Verifying Supplier ISO 27001 Certificates: Buyer Checks

A supplier's ISO 27001 certificate is often accepted at face value in due diligence, yet the certificate may cover a different part of the business, come from an unaccredited issuer, be out of date, or not exist in the issuer's records at all. Buyers who tick "ISO 27001: yes" without checking can end up relying on assurance that never applied to the service they bought. This guide sets out the buyer-side checks: confirming the certificate is genuine and current, tracing the accreditation chain, reading the scope and Statement of Applicability against the service, interpreting status and dates, and spotting red flags. It is written for third-party risk analysts, procurement and security assurance teams. For how certification works from the certified organisation's side, see the ISO 27001 Certification Guide; for choosing your own certification body, see the ISO 27001 Certification Body Selection guide.

Key takeaways

Verify with the issuer, not the PDF. A certificate image proves nothing on its own: confirm it with the certification body's register or directly with the certification body, and use IAF CertSearch as a first check.
Accreditation is a chain with three links. The certificate, the certification body's accreditation for ISO/IEC 27001, and the accreditation body's recognition under the international mutual recognition arrangement must all hold.
Scope decides relevance. A genuine certificate for one office, one product or one data centre says little about the service you are buying unless the scope statement covers it.
The Statement of Applicability shows which controls are in play. Ask for it, or a redacted summary, and check that controls relevant to your data were not excluded.
Certification is a floor, not the whole answer. Treat a verified certificate as evidence that a management system is audited, then target your own questions at the risks that matter for this supplier.

What an ISO 27001 certificate does and does not tell you

An accredited ISO/IEC 27001 certificate means a certification body, itself assessed against ISO/IEC 17021-1 and the ISMS-specific requirements in ISO/IEC 27006-1, has audited the organisation's information security management system against the standard for a defined scope. Certification runs on a three-year cycle with surveillance audits in between, so a certificate is a statement about a system that is audited regularly, not a one-off test.

A verified certificate tells you	It does not tell you
An ISMS exists for the stated scope and was audited against ISO/IEC 27001	That every Annex A control is implemented, or implemented well
The certification body was accredited to certify ISMS, if the accreditation chain checks out	That the service, region or subsidiary you use is in scope
The organisation commits to risk assessment, treatment and continual improvement	The level of residual risk the supplier accepted, or whether you would accept it
Nonconformities were closed to the auditor's satisfaction before certification	Results of technical testing such as penetration tests, which ISO 27001 audits do not require

That is why a certificate complements, rather than replaces, questionnaires, contract clauses and reports such as SOC 2. See How to Read a SOC 2 Report Guide for the attestation alternative many US suppliers offer.

Step one: confirm the certificate is genuine and current

UKAS's technical bulletin on validating management system certificates sets out a three-step approach: confirm the certification body is accredited by a recognised accreditation body, check that body's accreditation claim and scope, and confirm the certificate is valid with the certification body. Apply it in this order:

Collect the certificate details. Certified organisation's legal name and address, certificate number, standard and version, scope statement, sites, issue and expiry dates, the certification body's name and the accreditation mark shown.
Search IAF CertSearch. It describes itself as "the exclusive global database for accredited management system certifications" and says it cross-checks three layers: accreditation bodies and their recognition status, the certification bodies they accredit, and the certified organisations, sites and scopes. A match there with the same scope and dates is a strong first signal.
Do not treat a missing entry as proof of fraud. UKAS notes that CertSearch is not fully populated and that certification bodies are not required to upload certificate data, although accreditation bodies must upload data on the certification bodies they accredit. If the certificate is absent but the body is clearly accredited, go to the next step.
Confirm with the certification body. Use the body's own online certificate register or contact it directly, using contact details from the accreditation body's published schedule rather than from the certificate itself. Ask it to confirm the status, scope, sites and expiry date.
Record the evidence. Keep a screenshot or confirmation email with the date checked, so the decision can be audited later.

Step two: trace the accreditation chain

Accreditation is what makes a certificate independent. UKAS warns that there is no restriction on who can set up as an accreditation body, which is why the chain must be checked to the top.

Link	What to check	Where
Certificate to certification body	The certificate exists in the body's records with matching scope, sites and dates	The body's online register, or direct confirmation
Certification body to accreditation body	The body's accreditation specifically includes ISO/IEC 27001 ISMS certification, not only ISO 9001 or another scheme	The accreditation body's directory and the body's schedule of accreditation (UKAS calls its search "Who's Accredited")
Accreditation body to international recognition	The accreditation body is a recognised signatory for management system certification and the relevant sub-scope	The international accreditation cooperation's signatory lists

The international layer changed in 2026. The International Accreditation Forum (IAF) and the International Laboratory Accreditation Cooperation (ILAC) were replaced by Global Accreditation Cooperation Incorporated, which began full operations on 1 January 2026. Its launch notice states that accreditations issued under the IAF MLA and ILAC MRA continue to be recognised as they transition to the new arrangement, and that the IAF MLA and ILAC MRA marks remain valid until the new mark is fully adopted. The IAF website is now a legacy archive. So, as of November 2026, a certificate bearing an IAF MLA mark is not out of date for that reason, and signatory status should be checked through the current body's information. Before it closed, the IAF described the MLA as an arrangement that accreditation bodies join only after peer evaluation, with signatories required to recognise certificates issued under other signatories' accreditation within the relevant scope.

Check the scope of the accreditation, not just its existence. UKAS cautions that a certification body may hold accreditation that does not include the management system relevant to your purchase. A body accredited for quality management can still issue an unaccredited ISO 27001 certificate; the accreditation mark on that certificate should then be absent, and an accredited mark on it is a serious red flag.

Step three: read the scope against the service

ISO/IEC 27001 requires the organisation to define the boundaries and applicability of its ISMS (clause 4.3), and the certificate's scope statement is the public summary of that decision. This is where most practical gaps appear.

Organisational coverage: is the contracting entity named, or only a parent, sister company or acquired business? Group certificates may list certain legal entities only.
Service and product coverage: does the scope name the platform, product or managed service you buy? A scope of "provision of software development services" may exclude the hosting operation that holds your data.
Locations: are the sites that operate the service listed, including support and operations centres? Offshore support teams are a common omission.
Outsourced elements: scope statements often say that the ISMS relies on named cloud providers or other subcontractors. That is legitimate, but your due diligence must then cover those parties too. See the ISO/IEC 27036 Supplier Relationships Guide for managing fourth parties.
Standard version: certification bodies had until 31 October 2025 to move clients to ISO/IEC 27001:2022, and certificates to the earlier version have expired. A certificate still citing the 2013 version, or its European adoption, is not current.

Step four: review the Statement of Applicability

The Statement of Applicability (SoA), required by clause 6.1.3 d), lists the necessary controls, whether each is implemented and the justification for inclusion or exclusion. It is the bridge between the scope and the controls that protect your data. Many suppliers will share it under NDA, or provide a summary.

What to look at	Why it matters	Follow-up question
SoA version and date	It should match the one referenced in the current certification cycle, where the certificate cites a version	"Is this the SoA version the last audit used?"
Excluded Annex A controls	Exclusions are allowed with justification, but some matter directly to you	"Why is control A.5.23 or A.8.28 excluded, given the service?"
Supplier and cloud controls (A.5.19 to A.5.23)	Show how the supplier manages its own suppliers and cloud services	"How do you assess the cloud providers named in your scope?"
Access and identity controls (A.5.15 to A.5.18, A.8.2, A.8.5)	Show how privileged, user and machine access is controlled	"How are service accounts and API keys used by the service governed?"
Logging, monitoring and incident controls (A.8.15, A.8.16, A.5.24 to A.5.28)	Decide how quickly a breach affecting you would be found and reported	"What is your notification time to customers?"

The ISO 27001 Statement of Applicability Template shows what a complete SoA looks like, and the ISO 27001 Annex A.5 Organisational controls and ISO 27001 Annex A.8 Technological controls guides explain the controls in detail.

Where identity fits

ISO 27001 audits sample identity controls, but a certificate does not tell you how the supplier handles the credentials that touch your environment. If the supplier integrates by API, OAuth app or service account, ask specifically how those non-human identities are inventoried, scoped, rotated and revoked at contract end, and treat the answer as a separate check from the certificate. See the Third-Party Risk Management Guide for how this fits into wider supplier assessment.

Red flags

Red flag	What it may mean	Action
Certificate not found on the certification body's register and the body will not confirm it	Fabricated or altered certificate	Treat as unverified; escalate and ask the supplier for an explanation in writing
Certification body accredited by an organisation you cannot find among recognised signatories	Unrecognised or self-styled accreditation body	Treat as unaccredited certification
Accreditation mark shown, but the body's accreditation does not include ISO/IEC 27001	Mark misused, or certificate issued outside accreditation	Confirm with the accreditation body
Expiry date passed, or more than three years after issue	Lapsed certificate, or a non-standard cycle	Ask for the current certificate and recertification evidence
Scope covers a parent, a different entity or a different service	Assurance does not apply to what you buy	Ask for an in-scope certificate or treat the service as uncertified
Suspended or withdrawn status on the register	Serious nonconformities or failure to complete surveillance	Ask why and what corrective action is under way
Supplier refuses to share any SoA detail, even under NDA	Exclusions may matter to you	Rely on targeted questions and contract terms instead
Details differ between the certificate and the register (name, address, sites)	Edited document or out-of-date copy	Rely on the register entry, not the PDF

Building verification into supplier management

Tier first. Apply full verification (register, accreditation chain, scope and SoA) to critical and high-risk suppliers; a register and scope check is proportionate for low-risk ones.
Make it part of onboarding. Add certificate number, certification body, accreditation body, scope summary, expiry date and verification date as required fields in the supplier record.
Ask for evidence in contracts. Require the supplier to maintain certification for the named scope, notify you of suspension, withdrawal or material scope changes, and share surveillance outcomes on request. The Supplier Security Policy Template gives model wording.
Monitor continuously. Diary each expiry date and re-verify at each surveillance anniversary. CertSearch offers status alerts for suspended, withdrawn or expired certificates; register-based checks work where a certificate is not listed.
Escalate gaps, do not just record them. Out-of-scope services and unverifiable certificates should trigger the same compensating assessment as an uncertified supplier, such as a questionnaire or a supplier security audit.

Decision guidance

Certificate or SOC 2: an ISO 27001 certificate tells you a management system is in place for a scope; a SOC 2 Type 2 report describes controls and how they operated over a period, with exceptions. For critical suppliers, ask for both where they exist and read the scope of each.
Small buyers with little leverage should focus on register confirmation, scope and expiry, which are free and quick, and use targeted questions for the controls that matter most.
Large buyers and regulated firms should also check SoA exclusions and surveillance outcomes, and record the verification so it can be shown to auditors and regulators under supplier oversight requirements.

Detection and measurement

Verification coverage: percentage of certified critical suppliers whose certificate was confirmed with the issuer in the last 12 months.
Scope fit rate: share of certified suppliers whose scope demonstrably covers the contracted service.
Expired or lapsed certificates: count of suppliers relying on an expired, suspended or withdrawn certificate, and days to resolution.
Unverifiable certificates: number found per year and how each was resolved.
Time to verify: working days from request to completed verification for a new supplier.

Report these alongside the wider measures in the Third-Party Risk KPIs and KRIs to Report to the Board guide.

Common failure patterns

Accepting the PDF. The certificate image is filed, never confirmed with the issuer, and later turns out to be altered or lapsed.
Ignoring scope. A genuine certificate for the head office is treated as covering a hosted service run from another country by a subsidiary.
Confusing accreditation of the body with accreditation of the scheme. The certification body is accredited for ISO 9001 only, and its ISO 27001 certificates sit outside accreditation.
Treating absence from CertSearch as proof of fraud, and rejecting a legitimate supplier whose certification body simply does not upload data.
Checking once. Verification at onboarding only, so a later suspension or a scope reduction goes unnoticed for years.
Stopping at the certificate. No follow-up on SoA exclusions, subcontractors or the credentials the supplier holds into your environment.

Framework mapping

Framework	Reference	Relevance
ISO/IEC 27001:2022 Annex A	A.5.19 Information security in supplier relationships, A.5.20 Addressing information security within supplier agreements, A.5.22 Monitoring, review and change management of supplier services	Verifying certificates is part of assessing and monitoring suppliers
NIST CSF 2.0	GV.SC-06, GV.SC-07	Due diligence before contracting, and assessing and monitoring supplier risk over the relationship
NIST SP 800-53 Rev 5	SR-6 Supplier Assessments and Reviews, SA-9 External System Services	Assessing suppliers and the external services they provide
Conformity assessment standards	ISO/IEC 17021-1, ISO/IEC 27006-1:2024	The requirements certification bodies are accredited against; the basis for trusting the certificate

Practitioner checklist

Capture certificate number, certification body, accreditation body, scope, sites, version and dates for every certified supplier.
Search IAF CertSearch first, then confirm with the certification body using contact details from the accreditation body's schedule.
Check that the certification body's accreditation includes ISO/IEC 27001, and that the accreditation body is a recognised signatory.
Read the scope against the contracted entity, service and operating locations.
Confirm the certificate cites ISO/IEC 27001:2022 and has not expired.
Request the SoA or a summary for critical suppliers and question relevant exclusions.
Write certification maintenance and change notification into the contract.
Re-verify at each surveillance anniversary and before renewal.

Verifying Supplier ISO 27001 Certificates: Scope, Accreditation and Red Flag Checks