ISO 27001 certification guide
The certification body's side of ISO 27001, step by step.
Building the information security management system (ISMS) is your project. Certifying it belongs to someone else: an accredited certification body that plans the audit, tests what you built and then decides, through people who did not audit you, whether a certificate is issued. This page follows that body's process from the first enquiry to the certificate, and says what to have ready at each step.
Back to ISO 27001 services01 · Two separate jobs
Your build project and the certifier's audit are separate jobs
An auditor can only test a system that already runs. How to build one is the subject of our implementation roadmap page; this page picks up where that one stops.
ISO/IEC 27001:2022 tells you what your ISMS must achieve. A different standard, ISO/IEC 17021-1, governs the certification bodies themselves, and ISO/IEC 27006 adds rules specific to information security, including how many audit days a scope of a given size calls for. Because every accredited body works under those rules, the sequence below looks much the same whichever body you pick.
What you own
- The scope, the risk method and the Statement of Applicability (SoA)
- Running the controls and keeping their records
- A finished internal audit and management review before Stage 2
- Fixing whatever the auditor raises
What the certification body owns
- Working out audit days and choosing the audit team
- Running Stage 1 and Stage 2
- Grading each finding
- The certification decision, taken by people outside the audit team
The roles cannot be merged. Impartiality rules stop a certification body from also advising you, so whoever helps you build the ISMS, Auditify included, is never the party that certifies it.
02 · The sequence
From first enquiry to certificate in seven steps
Each step needs something from you and returns something from the certification body. Knowing both sides in advance removes most surprises.
| Step | You hand over | The certification body returns |
|---|---|---|
| 1. Application | Headcount in scope, sites, draft scope wording and any outsourced processes | An audit-time calculation and a proposal |
| 2. Planning | Dates, a main contact and access arrangements | An audit plan naming the team and the areas to cover |
| 3. Stage 1 | Scope, policy, risk method and results, SoA, internal audit and management review records | A report saying whether you are ready for Stage 2 |
| 4. The interval | Fixes for anything Stage 1 raised | Confirmed Stage 2 dates |
| 5. Stage 2 | People for interviews, live systems and the records the auditor picks | Findings graded major or minor, plus observations |
| 6. Responses | Root cause, correction and corrective action for each finding | Acceptance of your plans, or verification of fixes for majors |
| 7. Decision | Nothing new: the audit file speaks for you | A certificate, or a decision to withhold one |
03 · Stage 1
Stage 1 asks whether the system is real enough to test
Treat Stage 1 as a readiness check. The auditor reads your design and judges whether a full test would be worth everyone's time.
Much of Stage 1 is reading, and some bodies do it remotely. The auditor confirms that the scope makes sense, that the risk method can give consistent answers, that the SoA follows from the risk work, and that the ISMS has already been through an internal audit and a management review. They also collect what they need to plan Stage 2: locations, key systems and which processes run outside your walls.
What tends to stall a Stage 1 report
- A scope with a hole in it. Something the business plainly depends on sits outside the boundary with no explanation.
- Risk scores nobody can explain. The owner of a high risk cannot say why it scored that way or what treats it.
- Silent exclusions. Controls marked not applicable in the SoA with no reason, or a reason the scope contradicts.
- No completed loop. The internal audit is still planned, or the management review minutes record no decisions.
04 · Stage 2
Stage 2 tests whether people do what the documents say
Stage 2 runs on sampling. The auditor cannot check everything, so they pick items and follow each one to its proof.
Expect requests such as: a joiner from last quarter and the approval behind their access; a production change and its ticket and test; a supplier and the security clause in its contract. Interviews count as much as records. A control owner who cannot describe their own control gives the auditor a finding to write.
Illustrative: one sample, followed end to end
- A software company of about sixty people (illustrative) is asked about one risk from its register: loss of the customer database.
- The auditor checks which controls the SoA links to it, here backups, access restriction and logging.
- They ask for the latest restore test and read its date and outcome.
- They ask the database owner to show who holds admin rights today, and compare that with the last access review.
- Any mismatch between register, SoA and live system becomes a finding.
05 · Findings
How findings are graded, and what each grade costs you
The grade decides whether the certificate waits. It turns on one question: can the system as a whole still be trusted?
| Grade | Typical trigger | Effect on the certificate | What you send back |
|---|---|---|---|
| Major nonconformity | A clause requirement missing, or a breakdown that undermines the ISMS, such as no internal audit at all | No certificate until the fix is in place and the certification body has verified it | Correction, root cause, corrective action and evidence, sometimes checked on a follow-up visit |
| Minor nonconformity | An isolated lapse, such as one quarterly access review skipped | Does not hold up the decision on its own once your plan is accepted | A corrective action plan, checked at the next audit |
| Observation | A weakness that could turn into a lapse | None | Nothing formal, though an ignored observation often returns as a minor finding |
If a major finding cannot be verified as closed within the period the certification body allows, the body may need to repeat some or all of Stage 2 before it decides. How to write a root cause that survives review is covered on our nonconformity and corrective action page.
06 · The decision
Who says yes, and what the certificate shows
The audit team recommends. A separate reviewer or committee at the certification body reads the file and decides.
What to read on a certificate
- Scope statement
- Names the activities, sites and services covered. It should match what your customers buy from you.
- Standard and edition
- Should read ISO/IEC 27001:2022. Certificates to the 2013 edition lapsed when the transition period ended on 31 October 2025.
- Issuing body and accreditation mark
- Tells a reader which body issued it and which accreditation body oversees that body.
- Dates
- Issue and expiry. The validity period and the yearly audits that keep it alive are explained on our certificate validity page.
- SoA reference
- Certificates commonly cite the version of the SoA that was audited, which ties the certificate to your control choices.
07 · Choosing a certifier
Questions to put to a certification body before you sign
Accreditation is what makes a certificate carry weight with a buyer. Check it before you compare dates or fees.
- Accredited for this standard. Ask which accreditation body accredits them, and confirm ISO/IEC 27001 is inside that accreditation scope.
- A recognised accreditation body. The accreditation body should be a signatory to the IAF multilateral recognition arrangement. In India, the national body that accredits certification bodies is NABCB.
- A visible audit-day calculation. Ask how ISO/IEC 27006 produced the number of days, so quotes can be compared like for like.
- No advisory ties. Confirm that no related company is advising you on the ISMS.
Sources: ISO/IEC 27001:2022 (clause titles only); ISO/IEC 17021-1:2015, requirements for bodies providing audit and certification of management systems; ISO/IEC 27006-1:2024, requirements for bodies certifying information security management systems; IAF MD 26 on the transition to ISO/IEC 27001:2022; IAF public material on the multilateral recognition arrangement.
Questions people ask before audit day
Will the certification body tell us how to fix a finding?
It can explain the gap, not design your fix.
An auditor will say which requirement is not met and what evidence was missing. Designing the remedy would be consultancy, which impartiality rules forbid for the body that certifies you. The fix, and the root cause behind it, are yours to work out.
What if we disagree with a finding?
Say so before the closing meeting, then use the appeals route.
Raise the disagreement with evidence while the auditor is still with you, since many disputes end there. If it stands, accredited bodies must run an appeals and complaints process, separate from the audit team, and must tell you how to use it.
Does our certificate cover our cloud provider?
No. It covers your ISMS and how you use the provider.
The auditor looks at how you choose, configure and oversee the provider, not inside the provider's own operations. For those, you rely on the provider's own assurance, such as its certificate or audit report, and the auditor checks that you actually read it.
Who keeps the certificate valid once it is issued?
You do, through audits every year.
The decision starts a cycle of surveillance audits and a later recertification. Our certificate validity page explains that cycle; the short version is that the ISMS has to keep producing records between audits, not only in the weeks before one.
Walk into Stage 1 knowing what the auditor will pull.
An ISO 27001 gap analysis from Auditify reads your ISMS the way a certification body will and lists what to fix before you book the audit. The certificate itself comes from an accredited certification body.