditation body that checks it does.
Most buyers who ask for your ISO 27001 certificate will not check that chain. The ones who do are usually the ones you most want to win: regulated enterprises, public sector buyers, and procurement teams with a supplier assurance function. For them, a certificate from an unaccredited body can be worth less than no certificate, because it raises the question of why you chose one.
This article explains how accreditation works, what it guarantees and what it does not, how to verify a certificate, and what to ask when choosing a certification body.
How the chain of trust works
Four layers are involved, and each does one job.
ISO and IEC publish the standard. They write ISO/IEC 27001. They do not audit or certify anyone, and an organization cannot be "certified by ISO".
Certification bodies audit and certify. They audit your ISMS against ISO/IEC 27001 and issue the certificate.
Accreditation bodies accredit certification bodies. A national accreditation body assesses each certification body against ISO/IEC 17021-1, the general requirements for bodies certifying management systems, and ISO/IEC 27006, the additional requirements for bodies certifying an ISMS. Examples include UKAS in the United Kingdom, ANAB in the United States, and DAkkS in Germany.
Accreditation bodies are peer-evaluated. Accreditation bodies operate to ISO/IEC 17011 and are evaluated by their peers under the International Accreditation Forum's Multilateral Recognition Arrangement, the IAF MLA.
The last layer is what makes a certificate portable. Signatories to the IAF MLA recognize each other's accreditations, so a certificate issued under an MLA-signatory accreditation body in one country is intended to carry the same weight in another.
What accreditation guarantees
Accreditation does not grade your security. It gives assurance about how the certification body operates. Under ISO/IEC 17021-1 and ISO/IEC 27006, an accredited certification body must, among other things:
Be impartial. It must manage conflicts of interest, and it may not provide management system consultancy to the organizations it certifies.
Use competent auditors. Its auditors must meet defined competence requirements, including knowledge of information security and of auditing.
Follow a defined audit process. The two-stage initial audit, annual surveillance, and recertification on a three-year cycle.
Allocate enough audit time. Audit duration is set using defined rules based largely on the number of people working within the scope.
Separate audit from decision. The certification decision is made by people who were not on the audit team.
Handle complaints and appeals. There is a route for challenging decisions and reporting concerns.
The certification body is itself audited by its accreditation body, including by witnessing some of its audits.
What accreditation does not guarantee
Accreditation sets a floor, not a ceiling. It does not mean every auditor is equally experienced in your technology or your industry, or that two accredited bodies will reach identical conclusions. It does not mean a certified organization has no security problems. A certificate states that an ISMS conformed to the standard, for a defined scope, when audited.
It also does not cover scope. A certificate can be fully accredited and cover only a small part of an organization. Reading the scope on the certificate is always part of evaluating it.
The problem with unaccredited certificates
Some certification bodies operate without accreditation from an IAF MLA signatory. Some are accredited by organizations that sound official but are not members of the IAF arrangement. Their certificates can look identical to accredited ones.
The risks fall on you, not the issuer.
Buyers reject them. A procurement team that checks accreditation will treat the certificate as unverified, and you will have spent the time and money to end up where you started.
No independent oversight. Nobody checks the audit process, the auditor's competence, or the audit duration.
Consulting and certifying combined. An offer to build your ISMS and certify it in one package is a strong signal, because an accredited body may not do both.
How to verify a certificate or a certification body
The same checks work whether you are choosing a certification body or reviewing a supplier's certificate.
- Not done:
The certificate names the certification body and shows an accreditation body's mark
- Not done:
The accreditation body is a signatory to the IAF MLA for management system certification
- Not done:
The certification body appears in the accreditation body's directory, with ISO/IEC 27001 within its accredited scope
- Not done:
The certificate appears in the certification body's own register, or in the IAF CertSearch database, with matching details
- Not done:
The certificate states the standard edition, ISO/IEC 27001:2022
- Not done:
Issue and expiry dates are current
- Not done:
The scope covers the services and locations you care about
If you are evaluating a supplier, this is also worth adding to your due diligence process. The guide to answering security questionnaires covers the other side: how buyers will look at your own certificate.
When a supplier's certificate does not check out
If a supplier's certificate fails one of these checks, do not assume bad faith. Expired certificates are often a renewal in progress, and register entries can lag. Ask the supplier directly:
Which certification body issued the certificate, and under which accreditation body?
Is a recertification or transition in progress, and when is it scheduled?
Can they share the current certificate and a summary of the most recent audit outcome?
Until the answers check out, treat the supplier as uncertified for your due diligence and assess them through your normal questionnaire and review process. Record what you asked and what you were told, so the decision is defensible at your own next audit.
Choosing a certification body
Once you have confirmed accreditation, the choice comes down to fit. Questions worth asking each candidate:
Which accreditation body accredits you for ISO/IEC 27001, and is your accreditation current?
Do your auditors have experience with organizations of our type and size, and with our technology?
How do you calculate audit duration for our scope, and what would the stage 1 and stage 2 durations be?
What is your maximum interval between stage 1 and stage 2?
How do you handle nonconformities, and what timescales apply to closing them?
Can you combine ISO 27001 audits with other management system audits we may need later?
How far in advance do you schedule surveillance audits?
Ask for the answers in writing as part of the proposal. They shape your calendar for three years. The stage 1 vs stage 2 article explains what the initial audit involves, and the surveillance audit article covers the years that follow.
Check before you sign
Accreditation is a short check that protects a long investment. Before signing with a certification body, confirm its accreditation directly with the accreditation body, not from the certification body's website alone. Before relying on a supplier's certificate, run the checklist above. The ISO 27001 framework page summarizes what the certificate attests to, and the glossary defines the terms used in certification documents.