Choosing an ISO/IEC 27001 certification body: accreditation, ISMS competence, scope and how to read a quote

What accreditation means for an ISO/IEC 27001 certificate

ISO/IEC 17021-1 sets the rules for every body certifying management systems. ISO/IEC 27006-1:2024, which replaced ISO/IEC 27006:2015, adds the ISMS requirements, under headings such as competence of personnel, certification documents and planning audits, with normative annexes on ISMS auditing knowledge and skills and on audit time.

An accreditation body assesses the certification body against both. Accreditation bodies are recognised in turn through the Global ACI arrangement: Global ACI took over the roles of IAF and ILAC on 1 January 2026, and its arrangement replaced the IAF MLA and ILAC MRA.

Both layers are granted standard by standard: a body accredited for ISO 9001 may hold no accreditation for ISO/IEC 27001, and an accreditation body recognised for quality management need not be recognised for ISMS.

How to check a body's ISMS accreditation

1. Name the certifying company. Get the legal entity, its accreditation body and accreditation number in writing; the accreditation must belong to the company on your contract, not just to the brand.
2. Check the accreditation body. Filter Global ACI's list of recognised accreditation bodies by the ISO/IEC 27001 (ISMS) scope and confirm that the accreditation body appears.
3. Read the accreditation schedule. In the accreditation body's directory, confirm that ISO/IEC 27001 is listed for that entity and the accreditation is current.
4. Search IAF CertSearch, which still carries the IAF name, for ISO/IEC 27001 certificates the body has issued. A thin record in your sector is a question to ask, not proof of a problem.

Checking a supplier's certificate is covered in our guide on how to verify an ISO/IEC 27001 certificate.

Questions that test a body's ISMS competence

Accreditation shows that the body follows the rules, not that your audit team understands your systems. ISO/IEC 27006-1 also provides for external technical experts. Ask every shortlisted body, in writing:

Auditor ISMS and sector experience

• Who will lead Stage 1 and Stage 2, and how many ISMS audits have they led in our sector?
• Does anyone on the team know our technology, such as payments or health data? If not, will a technical expert join?

Cloud providers

Your hosting provider sits outside the certificate, but the risks of relying on it sit inside the ISMS, under the supplier controls and Annex A 5.23, information security for use of cloud services.

• What evidence of a provider's security will you accept: its ISO/IEC 27001 certificate, a SOC 2 report, contract terms?
• Will you examine our cloud accounts by screen-sharing, or from exported records?
• ISO/IEC 27006-1:2024 was revised for organisations with few or no physical relevant sites. How do you audit one?

Annex A exclusions

The Statement of Applicability must justify each excluded Annex A control, and no requirement in clauses 4 to 10 may be excluded. ISO/IEC 27006-1 gives auditors informative guidance on reviewing the Annex A controls.

• How will you test our exclusions against the risk assessment?
• If we exclude secure areas because we have no office, what will you check? Clear desk and screen rules still reach home workers, and a competent auditor tests that boundary.

Writing the justifications is covered in our guide to the Statement of Applicability.

Give every body the same scope, then read the quote

Quotes compare only when every body has priced the same ISMS. Send each one identical details: scope statement, services, sites, cloud platforms, headcount, outsourced processes and existing certificates. ISO/IEC 27006-1:2024 introduced the concept of persons performing certain identical activities, so where large teams do the same work, ask whether each body applied it. Setting the boundary is covered in our guide to ISO/IEC 27001 scope.

ISMS audit time does not follow IAF MD 5, now Global ACI TECH-3-004, which covers quality, environmental and occupational health and safety systems. It comes from the normative audit-time annex of ISO/IEC 27006-1, and ISO/IEC 17021-1 requires the duration and its justification to be recorded. A complete quote states:

• Who certifies: the entity, its accreditation body and number, with ISO/IEC 27001 in scope.
• Auditor days for Stage 1, Stage 2, both surveillance audits and recertification, each with its calculation.
• Sites and sampling: the locations each audit covers and the basis for any sampling under the multi-site clause of ISO/IEC 27006-1.
• Remote and on-site: what is audited remotely and what in person, within Global ACI's mandatory document on using information and communication technology (TECH-3-003).
• The cycle: surveillance at least once a calendar year outside recertification years, the first within 12 months of the certification decision.
• Everything else: technical experts, audit language, travel basis, and fees for application, certificate issue, follow-up visits and rescheduling.

What each line does to the price is explained in our guide to ISO/IEC 27001 certification cost.

Three ISO/IEC 27001 quotes side by side

Illustrative composites of common patterns, not real offers: a software company with two offices and a public-cloud platform sends one scope to three bodies.

Quote A sets the benchmark. Quote B waits until the body proves ISO/IEC 27001 accreditation and shows its working. Quote C costs least because it omits the audit, the accreditation and the cycle: paper, not accredited certification.

Warning signs that should end the conversation

• A guaranteed certificate. The decision follows the audit, is taken by people who did not conduct it and waits for any major nonconformity to be resolved.
• No Stage 1 readiness review. ISO/IEC 17021-1 requires initial certification in two stages; a single visit or an e-mailed document review is not accredited certification.
• Unexplained low days, far below the other quotes with no ISO/IEC 27006-1 working, which usually means less audit.
• Untraceable accreditation: nothing on Global ACI's list, on an accreditation schedule or in IAF CertSearch.
• One firm offering to write and certify. Certification bodies may not provide management system consultancy, so drafting your Statement of Applicability and then certifying it is a conflict of interest.
• Days, not months, or the 2013 edition. An ISMS needs time to produce records, an internal audit and a management review before Stage 2; ISO/IEC 27001:2013 certificates lapsed on 31 October 2025.

Sterling's part in the choice

Sterling does not certify: the accredited body you appoint audits your ISMS and decides. The full route is in our guide to the ISO/IEC 27001 certification process.

Choosing an ISO/IEC 27001 certification body: questions buyers ask