We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Can the firm that prepares you also certify you?

For an accredited ISO certificate, preparing you and certifying you are two separate jobs, and the rules keep them apart.

No, not for an accredited ISO certificate such as ISO 27001 or ISO 42001. The certification body may not also offer consultancy on management systems. Your own team or a different firm does the preparation. For the UK's Cyber Essentials, the certification body may help you understand the questions.

On this page
  1. How to get an accredited ISO 27001 or ISO 42001 certificate
  2. ISO 42001 and Cyber Essentials: common questions
  3. Where next
  4. The 91 providers

Which rules apply depends on the certificate. In the UK, UKAS is the one national body that accredits certification bodies. It announced its first ISO 42001 accreditation, to BSI, on 15 January 2026. For Cyber Essentials, a certification body licensed by IASME checks whether you meet the requirements.

For an accredited ISO certificate, the two jobs sit with different organisations. If one group offers both, you can ask which company issues the certificate and under which accreditation. The guide to choosing an adviser covers the wider questions.

Who checks whom in accredited ISO certification

  1. UKAS the UK's national accreditation body
    accredits
  2. A certification body audits you and issues the certificate
    certifies
  3. Your organisation prepared by your own team or a consultant, never by the certification body itself
UKAS checks the certification body, the certification body checks you, and a consultant who helps you prepare stays outside the chain.

In short, UKAS ‘checks the checkers’.

United Kingdom Accreditation Service (UKAS)
Read original

How to get an accredited ISO 27001 or ISO 42001 certificate

  1. Ask your customer which certificate it wants, and whether it must come from an accredited body.
  2. Search the UKAS directory for the certification body, and check it is accredited for your exact standard.
  3. Keep the firm that prepares you separate from the body that audits you.
  4. If you use a consultant, ask who will do the work and which certificates past clients now hold.
  5. Plan for the full cost over time: the gap analysis, help to build the system, the audit, and later audits or renewals.

ISO 42001 and Cyber Essentials: common questions

How do we check a body is accredited for ISO 42001?

Search for the certification body by name on the UKAS directory. UKAS also shows the bodies accredited for ISO 42001 on its browse-by-category page.

Our certification body suggested a consultant. Is that allowed?

Yes. A certification body may give you a list of consultants. It must also tell you that using one will not make certification simpler, easier, faster or cheaper. The choice of consultant stays with you.

Does a UK government contract need Cyber Essentials?

A UK government contract often asks for Cyber Essentials. UK government policy applies to central government departments, their agencies and the public bodies they sponsor, and to NHS bodies. On contracts that handle personal data about citizens or government staff, they must check supplier security. Cyber Essentials or Cyber Essentials Plus is the quickest way to pass, and equal controls shown another way also count.

What does Cyber Essentials Plus add?

Cyber Essentials Plus adds testing by an outside assessor. It covers the same protections as Cyber Essentials, with more rigorous technical testing. Ask your customer which of the two the contract names.

Sources

  1. UKAS, checked 29 September 2026
  2. European Accreditation, checked 29 September 2026
  3. the NCSC, checked 29 September 2026
  4. UKAS news, checked 29 September 2026
  5. UKAS, checked 29 September 2026
  6. UKAS bulletin, checked 29 September 2026
  7. GOV.UK, checked 29 September 2026

The 91 providers for this situation

Grouped by type, alphabetical inside each type. Three of the six scores are shown here. Each profile has all six, with the evidence for each.

Advisory firms (37)

Provider Qualifications Fee information Help when things go wrong
AARC-360 Advisory firm Relevant if you are a US group that wants one adviser across the EU GDPR, HIPAA and CCPA
2/5 1/5 2/5
Accorian (Esha Corporation dba Accorian; Accorian Assurance) Advisory firm Relevant if you need SOC 2 or ISO 27001 work and ISO 42001 help from the same firm
4/5 2/5 2/5
Actica Consulting Limited Advisory firm Relevant if you run essential services and need NCSC-assured security architecture, risk or audit work
4/5 3/5 2/5
Amethyst Risk Management Limited Advisory firm Relevant if you need a Cyber Assessment Framework audit from an NCSC-listed firm, or ISO/IEC 27001 help
4/5 2/5 2/5
AMSA InfoSec Ltd Advisory firm Relevant if you buy through G-Cloud and want a published day rate and a named consultant
3/5 3/5 1/5
Anekanta Consulting Advisory firm Relevant if your board uses higher-risk AI, such as biometrics, and needs an EU AI Act risk assessment
4/5 1/5 1/5
AvISO Consultancy Advisory firm Relevant if you are already working towards several ISO certificates and want DPO support alongside
2/5 1/5 2/5
BABL AI Inc. Advisory firm Relevant if you sell hiring software and need a New York City Local Law 144 bias audit
3/5 3/5 3/5
Bridewell Advisory firm Relevant if you run critical infrastructure or a regulated business and want privacy help inside a security firm
3/5 1/5 3/5
Bright Defense, LLC Advisory firm Relevant if you need SOC 2 or ISO 27001 readiness and want a published starting price
4/5 3/5 2/5
CBIZ Pivot Point Security Advisory firm Relevant if you want an outsourced security chief with published monthly prices, or help towards ISO 27001
4/5 4/5 2/5
Compass IT Compliance, LLC Advisory firm Relevant if you want help preparing for SOC 2, PCI DSS or CMMC from named practice leads
4/5 2/5 3/5
Core Business Solutions Advisory firm Relevant if you are preparing for a first SOC 2 or ISO 27001 audit and want named consultants
4/5 2/5 2/5
Cyber Defense Group Advisory firm Relevant if you are a growing company that wants a part-time security leader and help preparing for audits
3/5 4/5 3/5
CyPro Advisory firm Relevant if you want cyber security and GDPR work together from named founders with checkable credentials
5/5 1/5 3/5
Data GRC Ltd Advisory firm Relevant if you want a 30-minute advice call at a fixed price before committing to a retainer
1/5 3/5 2/5
Data Protection People Advisory firm Relevant if you want DPO support and subject access request handling from one firm with named staff
4/5 1/5 3/5
DataGuard Advisory firm Relevant if you want software with consultants attached for ISO 27001 or several frameworks at once
2/5 3/5 2/5
Elevate Consult Advisory firm Relevant if you are preparing for ISO 42001 or a New York City hiring-tool bias audit
3/5 1/5 2/5
Enterprivacy Consulting Group Advisory firm Relevant if you want a privacy-by-design review done personally by a named, qualified privacy specialist
4/5 2/5 1/5
Evalian Advisory firm Relevant if you want data protection, cyber security and ISO support from one firm with named, qualified leaders
5/5 3/5 3/5
Fractional CISO, LLC Advisory firm Relevant if you are preparing for a SOC 2 or ISO 27001 audit and want named, qualified staff
4/5 3/5 2/5
GDPR Advisor (PSA Professional Solutions) Advisory firm Relevant if you want an outsourced DPO and training from one firm, and will check its company number
1/5 1/5 2/5
IT Governance (now GRC Solutions) Advisory firm Relevant if you want advice and ready-made compliance documents from one supplier, with published product prices
2/5 3/5 3/5
JBW Group International, LLC Advisory firm Relevant if you run a regulated US business and want named, qualified people for privacy or ISO work
4/5 2/5 2/5
JVR Consultancy Advisory firm Relevant if you want UK GDPR help alongside rail, construction or utilities accreditation work
1/5 3/5 2/5
Kafico Advisory firm Relevant if you run a GP practice or health business and want a named, qualified DPO
4/5 4/5 3/5
Meditology Services, LLC Advisory firm Relevant if you are a US health organisation needing a HITRUST assessment or HIPAA compliance help
5/5 2/5 4/5
Osborne Clarke LLP Advisory firm Relevant if you need solicitors for an ICO crisis, a subject access dispute or an AI rollout
4/5 2/5 4/5
Rhymetec LLC Advisory firm Relevant if your SaaS company needs SOC 2, ISO 27001 and a virtual CISO from one firm
3/5 2/5 2/5
RightCue Consulting Services Ltd Advisory firm Relevant if you are a small firm seeking Cyber Essentials or appointing a first virtual CISO
4/5 2/5 3/5
Samurai Digital Security Limited Advisory firm Relevant if you are appointing a first virtual CISO or working towards ISO 27001 or Cyber Essentials
4/5 1/5 2/5
SideChannel, Inc. Advisory firm Relevant if you want a virtual CISO or SOC 2 readiness help and a published price range
3/5 4/5 2/5
The DPO Centre Advisory firm Relevant if you are appointing a first DPO and want named, qualified people and sector case studies
5/5 3/5 3/5
URM Consulting Advisory firm Relevant if you want DPO support and ISO 27001 or 22301 certification help from one firm
3/5 1/5 3/5
vCISO Services, LLC Advisory firm Relevant if you are a smaller US business preparing for SOC 2, ISO 27001 or CMMC audits
2/5 2/5 2/5
Zaviant (WJS Cyber Consulting, LLC d/b/a Zaviant) Advisory firm Relevant if you are a US company building a privacy programme on OneTrust or a similar platform
3/5 2/5 3/5

Certification bodies (33)

Provider Qualifications Fee information Help when things go wrong
360 Advanced, Inc. Certification body Relevant if you need a SOC 2 examination and work in US finance, healthcare or government
2/5 1/5 1/5
A-LIGN Compliance and Security, Inc. (dba A-LIGN) Certification body Relevant if you want one accredited body to certify security, privacy, continuity and AI management systems
5/5 1/5 3/5
Amtivo Certification body Relevant if you want UKAS-accredited ISO 9001, ISO 27001 or ISO 45001 certification, not ISO 42001
3/5 2/5 3/5
Approachable Certification Ltd Certification body Relevant if you want ISO/IEC 27001 certification from a body that says it has never offered consultancy
5/5 3/5 4/5
Aprio, LLP Certification body Relevant if you want ISO/IEC 42001 or 27001 certification from a large, ANAB-accredited US firm
4/5 1/5 1/5
BARR Certifications, LLC Certification body Relevant if you run a US organisation and need ANAB-accredited ISO/IEC 27001 or 27701 certification
3/5 1/5 1/5
Boulay Certifications, LLC Certification body Relevant if you need ISO/IEC 27001 certification and want written rules separating audit from consulting
2/5 1/5 2/5
BSI (The British Standards Institution) Certification body Relevant if you want UKAS-accredited ISO/IEC 42001 certification and a certificate anyone can check online
5/5 2/5 5/5
Bureau Veritas Certification body Relevant if you need UKAS-accredited ISO 27001, ISO 9001 or nuclear supply-chain certification, not ISO 42001
3/5 1/5 3/5
Centre for Assessment Certification body Relevant if you want UKAS-accredited ISO 9001 or 27001 certification, or a Lexcel assessment for a law firm
2/5 4/5 3/5
Coalfire Certification, Inc. Certification body Relevant if you want ISO 42001 certification from a body that has already certified named technology firms
5/5 1/5 4/5
ControlCase Assessments LLC Certification body Relevant if you need PCI DSS, FedRAMP, CMMC or HITRUST assessments from one firm
3/5 1/5 2/5
DNV Certification body Relevant if you need UKAS-accredited ISO 9001, ISO 27001 or ISO 45001 certification from a large international group
3/5 1/5 3/5
EAGLE Registrations Inc. Certification body Relevant if you want an ANAB-accredited ISO/IEC 27001 certificate from a body that sells no consulting
4/5 1/5 2/5
Forefront Certification Limited (FFC) Certification body Relevant if you want UKAS-accredited ISO 27001 certification for a UK organisation
4/5 3/5 3/5
Intertek Certification body Relevant if you need a UKAS-accredited ISO 27001, ISO 9001 or ISO 37001 certificate from a large group
3/5 1/5 3/5
IS Partners, LLC Certification body Relevant if you need an ANAB-accredited ISO 27001 certificate or a CMMC assessment in the US
3/5 1/5 2/5
ISOQAR (formerly Alcumus ISOQAR) Certification body Relevant if you want a UKAS-accredited ISO 42001 certificate, audited alongside ISO 9001 or ISO 27001
5/5 3/5 4/5
Kompleye Attestation, LLC Certification body Relevant if you need an accredited ISO 27001 or 27701 certificate and SOC work from one firm
3/5 1/5 1/5
Linford & Company LLP Certification body Relevant if you need SOC 2, US HIPAA or FedRAMP Moderate assessments from one firm
4/5 4/5 2/5
LRQA Certification body Relevant if you want accredited ISO 42001 certification combined with ISO 27001, 9001 or 14001 audits
5/5 2/5 3/5
NQA Certification body Relevant if you want accredited ISO 42001 certification with the contract terms published before you sign
5/5 3/5 4/5
Palindrome Technologies, Inc. Certification body Relevant if you want ISO/IEC 42001 certification from an ANAB-accredited body
3/5 1/5 1/5
Peers Quality Assurance Limited (PQAL) Certification body Relevant if you want UKAS-accredited ISO/IEC 27001 certification and published rules on auditor impartiality
4/5 1/5 3/5
Perry Johnson Registrars, Inc. Certification body Relevant if you need certification to an established standard such as ISO 9001 or ISO 27001
3/5 1/5 1/5
RA Cert Ltd Certification body Relevant if you want UKAS-accredited ISO/IEC 27001 certification or a World Lottery Association security assessment
2/5 1/5 3/5
Responsible AI Institute (Responsible Artificial Intelligence Institute) Certification body Relevant if you work in finance or health and want an AI governance assessment with published prices
4/5 4/5 2/5
Schellman Compliance, LLC Certification body Relevant if you want ISO 42001 or ISO 27001 certification and also face US FedRAMP or CMMC rules
3/5 2/5 4/5
Sensiba LLP Certification body Relevant if you want ISO 27001 or ISO 42001 certification and a SOC 2 report from one firm
4/5 1/5 2/5
SGS North America Inc. Certification body Relevant if you need ISO 27001 or ISO 42001 certification in the US from a large certifier
5/5 1/5 2/5
SGS United Kingdom Limited Certification body Relevant if you want UKAS-accredited ISO 27001 certification, with ISO 27701 privacy certification from the same body
5/5 1/5 3/5
Socotec Certification United Kingdom Limited Certification body Relevant if you want UKAS-accredited ISO 27001 certification and do not need ISO 42001
3/5 1/5 2/5
TÜV UK Limited (TÜV NORD Group) Certification body Relevant if you want an ISO 42001 certificate from a UKAS-accredited body that says it does not consult
5/5 1/5 4/5

Software products (21)

Provider Qualifications Fee information Help when things go wrong
Advai Software product Relevant if you need test and monitoring evidence for a high-risk AI system in a regulated sector
2/5 1/5 4/5
Credo AI Software product Relevant if you need software to track your AI systems against the EU AI Act or ISO 42001
4/5 1/5 4/5
Drata Software product Relevant if you want software that links AI risks to controls, owners and evidence for ISO 42001
4/5 1/5 4/5
Enzai Software product Relevant if you want UK software to register, assess and monitor your AI systems
4/5 1/5 4/5
Hicomply Software product Relevant if you want compliance software with prices on the website before you speak to sales
1/5 5/5 2/5
Holistic AI Software product Relevant if you want one tool to list your AI systems and map them to several frameworks
2/5 1/5 4/5
Hyperproof Software product Relevant if you manage several frameworks and want one place for audit evidence
3/5 1/5 2/5
IBM watsonx.governance Software product Relevant if you use IBM's watsonx and want audit records for AI models, with a published starting price
3/5 4/5 5/5
ISMS.online Software product Relevant if you already run ISO 27001 and want to add ISO 42001 on the same platform
3/5 1/5 3/5
LogicGate Software product Relevant if your team runs its own risk, compliance and AI oversight work and needs software for it
4/5 1/5 1/5
Microsoft Purview Software product Relevant if you already use Microsoft 365 E3 or E5 and want controls on data sent to AI
4/5 5/5 5/5
Monitaur Software product Relevant if you are an insurer or financial firm wanting software to track AI model controls and evidence
3/5 1/5 4/5
OneTrust AI Governance Software product Relevant if you already use OneTrust for privacy and want AI governance in the same platform
5/5 1/5 4/5
Saidot Software product Relevant if you need software to classify AI systems by risk and document EU AI Act conformity
3/5 1/5 5/5
Secureframe Software product Relevant if you want ISO 42001 software on the same platform as SOC 2 and ISO 27001
5/5 1/5 4/5
Strike Graph Software product Relevant if you want to run SOC 2 or ISO 27001 compliance yourself and know the price upfront
2/5 5/5 1/5
SureCloud Software product Relevant if you already use SureCloud and want to add EU AI Act risk classification
3/5 1/5 4/5
Thoropass Software product Relevant if you want one tool to hold your SOC 2, ISO 27001 and ISO 42001 evidence
5/5 1/5 2/5
Trilateral Research Software product Relevant if you buy through Crown Commercial Service and want data protection and AI governance together
3/5 1/5 4/5
Trustible Software product Relevant if you need a register of your AI uses, triaged by risk, for the EU AI Act
4/5 1/5 3/5
Vanta Software product Relevant if you want SOC 2 or ISO 42001 evidence collected automatically, with a published uptime commitment
5/5 1/5 4/5

This is an independent editorial guide, not legal advice.