ISO 27001 certification bodies: how to choose one

The short answer: when you compare ISO 27001 certification companies, start with accreditation. The body has to be accredited for ISO/IEC 27001 by a national accreditation body that signs the European (EA) or international (Global ACI) mutual recognition arrangements. Only among bodies that pass this filter do you compare auditors, audit days and calendar.

This guide is for whoever signs the contract with a certification body: who does what, how to check accreditation, how to compare offers, which signs should stop the conversation and how to change body later. We name no certification bodies and give no rankings: the right one depends on your scope and on where your customers are.

Certification body, accreditation body, consultant: who does what

Three roles are often blurred, and keeping them apart is the first step.

• The certification body audits your information security management system (ISMS) and issues the certificate. This is what most people mean by an ISO 27001 certification company.
• The accreditation body assesses certification bodies and attests that they are competent and impartial. It does not certify companies.
• The consultant helps you build the ISMS and prepare for the audit. It does not certify, and it should have no commercial tie to the body that will audit you (more on this below).

In the EU the framework is set by Regulation (EC) No 765/2008. Article 4(1) reads: Each Member State shall appoint a single national accreditation body. The same article requires that body to operate on a not-for-profit basis and bars it from offering consultancy or the services of the bodies it accredits (Article 4(7) and 4(8)). Each national body is also a member of the European co-operation for Accreditation (EA), the network formally recognised by the European Commission under the Regulation (Article 4(10); EA, Who we are).

Bodies that certify management systems are accredited against ISO/IEC 17021-1. For information security there is an additional standard, ISO/IEC 27006-1:2024, which sets requirements and guidance for bodies providing audit and certification of an ISMS on top of ISO/IEC 17021-1 (IEC Webstore abstract). In practice: an accreditation for ISO 9001 does not automatically cover ISO/IEC 27001. Ask for the ISMS scope specifically.

Why accreditation comes before everything else

Not every ISO 27001 certificate in circulation is accredited. An unaccredited certificate may describe a well-built system, but nobody independent has checked the body that issued it. Three practical consequences follow.

• Recognition. Under Article 11(2) of Regulation 765/2008, national authorities accept the attestations issued by bodies accredited by national accreditation bodies that have passed peer evaluation. An unaccredited certificate sits outside that mechanism.
• Customer and tender requirements. Global ACI notes in its Q&As that the use of accredited conformity assessment services is increasingly a requirement set by specifiers in both the public and private sector. If you need the certificate for a tender or a specific customer, ask them which accreditation they accept before choosing the body.
• Portability. Only accredited certification can be transferred to another certification body. A company holding an unaccredited certificate that moves to an accredited body is treated as a new client (Global ACI-TECH-3-002, clause 2.1.1).

A note on names you will meet in older material. The International Accreditation Forum (IAF) ceased operations on 1 January 2026, and Global Accreditation Cooperation Incorporated (Global ACI) took over the former roles of IAF and ILAC from that date (Global ACI, Q&As; iaf.nu). Former IAF mandatory documents are now published by Global ACI under new codes: the transfer document cited below, for example, states that it was reformatted from IAF MD 2:2023 without any substantive change.

Which accreditation body is behind the certificate

The accreditation body depends on where the certification body is established, not on where you are. A few examples, as listed on the EA directory of members and MLA signatories (consulted October 2026), all with management system certification in their MLA scope: UKAS for the United Kingdom, INAB for Ireland, DAkkS for Germany, COFRAC for France, RvA for the Netherlands, ESYD for Greece, BELAC for Belgium. UKAS describes itself as the national accreditation body for the United Kingdom, appointed by government.

Malta and Cyprus are a useful case for readers based there. On the same EA directory, the MLA scopes of NAB-Malta and CYS-CYSAB do not include management system certification. Article 7(1) of Regulation 765/2008 lets a certification body seek accreditation from another Member State's body where its national body does not accredit that activity or has not passed peer evaluation for it. So for a company in Malta or Cyprus, a certificate accredited by another EA member is not in itself a warning sign. What matters is that the accreditation body is an MLA signatory for management system certification.

How to check accreditation in ten minutes

1. Ask for the accreditation certificate and its scope. It names the accreditation body and the schemes covered. Look for ISO/IEC 27001, not just management systems in general.
2. Check the accreditation body's public register. National bodies keep directories of the organisations they accredit: UKAS, for example, publishes a searchable directory of accredited organisations. Confirm that the certification body is listed and that the ISMS scope is active.
3. Check the accreditation body itself. On the EA directory, confirm that it is an MLA signatory and that management system certification is in its scope.
4. Look at a sample certificate. Under ISO/IEC 17021-1 (clause 8.2.2) a certificate identifies, among other things, the standard and its edition, the scope of certification by activity and site, the expiry or recertification date and a unique identification code. The current edition is ISO/IEC 27001:2022, with its 2024 amendment. A vague scope or a missing edition is a question to ask.
5. Verify an existing certificate if you need to. A certification body has to provide, on request, the status of a given certification (ISO/IEC 17021-1, clause 8.1.2). IAF CertSearch, a global database of accredited management system certifications, lets you check whether a certification is valid.

Certification body and consultant: keep them apart

This is the point where offers most often blur. ISO/IEC 17021-1 states that the certification body, any part of the same legal entity and any entity under its organisational control cannot offer or provide management system consultancy (clause 5.2.5). Explaining findings or clarifying requirements is allowed; designing your system is not.

The standard goes further. It treats consultancy received from a body that has a relationship with the certification body as a significant threat to impartiality (clause 5.2.7), and it bars a certification body from suggesting that certification would be simpler, easier, faster or cheaper if a specified consultancy were used (clause 5.2.9).

In practice: whoever prepares you does not certify you. If the same group offers you both the preparation and the certificate, ask how the two are separated, and check whether your customers would accept the result. How we approach the preparation side, from gap analysis to audit readiness, is described on our ISO 27001 page.

How to compare two accredited bodies

Once the filter is passed, real differences remain. These are the ones that weigh most over the life of the certificate.

1. Audit days with a written justification

Audit time is not a free choice. ISO/IEC 17021-1 (clause 9.1.4) requires documented procedures for determining it, lists factors such as the complexity of the organisation, its technological and regulatory context, outsourcing, the number of sites and the risks of its activities, and requires the duration and its justification to be recorded. Where a scheme has its own criteria, such as ISO/IEC 27006 for information security, those apply. A serious offer shows you the calculation: that is what makes two quotes comparable.

2. Auditors who know your technology

Ask who the auditors will be, what experience they have with environments like yours (cloud-native, hybrid, regulated sectors) and whether the team will stay stable across the certification cycle. An auditor who understands your stack asks relevant questions; one who does not stops at the paperwork.

3. Calendar for Stage 1 and Stage 2

If a customer contract or a tender depends on the certificate, the body's available dates can decide the plan. Ask for them before you fix the rest of the project.

4. Other standards you will need

If you already hold ISO 9001, or expect to add ISO 22301 or ISO/IEC 42001, a body accredited for all of them can plan combined or integrated audits, which ISO/IEC 17021-1 lists among the factors for audit time. Check each accreditation separately.

5. Where your customers are

If part of your customer base is in the US, check whether they expect SOC 2 instead of, or as well as, ISO 27001. The difference is explained in our article on what SOC 2 is and how to get it.

6. How findings are handled

Ask how soon the report arrives, how nonconformities are managed and who takes the certification decision. The answers say more than any brochure.

Warning signs

• No accreditation for ISO/IEC 27001, or an accreditation body that is not an MLA signatory for management system certification.
• A certificate promised on a fixed date before anyone has seen your system. The outcome depends on the audit.
• Consultancy and certification in one package, from the same entity or from related companies.
• Audit days stated without a calculation, or far below the other offers with no written reason.
• No mention of accreditation in the contract or on the sample certificate.
• Pressure to sign quickly that leaves no time for the checks above.

Changing certification body: the transfer

An accredited certificate does not tie you to the body that issued it. Global ACI-TECH-3-002 (formerly IAF MD 2:2023), issued on 10 July 2026 and applicable from 28 August 2026, governs transfers between accredited bodies. It allows stricter procedures only as long as the client's freedom to choose a certification body is not unduly or unfairly constrained.

How it works, in summary:

• only valid accredited certification can be transferred; a certificate known to be suspended is not accepted;
• the new body carries out a documentation review (audit reports, open nonconformities, complaints, reasons for the transfer) and, where needed, a pre-transfer visit, which is not an audit;
• the new certificate is not issued until corrections for all open major nonconformities have been verified and the plans for minor ones accepted;
• if the review finds no problems, the certification cycle continues from the previous one; otherwise the company is treated as a new client;
• the new body takes its decision before any surveillance or recertification audit begins.

The practical consequence: plan a change of body away from the window of a surveillance or recertification audit, with your previous reports to hand.

In summary

Accreditation first, everything else after. Check that the body is accredited for ISO/IEC 27001 by an accreditation body that signs the EA or Global ACI arrangements for management system certification, ask your customers which accreditation they accept, compare offers on the audit-day calculation and the quality of the auditors, and keep the consultant and the certification body separate. If the body stops working for you, an accredited certificate can be transferred.

If you are preparing for certification and want to reach the audit with an ISMS that holds up, with an accredited body of your choice, talk to us.