ISO 27001 Certification in USA
ISO/IEC 27001:2022 information security management system certification for American businesses
ISO/IEC 27001 sets requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). An ISMS manages information security risks to protect the confidentiality, integrity and availability of information.
Independent certification evaluates your ISMS against the standard within a defined scope. It is not a penetration test, a guarantee against attacks or a legal compliance determination.
Standard status
Current ISO/IEC 27001 standard — 2022 edition
ISO/IEC 27001:2022 is the current published ISMS requirements standard. The transition from the 2013 edition ended in October 2025, so certificates must now reference the 2022 edition. As of October 2026, no new edition has been published.
- Current standard
- ISO/IEC 27001:2022Information security, cybersecurity and privacy protection — Information security management systems — Requirements.
- Amendment
- Amd 1:2024Climate action changes: decide whether climate change is a relevant issue (4.1); interested parties can have climate-related requirements (4.2). No climate control program is required.
- Controls guidance
- ISO/IEC 27002:2022Guidance on the 93 information security controls listed in Annex A.
- Risk guidance
- ISO/IEC 27005:2022Guidance on information security risk management.
Certification bodies work to ISO/IEC 17021-1 and ISO/IEC 27006-1:2024, the requirements for bodies certifying an ISMS. Sources: ISO/IEC 27001 (iso.org) (opens in a new tab) · Amendment 1:2024 (opens in a new tab) · ISO/IEC 27006-1:2024 (opens in a new tab)
Buyer requirements
Why your customers may require ISO 27001 certification
Some customers ask for ISO 27001; others ask for a SOC 2 report or answers to their own questionnaire. Each buyer decides what assurance and scope it accepts, and certification does not guarantee a contract.
- Enterprise procurement Supplier onboarding often asks for security assurance.
- Vendor security questionnaires A certificate and SoA can answer many questions, though not all.
- Due diligence Investors, partners and acquirers review security governance.
- Supplier qualification Some approved-supplier lists name ISO 27001.
- Contractual requirements Contracts may require certification for a defined scope.
- B2B SaaS confidence Customers want to know how their data is protected.
- Data protection expectations A structured ISMS supports, but does not prove, privacy compliance.
- Independent assessment A third-party audit rather than self-declaration.
The basics
Understanding information security management system certification
Your ISMS is your work. Certification is an independent check of it.
An ISMS is how an organization governs information security. It sets out how you protect confidentiality (only authorized people see information), integrity (information is accurate and complete) and availability (information is there when needed).
You assess information security risks, decide on risk treatment, set security objectives, operate controls, audit yourself internally, review at management level and improve continually.
Third-party certification means a certification body audits the ISMS and makes an independent decision for the scope stated on the certificate.
Certification covers your ISMS within its scope. It does not certify each system, product or cloud service. It is not a guarantee against cyberattacks or a penetration test. It does not establish compliance with privacy or cybersecurity laws, and it does not certify your cloud vendors, suppliers or subsidiaries.
Scope builder
Define your ISO 27001 certification scope
Scope decides almost everything: what customers can rely on, which risks and controls apply and how long audits take. The narrowest scope is not automatically best. The summary is for technical review only; the certification body reviews and accepts the final scope.
Requirements
Understanding ISO/IEC 27001:2022 requirements
Clauses 4 to 10 in our own words. These summaries do not reproduce or replace the standard.
Risk assessment
Understanding ISO 27001 information security risk assessment
You identify information assets and processes, then threats and vulnerabilities that create risk scenarios. Each risk is analyzed for consequence and likelihood, evaluated against your criteria, and assigned a risk owner, who decides on treatment and accepts the residual risk.
Scenarios for a hypothetical SaaS company. Educational only: this does not rate your risks, set acceptable residual risk or produce a risk register.
Risk treatment
How organizations address information security risks
The options available depend on your risk method and context. No single control checklist suits every company.
See also: risk scenarios · Annex A controls · Statement of Applicability · readiness check
- Modify Add or change controls to reduce likelihood or consequence.
- Avoid Stop the activity that creates the risk.
- Share Transfer part of the risk, for example by contract or insurance, where appropriate.
- Retain Accept the risk when it meets your acceptance criteria.
- Control selection Choose controls from any source, then compare them with Annex A so nothing necessary is missed.
- Treatment plan Actions, owners, resources and dates, approved by risk owners.
- Monitoring Check that controls work and review residual risk.
Annex A
Explore the 93 ISO 27001 Annex A security controls
Annex A lists 93 controls in four themes. It is a reference list: you select controls through risk treatment and justify the selection in your Statement of Applicability. Controls outside Annex A can be added where your risks need them.
- A.5Organizational37 controls
- A.6People8 controls
- A.7Physical14 controls
- A.8Technological34 controls
Control numbers and short titles follow ISO/IEC 27001:2022 Annex A. Summaries are our own and do not reproduce the control text.
Statement of Applicability
What is the ISO 27001 Statement of Applicability?
The SoA lists the controls you need, why each is included, whether it is implemented, and why any Annex A control is excluded. It connects risk treatment to the controls auditors check. It is not a tick-all form, and selecting 93 of 93 is not better by default.
| Control | Applicability | Justification | Implementation status | Illustrative evidence |
|---|---|---|---|---|
| 5.23 Information security for use of cloud services | Applicable | The platform runs on a public cloud provider (risk R-04). | Implemented | Cloud service inventory, provider assessment |
| 7.12 Cabling security | Not applicable | No owned premises with in-scope cabling; offices are shared co-working spaces where staff use cloud services only, and no in-scope information is processed on local networks. | — | Scope statement, office arrangement |
| 8.12 Data leakage prevention | Applicable | Customer exports could leave through email or file sharing (risk R-09). | Planned — Q2 | Risk treatment plan entry |
| Additional control: customer key management option | Applicable | Contractual requirement from enterprise customers (risk R-11). | Implemented | Customer contracts, key management records |
Illustrative only. Your organization makes and justifies its own applicability decisions; this page does not produce an SoA for you.
Cloud and SaaS
ISO 27001 for cloud services and SaaS companies
Your certificate does not certify AWS, Microsoft Azure or Google Cloud, and their certificates do not cover your ISMS. Who is responsible for what depends on your architecture and contracts.
- Shared responsibilityKnow which controls are yours and which are the provider’s.
- Identity and accessStrong authentication and least privilege for cloud consoles and production.
- Secure developmentSecure coding, change management and testing before release.
- Vulnerabilities and configurationPatching, baselines and configuration monitoring.
- Backups and continuityTested restores and ICT readiness.
- Logging and incidentsLogs, monitoring and response across providers.
Responsibility guide
Supply chain
Managing information security across your supply chain
You identify supplier risks, set security requirements in agreements, monitor suppliers and handle their incidents. Suppliers do not become certified because you are. Example for a hypothetical company:
| Supplier | Information involved | You control | Supplier controls | Relevant evidence |
|---|---|---|---|---|
| Cloud infrastructure | Production systems and customer data | Configuration, identities, data and monitoring | Physical data centers, hardware and core infrastructure | Provider assurance reports, shared responsibility model, configuration reviews |
| Payroll services | Employee personal and bank information | What you send, who can access the payroll portal | Security of the payroll platform | Supplier assessment, contract clauses, access list |
| CRM platform | Customer contact and sales data | User access, data exported, integrations | Platform security and its subprocessors | Access reviews, data processing terms |
| Payment processing | Cardholder data flows | Integration and what card data touches your systems | Card processing environment under its own validation | Integration design, provider compliance evidence |
| Outsourced IT support | Administrator access to your systems | What access is granted, monitoring and removal | Its staff vetting and own security | Contract terms, privileged access logs, review meetings |
Incidents and continuity
How ISO 27001 supports structured security incident management
An event is something that may affect security, such as a suspicious login. An incident is an event assessed as harming, or likely to harm, information security. Certification does not prevent incidents. Legal reporting duties vary by jurisdiction and situation.
- Prepare Plan, roles and contacts.
- Report Staff report events promptly.
- Assess Decide whether an event is an incident.
- Respond and escalate Contain and escalate as planned.
- Preserve evidence Collect and protect evidence.
- Record Keep incident records.
- Learn Review lessons and take corrective action.
- Notify Consider legal, regulatory and contractual notification duties.
Information security during business disruptions
ISO 27001 covers keeping information secure during disruption and ICT readiness. Full business continuity management is covered by ISO 22301, a separate certification.
- ICT readiness Recovery objectives for systems and services.
- Backup and recovery Tested restores.
- Availability Redundancy where requirements need it.
- Supplier dependencies Critical providers in continuity plans.
- Testing Exercises against objectives.
- Crisis communication Who tells customers what, and when.
Frameworks compared
ISO 27001, SOC 2 and NIST CSF — what is the difference?
SOC 2 is not an ISO certification, and NIST CSF is not a certifiable standard. ISO 27001 certification does not satisfy a SOC 2 examination. Many organizations use more than one; buyers decide which they accept.
| ISO/IEC 27001 | SOC 2 | NIST CSF 2.0 | |
|---|---|---|---|
| Purpose | Requirements for an information security management system | Report on controls relevant to security, availability, processing integrity, confidentiality or privacy | Voluntary framework of cybersecurity outcomes |
| Owner | ISO and IEC | AICPA (Trust Services Criteria) | NIST (US Department of Commerce) |
| Intended audience | Any organization; customers and partners worldwide | Service organizations and their user entities, typically US customers | Any organization; widely used in the US |
| Assessment type | Third-party certification audit by a certification body | Attestation examination by a licensed CPA firm | Self-assessment or third-party review; no NIST certification |
| Governing requirements | ISO/IEC 27001:2022 clauses 4–10; Annex A as a reference | Trust Services Criteria and AICPA attestation standards | CSF 2.0 Functions, Categories and Subcategories |
| Independent assurance | Yes, through accredited certification | Yes, through a CPA opinion | Not built in |
| Typical deliverable | Certificate with scope, plus audit reports to the client | Restricted-use report with auditor opinion and control descriptions | Current and target profiles, internal reports |
| Scope | Organization-defined ISMS scope | Defined system and chosen criteria; Type 1 (point in time) or Type 2 (period) | Organization-defined |
| US buyer relevance | Often accepted, especially by global buyers; acceptance varies | Common request from US enterprise buyers of SaaS and services | Common in US critical infrastructure and government-related work |
| International relevance | High | Mainly US | Growing; referenced internationally |
| Ongoing maintenance | Annual surveillance, recertification every three years | New report each period, often annual | Self-directed review |
Sources: NIST CSF 2.0 (opens in a new tab) · AICPA SOC suite of services (opens in a new tab)
US context
ISO 27001 and US information security compliance requirements
An ISMS can help you organize how you meet legal and contractual requirements, but certification is not a compliance determination. Which rules apply depends on your sector, data, customers and contracts. This is general information, not legal advice.
| Requirement | Who it applies to | Relationship to ISO 27001 | Official source |
|---|---|---|---|
| HIPAA Security Rule | Covered entities and business associates handling electronic protected health information | ISO 27001 is not HIPAA certification and does not by itself show HIPAA compliance. | HHS (opens in a new tab) |
| GLBA Safeguards Rule | Financial institutions under FTC jurisdiction | An ISMS can support an information security program, but does not establish compliance by itself. | FTC (opens in a new tab) |
| State privacy, security and breach-notification laws | Organizations handling residents’ personal information; rules differ by state | Requirements and notification duties vary by state and situation. | Federal, state and contract sources vary |
| CMMC | Defense contractors and subcontractors handling federal contract or controlled unclassified information, where the contract requires it | ISO 27001 certification is not a substitute for a required CMMC assessment. | DoD CIO (opens in a new tab) |
| PCI DSS | Entities that store, process or transmit payment card data | ISO 27001 certification does not provide PCI DSS validation. | PCI SSC (opens in a new tab) |
| Contractual and sector requirements | Customer contracts, financial, healthcare and federal supplier requirements | Contracts may name specific frameworks, reports or controls. | Federal, state and contract sources vary |
| Cybersecurity incident reporting | Depends on sector, regulator, contract and whether the company is public | Reporting duties and deadlines vary; ISO 27001 does not set them. | Federal, state and contract sources vary |
Readiness check
Is your organization ready for ISO 27001 certification?
Eighteen questions, no email needed. Answers stay in your browser unless you choose to include them in a quote request. Educational only: not an audit result or certification decision.
Certification process
How to get ISO 27001 certified in the USA
Steps 1 to 6 are your preparation; steps 7 to 14 are independent certification. IAS does not implement your ISMS, write your risk register or author your SoA, and certification is not guaranteed.
What happens during an ISO 27001 certification audit?
| Stage | Purpose | Main activities | Typical evidence | Findings | Next step |
|---|---|---|---|---|---|
| Stage 1 | Confirm readiness and plan Stage 2 | Review of scope, policy, risk assessment and treatment, SoA, documented information, internal audit and management review status | Scope, policy, risk results, SoA, audit and review records | Areas of concern | Address concerns; Stage 2 |
| Stage 2 | Assess implementation and effectiveness | Sampling of operating controls: access management, supplier security, incidents, change, logging and monitoring, risk treatment, awareness, internal audit results | Records from the operating period, interviews, system observation | Major and minor nonconformities | Close nonconformities; certification decision |
Stage 2 uses sampling. It does not test or certify that systems cannot be breached.
Audit evidence
What documents and records are needed for ISO 27001 certification?
The standard requires certain documented information. Other evidence depends on the controls you select. Formats are your choice, and not every control needs its own policy or procedure.
| Document or record | Type | Related clause or control |
|---|---|---|
| ISMS scope | Documented information required | 4.3 |
| Information security policy | Documented information required | 5.2 |
| Risk assessment process | Documented information required | 6.1.2 |
| Risk treatment process | Documented information required | 6.1.3 |
| Statement of Applicability | Documented information required | 6.1.3 d |
| Information security objectives | Documented information required | 6.2 |
| Evidence of competence | Documented information required | 7.2 |
| Documented information determined as necessary by the organization | Documented information required | 7.5.1 b |
| Operational planning information, to the extent necessary | Documented information required | 8.1 |
| Risk assessment results | Documented information required | 8.2 |
| Risk treatment results | Documented information required | 8.3 |
| Monitoring and measurement results | Documented information required | 9.1 |
| Internal audit program and results | Documented information required | 9.2.2 |
| Management review results | Documented information required | 9.3.3 |
| Nonconformities and corrective actions | Documented information required | 10.2 |
| Asset inventory | Illustrative; depends on controls selected | Annex A 5.9, where selected |
| Topic-specific security policies | Illustrative; depends on controls selected | Annex A 5.1, where selected |
| Access control and access review records | Illustrative; depends on controls selected | Annex A 5.15–5.18 |
| Training and awareness records | Illustrative; depends on controls selected | Annex A 6.3 |
| Supplier security evaluations | Illustrative; depends on controls selected | Annex A 5.19–5.22 |
| Incident records | Illustrative; depends on controls selected | Annex A 5.24–5.28 |
| Vulnerability management evidence | Illustrative; depends on controls selected | Annex A 8.8 |
| Backup and restore test evidence | Illustrative; depends on controls selected | Annex A 8.13 |
| Change management records | Illustrative; depends on controls selected | Annex A 8.32 |
Clause references follow ISO/IEC 27001:2022.
Common issues
Common challenges during ISMS certification
General educational examples, not findings from IAS clients, and not issues that always occur.
| Potential issue | Why it matters | Example evidence | Audit consideration |
|---|---|---|---|
| Scope drift | Certificate scope no longer matches what customers buy | New product line launched outside the scope | Scope compared with services and contracts |
| Incomplete risk assessment | Risks missed, controls misaligned | Risk register covers IT only, not suppliers or people | Coverage of the whole scope |
| Weak SoA justifications | Exclusions or inclusions cannot be explained | “Not applicable” with no reason | Justification traced to risks or requirements |
| Policies without implementation evidence | Policy is not practice | Approved policy, no records of it operating | Records from the operating period |
| Inactive access reviews | Leavers or excess rights remain | Last review over a year ago | Review records and resulting changes |
| Inadequate supplier evaluation | Supplier risks unknown | Critical cloud supplier never assessed | Supplier assessment and monitoring |
| Missing incident records | Learning and response cannot be shown | Events handled informally in chat | Event and incident records |
| Incomplete internal audits | ISMS not fully evaluated | Audit skipped Annex A controls in operation | Audit program covering scope |
| Management review without decisions | Leadership not directing the ISMS | Minutes list inputs but no actions | Review outputs and follow-up |
| Weak employee awareness | Controls bypassed | Staff unsure how to report an event | Interviews and training records |
| Poor change management evidence | Unauthorized or risky changes | Production changes without approval | Change records sampled |
| Objectives not monitored | Performance unknown | Objectives set, never measured | Measurement and analysis results |
Industries
Industry-specific ISO 27001 applications
Examples only. Each organization selects controls through its own risk treatment.
Startups
ISO 27001 certification for startups and growing US businesses
There is no minimum number of employees. Small companies still need every ISMS process the standard requires, and fees and timelines are set only after review.
- SaaS startups Scope usually covers the product, development and operations.
- Remote-first teams Endpoint, identity and remote working controls matter more.
- Outsourced IT Managed through supplier controls.
- Cloud-native Cloud configuration and provider oversight.
- Scope selection Cover what customers rely on.
- Risk-based controls Proportionate to your risks, justified in the SoA.
- Evidence Records from a real operating period.
Distributed organizations
ISO 27001 certification for distributed organizations
Multi-site sampling is not guaranteed, and cloud-only organizations do not automatically qualify for fully remote audits. Arrangements depend on scope and accreditation rules.
Request a multi-site proposal- Multiple offices and international teams Each in-scope location is considered in audit planning.
- Remote employees Controls for home working and devices.
- Shared IT and central security Central functions audited once.
- Different legal entities Named on the certificate if in scope.
- Outsourced operations Covered through supplier controls.
- Scope changes Notify your certification body.
Business assurance
How ISO 27001 certification can support business assurance
What a well-run ISMS can help with. Certification does not guarantee zero breaches, prevention of attacks or ransomware, lower insurance premiums, contract awards, customer acceptance or regulatory compliance.
- Governance Structured security decisions and responsibilities.
- Consistent risk assessment Repeatable, comparable results.
- Control monitoring Evidence that controls operate.
- Supplier oversight Known supplier risks.
- Customer assurance An independent audit to point to.
- Procurement readiness Faster answers to questionnaires.
- Incident management A structured approach.
- Continual improvement A cycle of review and correction.
Cost
How much does ISO 27001 certification cost?
Fees depend on audit time and travel. Audit time depends on people in scope, sites, legal entities, technology, outsourced services, risk profile and complexity. No prices, audit days or discounts are published; a quotation follows technical and pricing review.
Timeline
How long does ISO 27001 certification take?
Preparing your ISMS and the certification audits are separate periods. We do not promise certification within a set number of days, weeks or months. Tick what is in place.
Certification cycle
The three-year certification cycle
Certification is maintained through surveillance, not issued once for good.
- 1
Initial certification
Stage 1, Stage 2 and an independent decision.
- 2
Surveillance
At least once a calendar year; the first within 12 months of the decision.
- 3
Surveillance
Checks ISMS performance and changes.
- 4
Recertification
Audit and decision before expiry.
Report significant changes: scope, controls, new services, suppliers and significant security incidents. Certificates can be suspended or withdrawn if requirements are not met.
Accreditation
Understanding IAS ISO 27001 accreditation
ISO publishes standards; it does not issue certificates. Accreditation is an assessment of a certification body’s competence, and certification is an assessment of your ISMS. One body’s accreditation does not transfer to another.
- Who issues the certificate
- For US clients, either Empowering Assurance Systems (EAS) under its JAS-ANZ accreditation, or Integrated Assessment Services LLC under its UQAS accreditation. Your proposal names the issuer.
- Recognition
- Recognition arrangements apply to accreditation bodies, not to certification bodies directly. IAS’s UQAS accreditation does not by itself mean recognition under the IAF MLA. Ask us which arrangement applies to your issuer.
- Reading a certificate
- Check the certificate number, company name, certified scope, standard edition (ISO/IEC 27001:2022), issuer, accreditation body, validity dates and current status with the issuer.
- Verification
- IAS certificates: IAS certificate search. EAS certificates are verified through EAS.
Certification vs testing
ISO 27001 certification vs technical security testing
An ISO 27001 audit evaluates the management system through evidence and sampling. It does not replace technical testing where testing is required, and it does not make systems invulnerable.
| Activity | What it looks at | Method | Output |
|---|---|---|---|
| ISO 27001 certification | Whether the ISMS meets ISO/IEC 27001 for a defined scope | Audit of evidence, interviews and sampling | Certificate |
| Vulnerability assessment | Known weaknesses in systems | Automated and manual scanning | Findings list |
| Penetration testing | Whether weaknesses can be exploited | Simulated attacks by testers | Test report |
| Security configuration assessment | Settings against a baseline | Configuration review | Gap report |
| Cloud security assessment | Cloud account and service configuration | Review of cloud settings | Findings and recommendations |
| SOC 2 examination | Controls against Trust Services Criteria | CPA attestation | SOC 2 report |
| Regulatory compliance assessment | Compliance with a specific law or rule | Legal or regulatory review | Opinion or report |
Impartiality
Independent information security management system certification
A certification body must stay independent of what it certifies.
- No consultancy IAS does not implement your ISMS, prepare your risk register or write your SoA.
- Competence Auditors are assigned for information security technical areas.
- Evidence-based Conclusions rest on audit evidence.
- Confidentiality Client information is protected.
- Conflicts of interest Identified and managed.
- Independent decisions Made by people not involved in the audit.
- Complaints and appeals A documented process.
- Training is separate Training through EAS does not make certification more likely.
IAS USA
Why businesses consider IAS USA
A certification coordination team serving organizations across the US.
- Certification coordination One contact from application to certificate.
- Scope review Technical review of the scope you propose.
- Structured audits Stage 1, Stage 2 and surveillance planned in advance.
- Transparent quotation Factors explained before you agree.
- Client communication Clear reports and timelines for findings.
- Ongoing support Surveillance and recertification planning.
Quotation
Request your ISO 27001 certification proposal
Seven short steps. Your scope builder answers are carried in.
- A certification coordinator and an ISMS technical reviewer review your scope.
- Audit time and price are set after technical and pricing review.
- Nothing is agreed until you accept the proposal.
- Phone
- +1 (888) 493-0916
FAQ
ISO 27001 certification questions
40 answers for US organizations.
What is ISO 27001 certification?
Independent confirmation by a certification body that an organization’s information security management system meets ISO/IEC 27001 for a defined scope.
What is an ISMS?
An information security management system: the policies, risk processes, controls, roles and reviews an organization uses to manage information security risks.
What is the latest ISO 27001 edition?
ISO/IEC 27001:2022, including Amendment 1:2024. Certificates must reference the 2022 edition.
Is ISO 27001:2026 published?
No. As of October 2026 no new edition of ISO/IEC 27001 has been published. Be careful with offers referring to “ISO 27001:2026”.
What is ISO 27001 Amendment 1:2024?
A 2024 amendment adding climate action text. Organizations decide whether climate change is a relevant issue and note that interested parties can have climate-related requirements. It does not require a climate control program.
Is ISO 27001 mandatory in the USA?
No. It is voluntary, although customers or contracts may require it.
Why do enterprise customers request ISO 27001?
To gain independent assurance about a supplier’s information security management, often as part of procurement and security questionnaires. Acceptance and scope requirements vary by buyer.
What businesses can obtain certification?
Any organization, in any sector, that operates an ISMS meeting the standard.
Can small businesses obtain certification?
Yes. There is no minimum number of employees, but all ISMS requirements still apply.
Can SaaS companies obtain certification?
Yes. The scope usually covers the platform, development, operations and support. The cloud provider’s own certification does not cover your ISMS.
Can remote-first companies obtain certification?
Yes. Audit arrangements, including any remote auditing, depend on accreditation rules and the scope; remote-first does not mean the whole audit is remote.
What is an ISMS scope?
The boundaries of the ISMS: services, locations, people, processes and systems covered. It appears on the certificate, so customers read it.
Can some company activities be excluded from the scope?
Yes, if the boundary is clear and justified. A scope that leaves out what customers rely on may not give them the assurance they need.
What are the ISO 27001 requirements?
Clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement, applied to information security risks.
What are Annex A controls?
A reference list of 93 information security controls in four themes: organizational (37), people (8), physical (14) and technological (34).
Are all 93 security controls mandatory?
No. You compare your risk treatment with Annex A, select the controls you need and justify inclusions and exclusions in the Statement of Applicability.
What is the Statement of Applicability?
A document listing the necessary controls, why they are included, whether they are implemented, and why any Annex A controls are excluded.
What is an information security risk assessment?
A repeatable process to identify, analyze and evaluate risks to confidentiality, integrity and availability, using criteria the organization sets.
What documents are required?
The standard specifies certain documented information, such as the scope, policy, risk processes and results, SoA, objectives, audit and review results. Other records depend on your controls.
What is Stage 1?
A readiness review of the scope, policy, risk assessment and treatment, SoA, internal audit and management review, used to plan Stage 2.
What is Stage 2?
An audit of ISMS implementation and effectiveness through sampling of records, interviews and controls in operation.
What happens when nonconformities are identified?
You correct them and take corrective action. Major nonconformities must be resolved and verified before certification can be granted.
How much does ISO 27001 certification cost?
It depends on audit time and travel, which depend on scope, people, sites and complexity. We quote after reviewing your application.
How long does certification take?
It depends on your ISMS maturity, evidence and how quickly findings are closed. We do not promise a fixed timeline.
How long is the certificate valid?
Usually three years, subject to successful surveillance audits.
What is a surveillance audit?
An audit at least once a calendar year between certification and recertification, checking that the ISMS remains effective.
Can certification audits be conducted remotely?
Some activities may use remote techniques where accreditation rules and the scope allow. The audit plan confirms the arrangement.
What is the difference between ISO 27001 and SOC 2?
ISO 27001 is a management system certification. SOC 2 is a CPA attestation report on controls against the AICPA Trust Services Criteria. One does not replace the other.
What is the difference between ISO 27001 and NIST CSF?
NIST CSF 2.0 is a voluntary framework of cybersecurity outcomes with no NIST certification. ISO 27001 is a certifiable requirements standard.
Does ISO 27001 automatically establish HIPAA compliance?
No. HIPAA applies separately to covered entities and business associates.
Does certification guarantee cybersecurity?
No. It shows the ISMS met the standard at audit; it does not prevent attacks or breaches.
Does ISO 27001 certification cover cloud providers?
No. Your certificate covers your scope. Cloud providers and other suppliers are managed through your supplier controls.
Can multiple legal entities or sites be certified?
Yes, if they are within one ISMS. Sampling of sites depends on accreditation rules and is not guaranteed.
What happens if our scope changes?
Tell your certification body. Changes may need a special audit or review at surveillance before the certificate is updated.
Can ISO 27001 be integrated with ISO 9001?
Yes. Shared clause structure makes integrated audits practical.
Can ISO 27001 be integrated with ISO 22301?
Yes. ISO 22301 covers business continuity management more fully; ISO 27001 certification does not include it.
Who issues the certificate?
For US clients, either Empowering Assurance Systems (EAS) under its JAS-ANZ accreditation or Integrated Assessment Services under its UQAS accreditation. Your proposal names the issuer.
How can IAS accreditation be verified?
Check the IAS certificate search for IAS certificates, and ask us for the accreditation certificate and scope. EAS certificates are verified through EAS.
Is ISO 27001 certification the same as a penetration test?
No. Certification audits the management system. Penetration testing technically tests systems.
How do we request a quotation?
Use the quotation form on this page. A certification coordinator and an ISMS technical reviewer review your scope before a proposal is issued.
Related certification and training
Training is delivered by EAS and is separate from certification.
- ISO 27001 Lead Auditor training
- ISO 27001 Internal Auditor training
- ISO 22301 certification
- ISO/IEC 20000-1 certification
- ISO 9001 certification
- System certification
- ISO 27001 requirements (blog)
- ISO 27001 certification cost (blog)
- ISO 27001 audit (blog)
- Training schedule
- Contact us
- About us
- Associate partners
- Guideline for usage of logos
- ISO 27001 certification process (blog)
- Certification process
- Foundation training
- VAPT certification
- ISO lead auditor training
- ISO training
- ISO 9001 lead auditor training
- ISO 22301 lead auditor training
- ISO 14001 certification
- ISO 45001 certification
- ISO audit procedure
- Frequently asked questions
- IAS blog
- Application form (DOC)
- Course or service brochure (PDF)