An ISO/IEC 27001 certificate is only as credible as the body that issued it, and buyers regularly discover too late that a cheap, fast certificate came from an unaccredited issuer their customers will not accept. Choosing a certification body is a three-year commitment: initial certification, annual surveillance audits and a recertification audit, all priced on audit days. This vendor-neutral guide covers how to check accreditation (including IAF CertSearch and national accreditation bodies such as UKAS), what decides the number of audit days, what drives cost, where the transition to ISO/IEC 27001:2022 now stands, and how to compare proposals. It is for ISMS managers, compliance leads and procurement teams buying certification, not for certification bodies themselves. Preparing for certification is covered in our ISO 27001 Certification Guide and the ISO 27001 Certification Readiness Checklist.
Key takeaways
- Accredited or not is the first filter. Accredited certification means an IAF recognised accreditation body has assessed the certification body against ISO/IEC 17021-1 and ISO/IEC 27006-1. Verify it yourself on IAF CertSearch or the accreditation body's register.
- Audit days are not negotiable downwards at will. Accredited bodies calculate audit time from the number of people working under the ISMS and its complexity, so a quote far below its peers deserves questions.
- Compare three-year cost, not stage 2 cost. Surveillance and recertification audits, travel, certificate fees and annual charges often exceed the initial audit price.
- The certifier cannot be your consultant. Impartiality rules stop a certification body from implementing your ISMS and then certifying it. Treat a bundled offer as a red flag.
- The 2013 version is finished. Certificates to ISO/IEC 27001:2013 expired on 31 October 2025 under the IAF transition rules, so any new certificate should reference ISO/IEC 27001:2022.
Define requirements
- Who must accept the certificate: list the customers, regulators and tenders driving certification and what they require. Many ask for accredited certification, and some name a specific accreditation body or require a mark recognised under the IAF Multilateral Recognition Arrangement (MLA).
- Scope statement: the organisational units, locations, services and technology covered, as it will appear on the certificate. A narrow scope is cheaper but may not satisfy the customers who asked. See the ISO 27001 Statement of Applicability Template.
- Headcount and sites: the number of people doing work under the organisation's control within scope, including contractors, and the number of sites, temporary sites and remote working arrangements. These drive audit time.
- Integrated audits: whether you also want ISO 9001, ISO 22301, ISO/IEC 27701 or ISO/IEC 42001 audited by the same body, which can reduce combined days.
- Timeline: target date for the certificate, accounting for stage 1, time to close stage 1 findings, stage 2 and the certification decision.
- Language and geography: auditors able to work in the languages and countries in scope, and whether remote audit techniques are acceptable to you.
Capability areas
| Stage in the three-year cycle | What the certification body does | What to check in the proposal |
|---|---|---|
| Stage 1 | Reviews ISMS documentation, scope and readiness | Days, on-site or remote, and how findings must be closed before stage 2 |
| Stage 2 | Audits implementation and effectiveness of the ISMS and Annex A controls | Days per site, sampling approach, auditor sector experience |
| Certification decision | Independent review of the audit by people who did not audit you | Typical time from audit close to certificate issue |
| Surveillance (years 1 and 2) | Audits part of the ISMS each year, always including key elements such as internal audit and management review | Days per visit and annual fees |
| Recertification (year 3) | Re-audits the whole ISMS before the certificate expires | Days and price fixed now, not left open |
| Special audits and transitions | Scope extensions, short-notice audits, version transitions | Rates for extra days; IAF MD 26 set a minimum half day of extra time for the 2022 transition |
Verifying accreditation
- Search the certification body and a sample of its client certificates on IAF CertSearch, which describes itself as "the official global database for accredited certificates" and cross-checks that the certificate is valid, that the body was accredited to issue it, and that the accreditation body is an IAF MLA signatory for that standard.
- Confirm the accreditation scope on the national accreditation body's register. In the UK, UKAS offers CertCheck to "Verify UKAS accredited Management System certificates".
- Check that the accreditation covers ISO/IEC 27001 specifically, not only ISO 9001 or another scheme the body also certifies.
- Ask for a sample certificate: it should carry the accreditation mark, a certificate number you can verify, the standard version, scope and expiry date.
Evaluation criteria
An illustrative weighting: 30% accreditation and recognition, 25% auditor competence, 20% three-year cost, 15% audit approach, 10% service. Agree weights before opening proposals.
| Criterion | Strong answer | Weak answer |
|---|---|---|
| Accreditation | ISO/IEC 27001 in the accreditation scope of an IAF MLA signatory, verifiable on CertSearch | "Accredited" by an organisation that is not an IAF member, or no verifiable register |
| Audit time | Days calculated and explained from your headcount, sites and complexity, in line with ISO/IEC 27006-1 | A flat package regardless of size; stage 2 in a single day for a large scope |
| Auditor competence | Named lead auditor with ISMS audit experience in your sector and technology (cloud, SaaS, OT, AI services) | Auditor allocated late with no sector match |
| Three-year price | Every audit, fee and expense shown for all three years | Low stage 2 price, surveillance and certificate fees undisclosed |
| Impartiality | Clear statement that no consultancy is offered to you, and how conflicts are managed | Offers to write your policies or "fast track" certification |
| Recognition by your customers | Accreditation body and mark accepted by the customers or tenders that drove the project | A mark your largest customer does not recognise |
| Service | Realistic scheduling, a portal for findings, defined timeline for the certification decision | Long waits for audit dates; no route to raise complaints or appeals |
What drives cost
No regulator publishes certification prices. Cost follows audit days multiplied by the day rate, plus travel, application and certificate fees and any annual management charge. Audit days rise with headcount in scope, number of sites, regulatory or technical complexity and outsourced processes, and can be adjusted within limits for factors the accreditation rules allow. Ask every bidder to state the headcount and sites they assumed, so differences in price can be traced to differences in assumptions.
Where identity fits
Auditors routinely sample Annex A controls on identity: 5.15 access control, 5.16 identity management, 5.17 authentication information, 5.18 access rights and 8.2 privileged access rights. Ask whether the lead auditor can assess service accounts, API keys and cloud roles as well as staff accounts, since machine identities are often outside the evidence an inexperienced auditor asks for. See the NIST SP 800-53 to ISO 27001 Mapping Guide for how these controls map to other frameworks.
Questions to ask vendors
- Which accreditation body accredits you for ISO/IEC 27001, under what accreditation number, and can we verify it on IAF CertSearch?
- How did you calculate the audit days for each stage, which headcount and sites did you assume, and what adjustments did you apply?
- What is the full three-year cost, including surveillance, recertification, certificate fees, annual charges and expenses?
- Who will lead our audit, what ISMS audit experience do they have in our sector, and will the same auditor stay for surveillance?
- What consultancy or training do you or related companies offer, and how do you ensure impartiality?
- How much of the audit can be remote, and how do you sample sites and outsourced suppliers?
- How long from stage 2 close to the certification decision, and how do we appeal a decision or complain?
- How would you handle adding a standard such as ISO/IEC 27701 or ISO/IEC 42001 later, and how would that change audit days?
Red flags
- A certificate promised within days, or without any on-site or remote audit of implementation.
- An accreditation body you cannot find among IAF members, or a certificate that does not appear on CertSearch.
- A combined offer to implement your ISMS, write your documents and certify the result.
- A price that ignores headcount and sites, or audit days well below other accredited bidders.
- Proposals that still offer certification to ISO/IEC 27001:2013.
- Reluctance to name auditors or explain the appeals process.
Proof of concept
You cannot trial a certificate, but you can test a shortlist in a few weeks.
- Verify accreditation: check each bidder and two of its existing client certificates on CertSearch and on the national register.
- Send one scope pack: the same scope statement, headcount, sites and outsourced services to every bidder, and compare the audit days each derives.
- Interview the lead auditor: ask how they would audit two of your harder controls, for example privileged access and supplier security in cloud services.
- Check customer acceptance: confirm with your key customers that the accreditation body and mark are acceptable before signing.
- Fix the contract: three-year price, day rates for extras, cancellation and transfer terms.
After appointment, track days from stage 2 to certificate, nonconformities raised and closed on time, repeat findings at surveillance, and customer questionnaires answered by the certificate alone.
How NHI Mgmt Group can help
We provide independent requirements, RFP and evaluation support for assurance and certification services, including how identity and machine identity controls will be audited. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: ISO 27001 Certification Guide · ISO 27001 Internal Audit Programme Template · ISO 27001 Lead Auditor and Lead Implementer Guide · SOC 2 Auditor Selection