# Can the firm that prepares you also certify you?

For an accredited ISO certificate, preparing you and certifying you are two separate jobs, and the rules keep them apart.

**The short answer.** No, not for an accredited ISO certificate such as ISO 27001 or ISO 42001. The certification body may not also offer consultancy on management systems. Your own team or a different firm does the preparation. For the UK's Cyber Essentials, the certification body may help you understand the questions ([European Accreditation](https://european-accreditation.org/sp_accordion_faqs/question-41-1-impartiality-cl-5-2-5-of-iso-iec-17021-12015/) and [the NCSC](https://www.ncsc.gov.uk/cyberessentials/overview), checked 29 September 2026).

Which rules apply depends on the certificate. In the UK, UKAS is the one national body that accredits certification bodies. It announced its first ISO 42001 accreditation, to BSI, on 15 January 2026. For Cyber Essentials, a certification body licensed by IASME checks whether you meet the requirements ([UKAS](https://www.ukas.com/about-us/about-ukas/), [UKAS news](https://www.ukas.com/resources/latest-news/ukas-grants-first-aims-accreditation/) and [the NCSC](https://www.ncsc.gov.uk/cyberessentials/overview), checked 29 September 2026).

For an accredited ISO certificate, the two jobs sit with different organisations. If one group offers both, you can ask which company issues the certificate and under which accreditation. The guide to [choosing an adviser](/guides/how-to-choose-a-data-protection-adviser) covers the wider questions.

**Who checks whom in accredited ISO certification**

- UKAS: the UK's national accreditation body (accredits → A certification body)
- A certification body: audits you and issues the certificate (certifies → Your organisation)
- Your organisation: prepared by your own team or a consultant, never by the certification body itself

UKAS checks the certification body, the certification body checks you, and a consultant who helps you prepare stays outside the chain.

Source: UKAS, https://www.ukas.com/about-us/about-ukas/ (checked 29 September 2026); European Accreditation, https://european-accreditation.org/sp_accordion_faqs/question-41-1-impartiality-cl-5-2-5-of-iso-iec-17021-12015/ (checked 29 September 2026)

> "In short, UKAS ‘checks the checkers’."
> United Kingdom Accreditation Service (UKAS), https://www.ukas.com/about-us/about-ukas/ (checked 29 September 2026)

## How to get an accredited ISO 27001 or ISO 42001 certificate

1. Ask your customer which certificate it wants, and whether it must come from an accredited body.
2. Search the [UKAS directory](https://www.ukas.com/find-an-organisation/) for the certification body, and check it is accredited for your exact standard.
3. Keep the firm that prepares you separate from the body that audits you.
4. If you use a consultant, ask who will do the work and which certificates past clients now hold.
5. Plan for the full cost over time: the gap analysis, help to build the system, the audit, and later audits or renewals.

## The 91 providers for this situation

Grouped by type, alphabetical inside each type.

### Advisory firms (37)

- [AARC-360](https://theassurancedesk.com/advisers/aarc-360.md): Advisory firm
- [Accorian (Esha Corporation dba Accorian; Accorian Assurance)](https://theassurancedesk.com/advisers/accorian.md): Advisory firm
- [Actica Consulting Limited](https://theassurancedesk.com/advisers/actica-consulting-limited.md): Advisory firm
- [Amethyst Risk Management Limited](https://theassurancedesk.com/advisers/amethyst-risk-management.md): Advisory firm
- [AMSA InfoSec Ltd](https://theassurancedesk.com/advisers/amsa-infosec.md): Advisory firm
- [Anekanta Consulting](https://theassurancedesk.com/advisers/anekanta-consulting.md): Advisory firm
- [AvISO Consultancy](https://theassurancedesk.com/advisers/aviso-consultancy.md): Advisory firm
- [BABL AI Inc.](https://theassurancedesk.com/advisers/babl-ai.md): Advisory firm
- [Bridewell](https://theassurancedesk.com/advisers/bridewell.md): Advisory firm
- [Bright Defense, LLC](https://theassurancedesk.com/advisers/bright-defense.md): Advisory firm
- [CBIZ Pivot Point Security](https://theassurancedesk.com/advisers/cbiz-pivot-point-security.md): Advisory firm
- [Compass IT Compliance, LLC](https://theassurancedesk.com/advisers/compass-it-compliance.md): Advisory firm
- [Core Business Solutions](https://theassurancedesk.com/advisers/core-business-solutions.md): Advisory firm
- [Cyber Defense Group](https://theassurancedesk.com/advisers/cyber-defense-group.md): Advisory firm
- [CyPro](https://theassurancedesk.com/advisers/cypro.md): Advisory firm
- [Data GRC Ltd](https://theassurancedesk.com/advisers/data-grc.md): Advisory firm
- [Data Protection People](https://theassurancedesk.com/advisers/data-protection-people.md): Advisory firm
- [DataGuard](https://theassurancedesk.com/advisers/dataguard.md): Advisory firm
- [Elevate Consult](https://theassurancedesk.com/advisers/elevate-consult.md): Advisory firm
- [Enterprivacy Consulting Group](https://theassurancedesk.com/advisers/enterprivacy-consulting-group.md): Advisory firm
- [Evalian](https://theassurancedesk.com/advisers/evalian.md): Advisory firm
- [Fractional CISO, LLC](https://theassurancedesk.com/advisers/fractional-ciso.md): Advisory firm
- [GDPR Advisor (PSA Professional Solutions)](https://theassurancedesk.com/advisers/gdpr-advisor.md): Advisory firm
- [IT Governance (now GRC Solutions)](https://theassurancedesk.com/advisers/it-governance.md): Advisory firm
- [JBW Group International, LLC](https://theassurancedesk.com/advisers/jbw-group-international-llc.md): Advisory firm
- [JVR Consultancy](https://theassurancedesk.com/advisers/jvr-consultancy.md): Advisory firm
- [Kafico](https://theassurancedesk.com/advisers/kafico.md): Advisory firm
- [Meditology Services, LLC](https://theassurancedesk.com/advisers/meditology-services.md): Advisory firm
- [Osborne Clarke LLP](https://theassurancedesk.com/advisers/osborne-clarke-llp.md): Advisory firm
- [Rhymetec LLC](https://theassurancedesk.com/advisers/rhymetec.md): Advisory firm
- [RightCue Consulting Services Ltd](https://theassurancedesk.com/advisers/rightcue.md): Advisory firm
- [Samurai Digital Security Limited](https://theassurancedesk.com/advisers/samurai-digital-security-limited.md): Advisory firm
- [SideChannel, Inc.](https://theassurancedesk.com/advisers/sidechannel.md): Advisory firm
- [The DPO Centre](https://theassurancedesk.com/advisers/dpo-centre.md): Advisory firm
- [URM Consulting](https://theassurancedesk.com/advisers/urm-consulting.md): Advisory firm
- [vCISO Services, LLC](https://theassurancedesk.com/advisers/vciso-services.md): Advisory firm
- [Zaviant (WJS Cyber Consulting, LLC d/b/a Zaviant)](https://theassurancedesk.com/advisers/zaviant.md): Advisory firm

### Certification bodies (33)

- [360 Advanced, Inc.](https://theassurancedesk.com/advisers/360-advanced.md): Certification body
- [A-LIGN Compliance and Security, Inc. (dba A-LIGN)](https://theassurancedesk.com/advisers/a-lign.md): Certification body
- [Amtivo](https://theassurancedesk.com/advisers/amtivo.md): Certification body
- [Approachable Certification Ltd](https://theassurancedesk.com/advisers/approachable-certification.md): Certification body
- [Aprio, LLP](https://theassurancedesk.com/advisers/aprio-llp.md): Certification body
- [BARR Certifications, LLC](https://theassurancedesk.com/advisers/barr-certifications.md): Certification body
- [Boulay Certifications, LLC](https://theassurancedesk.com/advisers/boulay-certifications.md): Certification body
- [BSI (The British Standards Institution)](https://theassurancedesk.com/advisers/bsi.md): Certification body
- [Bureau Veritas](https://theassurancedesk.com/advisers/bureau-veritas.md): Certification body
- [Centre for Assessment](https://theassurancedesk.com/advisers/centre-for-assessment.md): Certification body
- [Coalfire Certification, Inc.](https://theassurancedesk.com/advisers/coalfire-certification.md): Certification body
- [ControlCase Assessments LLC](https://theassurancedesk.com/advisers/controlcase-assessments.md): Certification body
- [DNV](https://theassurancedesk.com/advisers/dnv.md): Certification body
- [EAGLE Registrations Inc.](https://theassurancedesk.com/advisers/eagle-registrations.md): Certification body
- [Forefront Certification Limited (FFC)](https://theassurancedesk.com/advisers/forefront-certification-limited.md): Certification body
- [Intertek](https://theassurancedesk.com/advisers/intertek.md): Certification body
- [IS Partners, LLC](https://theassurancedesk.com/advisers/is-partners.md): Certification body
- [ISOQAR (formerly Alcumus ISOQAR)](https://theassurancedesk.com/advisers/isoqar.md): Certification body
- [Kompleye Attestation, LLC](https://theassurancedesk.com/advisers/kompleye-attestation.md): Certification body
- [Linford & Company LLP](https://theassurancedesk.com/advisers/linford-and-company-llp.md): Certification body
- [LRQA](https://theassurancedesk.com/advisers/lrqa.md): Certification body
- [NQA](https://theassurancedesk.com/advisers/nqa.md): Certification body
- [Palindrome Technologies, Inc.](https://theassurancedesk.com/advisers/palindrome-technologies.md): Certification body
- [Peers Quality Assurance Limited (PQAL)](https://theassurancedesk.com/advisers/peers-quality-assurance-pqal.md): Certification body
- [Perry Johnson Registrars, Inc.](https://theassurancedesk.com/advisers/perry-johnson-registrars.md): Certification body
- [RA Cert Ltd](https://theassurancedesk.com/advisers/ra-cert-ltd.md): Certification body
- [Responsible AI Institute (Responsible Artificial Intelligence Institute)](https://theassurancedesk.com/advisers/responsible-ai-institute.md): Certification body
- [Schellman Compliance, LLC](https://theassurancedesk.com/advisers/schellman-compliance.md): Certification body
- [Sensiba LLP](https://theassurancedesk.com/advisers/sensiba-llp.md): Certification body
- [SGS North America Inc.](https://theassurancedesk.com/advisers/sgs-north-america.md): Certification body
- [SGS United Kingdom Limited](https://theassurancedesk.com/advisers/sgs.md): Certification body
- [Socotec Certification United Kingdom Limited](https://theassurancedesk.com/advisers/socotec-certification-uk.md): Certification body
- [TÜV UK Limited (TÜV NORD Group)](https://theassurancedesk.com/advisers/tuv-uk.md): Certification body

### Software products (21)

- [Advai](https://theassurancedesk.com/advisers/advai.md): Software product
- [Credo AI](https://theassurancedesk.com/advisers/credo-ai.md): Software product
- [Drata](https://theassurancedesk.com/advisers/drata.md): Software product
- [Enzai](https://theassurancedesk.com/advisers/enzai.md): Software product
- [Hicomply](https://theassurancedesk.com/advisers/hicomply.md): Software product
- [Holistic AI](https://theassurancedesk.com/advisers/holistic-ai.md): Software product
- [Hyperproof](https://theassurancedesk.com/advisers/hyperproof.md): Software product
- [IBM watsonx.governance](https://theassurancedesk.com/advisers/ibm-watsonx-governance.md): Software product
- [ISMS.online](https://theassurancedesk.com/advisers/isms-online.md): Software product
- [LogicGate](https://theassurancedesk.com/advisers/logicgate.md): Software product
- [Microsoft Purview](https://theassurancedesk.com/advisers/microsoft-purview.md): Software product
- [Monitaur](https://theassurancedesk.com/advisers/monitaur.md): Software product
- [OneTrust AI Governance](https://theassurancedesk.com/advisers/onetrust-ai-governance.md): Software product
- [Saidot](https://theassurancedesk.com/advisers/saidot.md): Software product
- [Secureframe](https://theassurancedesk.com/advisers/secureframe.md): Software product
- [Strike Graph](https://theassurancedesk.com/advisers/strike-graph.md): Software product
- [SureCloud](https://theassurancedesk.com/advisers/surecloud.md): Software product
- [Thoropass](https://theassurancedesk.com/advisers/thoropass.md): Software product
- [Trilateral Research](https://theassurancedesk.com/advisers/trilateral-research.md): Software product
- [Trustible](https://theassurancedesk.com/advisers/trustible.md): Software product
- [Vanta](https://theassurancedesk.com/advisers/vanta.md): Software product

## ISO 42001 and Cyber Essentials: common questions

### How do we check a body is accredited for ISO 42001?

Search for the certification body by name on the UKAS directory. UKAS also shows the bodies accredited for ISO 42001 on its browse-by-category page ([UKAS](https://www.ukas.com/accreditation/about/developing-new-programmes/development-programmes/aims/), checked 29 September 2026).

### Our certification body suggested a consultant. Is that allowed?

Yes. A certification body may give you a list of consultants. It must also tell you that using one will not make certification simpler, easier, faster or cheaper (a [UKAS bulletin](https://www.ukas.com/resources/technical-bulletins/relationship-between-cbs-and-consultants-result-of-question-to-ea-certification-committee/) of 8 April 2014, checked 29 September 2026). The choice of consultant stays with you.

### Does a UK government contract need Cyber Essentials?

A UK government contract often asks for Cyber Essentials. UK government policy applies to central government departments, their agencies and the public bodies they sponsor, and to NHS bodies. On contracts that handle personal data about citizens or government staff, they must check supplier security. Cyber Essentials or Cyber Essentials Plus is the quickest way to pass, and equal controls shown another way also count ([GOV.UK](https://www.gov.uk/government/publications/ppn-014-cyber-essentials-scheme/ppn-014-cyber-essentials-scheme-html), checked 29 September 2026).

### What does Cyber Essentials Plus add?

Cyber Essentials Plus adds testing by an outside assessor. It covers the same protections as Cyber Essentials, with more rigorous technical testing ([the NCSC](https://www.ncsc.gov.uk/cyberessentials/overview), checked 29 September 2026). Ask your customer which of the two the contract names.

## Where next

- [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed.md)
- [ISO 42001 in the UK: who certifies you, and what does it cost?](https://theassurancedesk.com/guides/iso-42001-certification-and-who-can-certify-you.md)
- [What does ISO 27001 certification take, and who can certify you?](https://theassurancedesk.com/guides/iso-27001-certification-and-who-can-certify-you.md)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.