What does ISO 27001 certification take, and who can certify you?

What is ISO 27001?

ISO/IEC 27001 is the international standard for an information security management system. It describes how an organisation runs information security as an ongoing system, rather than listing technical controls to install once. ISO and the IEC publish it jointly, and the current edition is the third, published in October 2022.

Its full title is Information security, cybersecurity and privacy protection, Information security management systems, Requirements.

Readers with a United Kingdom billing address buy the standard from the BSI store.

What does certification involve?

ISO 27001 certification has two halves. First you build and run the information security management system the standard requires. Then an independent certification body audits it and decides whether it meets the requirements. ISO/IEC 17021-1 sets the rules for those bodies, covering their competence, consistency and impartiality.

ISO/IEC 17021-1 also says a certification body does not need to offer every type of management system certification. That matters most when you choose one.

How do you check a certification body?

To check a certification body in the UK, read its schedule of accreditation in the UKAS directory of accredited organisations. The schedule lists the standards the body is accredited to certify. Read it for the standard you want, because accreditation for one does not carry across to another.

UKAS is the national accreditation body for the United Kingdom, appointed by government to assess organisations that provide certification, testing, inspection and calibration services.

You can search the directory by organisation type, including certification bodies.

The clearest current example is the AI management system standard, ISO/IEC 42001. Some bodies accredited for ISO 27001 are also accredited for ISO 42001. Others are not yet, and their schedules say so.

On this site, 33 of the 140 providers are certification bodies, and each profile records what its UKAS schedule showed on the date we read it.

Where to check a certification body

Is Cyber Essentials the same thing?

No, Cyber Essentials is not the same thing as ISO 27001. It is a separate United Kingdom scheme, the minimum standard of cyber security recommended by the government, developed by the National Cyber Security Centre (NCSC) and built around five technical controls: firewalls, secure configuration, security update management, user access control, and malware protection.

IASME is the NCSC's official Cyber Essentials delivery partner and manages a network of more than 400 cyber security organisations across the United Kingdom.

Certification is renewed annually. There are two routes: a self led route where you complete a verified self assessment, and a supported route where you pay for help from a Cyber Advisor or a certification body.

IASME publishes the price by organisation size: £320 plus VAT for nought to nine employees, £440 for ten to 49, £500 for 50 to 249, and £600 for 250 or more.

Cyber Essentials Plus is a technical audit of your systems. The verified self assessment is a prerequisite for it, and you contact a certification body directly to arrange it.

What to do

1. Decide which standard the person asking actually wants. A customer asking for 'security certification' may mean ISO 27001, Cyber Essentials, or something else.
2. If it is ISO 27001, look up any certification body in the UKAS directory of accredited organisations and read its schedule of accreditation for that standard before you engage it.
3. If a body is not listed for the standard you want, ask it directly what its accreditation covers. There are reasons a body may not be accredited for a given standard yet.
4. If it is Cyber Essentials, start with the free resources and the price bands published by IASME, and decide between the self led and supported routes.
5. If you need Cyber Essentials Plus, remember the self assessment comes first, then the technical audit.

Common questions

Can the firm that helps me prepare also certify me?

No, not for an accredited ISO certificate such as ISO 27001. The certification body may not also offer consultancy on management systems, so your own team or a different firm does the preparation. The rule comes from ISO/IEC 17021-1, the standard that sets the impartiality rules for certification bodies. If one group offers both, ask which company issues the certificate and under which accreditation. See can the firm that prepares you also certify you?

Does ISO 27001 certification cover AI?

ISO 27001 covers information security management. AI management systems are a separate standard, ISO/IEC 42001, and accreditation for it is separate too. A body accredited for one is not automatically accredited for the other. See our guide to ISO/IEC 42001 certification.

Is Cyber Essentials enough on its own?

It depends on what you are being asked for. Cyber Essentials is described by the NCSC as the minimum standard of cyber security recommended by the government. Some contracts ask for it specifically. Others ask for ISO 27001, which is a management system standard and a larger undertaking.

How do I read a schedule of accreditation?

Find the body in the UKAS directory of accredited organisations, open its schedule, and look for the standard you want. The schedule lists what the body is accredited to certify. It is the document UKAS itself publishes, so it settles the question.

Where next

• Seeking ISO 42001 certification
• After a ransomware or security incident
• ISO 42001 in the UK: who certifies you, and what does it cost?
• ISO 42001 or ISO 27001: which do you need, and which first?
• How do I choose a data protection or AI governance adviser?
• How do you check an ISO certificate is genuine?
• ISO 27001 or SOC 2: which does your customer want?
• How long does ISO 27001 take?

This is an independent editorial guide, not legal advice.