How to verify an ISO/IEC 27001 certificate, and how to spot a fake or a misleading one

Where to check an ISO/IEC 27001 certificate

A PDF attached to a security questionnaire proves only that someone produced a PDF. Forgeries are easy to make and genuine certificates get suspended while copies circulate, so check four independent sources, reaching each yourself rather than through a link or QR code on the document. For an ISMS-certified buyer, the record also supports its own supplier controls (Annex A 5.19 to 5.22).

1. IAF CertSearch

The global database of accredited management system certifications kept its IAF CertSearch name when Global ACI took over the roles of IAF and ILAC. Search by organisation name or certificate details, compare the result with the paper, and set expiry and suspension alerts. Because certification and accreditation bodies feed its records, an absent entry calls for a word with the issuer before any conclusion.

2. The certification body's register

The issuing body has the last word on status. Accredited bodies answer validity enquiries, so ask, through its online register or contact details you found independently, whether the certificate is current and what it covers.

3. The accreditation body's directory

The certificate should carry an accreditation symbol and number. The accreditation body's directory must show that number against the same legal entity, currently accredited for ISO/IEC 27001 under ISO/IEC 17021-1 and ISO/IEC 27006-1, the extra rules for bodies certifying information security management systems. Accreditation for ISO 9001 alone does not stretch to an ISMS certificate; our guide to choosing an ISO/IEC 27001 certification body covers the other checks.

4. Global ACI's list of recognised accreditation bodies

The Global ACI arrangement replaced the IAF MLA and ILAC MRA on 1 January 2026. Global ACI recognises accreditation bodies rather than accrediting certification bodies. Filter its list to ISO/IEC 27001: an accreditation body missing from it gives no internationally recognised standing, whatever its title suggests.

What a genuine ISO/IEC 27001 certificate shows

ISO/IEC 17021-1 sets what accredited certification documents identify. Look for:

• The certification body: name, address and, usually, an authorised signature.
• The accreditation mark: the accreditation body's symbol and the number it assigned the certification body.
• The organisation: legal name and location, or headquarters and each site of a multi-site certificate.
• The scope statement: services, activities and locations inside the ISMS, precise enough to test.
• The Statement of Applicability reference: where the body includes it, the version or date audited, tying the certificate to a defined set of controls.
• Edition, number and dates: ISO/IEC 27001:2022, sometimes with its 2024 amendment; a unique number; the current and original issue dates; an expiry within a three-year cycle.

A register match is true on the day you looked; our guide to surveillance and recertification explains what keeps it true.

Why the scope statement matters more on an ISMS certificate

Few certificates depend on their scope as heavily. Clause 4.3 lets an organisation draw its ISMS around the whole business or around one department, data centre or service, and the Statement of Applicability then records which Annex A controls apply inside it, justifying each exclusion. Two genuine certificates can therefore promise very different protection.

A certificate for "the IT department" can be entirely valid yet say nothing about the platform you pay for, its engineers or the cloud accounts holding your data. Ask:

• Is the service you receive named?
• Are the teams that develop, run and support it inside?
• Are the sites, cloud platforms and regions processing your data covered?
• Does the Statement of Applicability exclude a control you depend on, such as secure development?

Our ISO/IEC 27001 scope guide covers writing your own.

Signs of a fake or misleading ISO/IEC 27001 certificate

Problem certificates are forged, unaccredited or misleading: genuine and accredited, but narrower than the holder implies. Watch for:

• Accreditation that does not trace back: no mark, a body missing from Global ACI's list, an unknown number, or "accredited by IAF" or by Global ACI, neither of which accredits certification bodies.
• A body outside its accreditation: accredited for other standards, not ISO/IEC 27001, yet using its mark on the ISMS certificate.
• A scope or entity that misses you: head office or corporate IT only, or a parent, affiliate or trading name instead of your contracting company.
• Dates that fail: expired, open-ended, beyond three years, or ISO/IEC 27001:2013, whose certificates lapsed on 31 October 2025.
• A consultant as certifier: a "certificate" from the firm that built the ISMS; accredited certification bodies may not provide management system consultancy.
• Claims certification never makes: the ISO logo, "certified by ISO", "ISO 27001 compliant" instead of a certificate, or a product labelled certified.
• A certificate mill: certified within days, no Stage 1 readiness review or Stage 2 audit, a guaranteed outcome, a flat fee for any standard.

Speed is the plainest tell. An accredited audit samples evidence that takes months to exist, from completed risk assessments to an internal audit and management review; a certificate obtained without it closes no security gap and fails the first serious vendor review.

What a vendor-review team should ask for beyond the certificate

A certificate shows that an accredited body audited an ISMS, not which controls protect your data or how recently anyone looked. Request:

• The full scope statement, naming services, sites, teams, cloud platforms and regions.
• A Statement of Applicability summary, or the full document under a non-disclosure agreement: controls applied, controls excluded and why, and a version matching the certificate.
• The last surveillance audit date and the next one planned.
• Significant changes since, such as acquisitions, new hosting regions or major incidents, and whether the certification body was told.
• The cloud providers and subcontractors behind the service, and how the ISMS controls them.

If the supplier also offers a SOC 2 report, our guide to ISO/IEC 27001 vs SOC 2 explains what each proves.

ISO/IEC 27001 certificate verification checklist

Record the date, source and result of each check in your supplier file.

When a certificate fails the checks: what to do next

One failed check is not proof of fraud: certificates are renumbered on renewal, move between certification bodies and reach registers late.

1. Put it to the supplier: request the current certificate and the certification body's contact, with a reply date.
2. Go to the certification body directly, through details you looked up yourself, for written confirmation of validity, entity, sites and services; it will not release the audit report.
3. Report a forgery, a certificate the named body never issued or one altered since, to that body and to the accreditation body whose symbol it misuses; preserve the evidence and let legal advice shape any contractual step.
4. Treat a genuine but unaccredited, lapsed or out-of-scope certificate as a risk decision: added safeguards, a dated commitment to accredited certification covering your service, your own assessment, or a new supplier. Record the decision.

ISO/IEC 27001 certificate checks: questions buyers ask