# What does ISO 27001 certification take, and who can certify you?

Knowing the steps, and who may do each one, helps you plan the time and choose the right firms.

The Assurance Desk. Published 30 September 2026. Last checked 7 October 2026.

**The short answer.** ISO/IEC 27001 is the international standard for an information security management system, and it sets out the requirements such a system must meet ([ISO/IEC 27001:2022](https://www.iso.org/standard/27001), checked 30 September 2026). To be certified, you build that system, then a certification body audits it. In the United Kingdom, [UKAS](https://www.ukas.com/about-us/) is the national accreditation body, appointed by government to assess the organisations that provide certification ([UKAS](https://www.ukas.com/about-us/), checked 30 September 2026). Accreditation is granted standard by standard, so a body accredited for one management system standard is not automatically accredited for another ([ISO/IEC 17021-1:2015](https://www.iso.org/standard/61651.html), checked 30 September 2026). You can check any body's accredited scope yourself in the [UKAS directory of accredited organisations](https://www.ukas.com/find-an-organisation/) (checked 30 September 2026).

## In this series

- [How do you check an ISO certificate is genuine?](https://theassurancedesk.com/guides/check-iso-certificate-is-genuine.md)
- [How much does ISO 27001 certification cost in the UK?](https://theassurancedesk.com/guides/iso-27001-certification-cost-uk.md)
- [How to find UKAS accredited ISO 27001 certification bodies](https://theassurancedesk.com/guides/ukas-accredited-iso-27001-certification-bodies.md)
- [How long does ISO 27001 take?](https://theassurancedesk.com/guides/how-long-does-iso-27001-take.md)
- [ISO 27001 or SOC 2: which does your customer want?](https://theassurancedesk.com/guides/iso-27001-or-soc-2.md)
- [The ISO 27000 family: which standard does what?](https://theassurancedesk.com/guides/iso-27000-family-explained.md)

## What is ISO 27001?

ISO/IEC 27001 is the international standard for an information security management system. It describes how an organisation runs information security as an ongoing system, rather than listing technical controls to install once. ISO and the IEC publish it jointly, and the current edition is the third, published in October 2022 ([ISO/IEC 27001:2022](https://www.iso.org/standard/27001), checked 30 September 2026).

Its full title is Information security, cybersecurity and privacy protection, Information security management systems, Requirements ([ISO/IEC 27001:2022](https://www.iso.org/standard/27001), checked 30 September 2026).

Readers with a United Kingdom billing address buy the standard from the BSI store ([ISO/IEC 27001:2022](https://www.iso.org/standard/27001), checked 30 September 2026).

## What does certification involve?

ISO 27001 certification has two halves. First you build and run the information security management system the standard requires. Then an independent certification body audits it and decides whether it meets the requirements. ISO/IEC 17021-1 sets the rules for those bodies, covering their competence, consistency and impartiality ([ISO/IEC 17021-1:2015](https://www.iso.org/standard/61651.html), checked 30 September 2026).

ISO/IEC 17021-1 also says a certification body does not need to offer every type of management system certification ([ISO/IEC 17021-1:2015](https://www.iso.org/standard/61651.html), checked 30 September 2026). That matters most when you choose one.

**From a security system to a certificate**

1. Build and run: Put the information security management system into practice.
2. Check the body: Read its accredited scope for the standard you need.
3. Independent audit: The certification body audits the system and decides whether it meets the requirements.

Certification checks the management system you build and run.

Source: ISO/IEC 27001:2022, Information security management systems, ISO, https://www.iso.org/standard/27001 (checked 30 September 2026); ISO/IEC 17021-1:2015, Requirements for bodies providing audit and certification of management systems, ISO, https://www.iso.org/standard/61651.html (checked 30 September 2026); UKAS directory of accredited organisations, https://www.ukas.com/find-an-organisation/ (checked 30 September 2026)

## How do you check a certification body?

To check a certification body in the UK, read its schedule of accreditation in the UKAS directory of accredited organisations ([UKAS directory of accredited organisations](https://www.ukas.com/find-an-organisation/), checked 30 September 2026). The schedule lists the standards the body is accredited to certify. Read it for the standard you want, because accreditation for one does not carry across to another.

UKAS is the national accreditation body for the United Kingdom, appointed by government to assess organisations that provide certification, testing, inspection and calibration services ([UKAS](https://www.ukas.com/about-us/), checked 30 September 2026).

You can search the directory by organisation type, including certification bodies ([UKAS directory of accredited organisations](https://www.ukas.com/find-an-organisation/), checked 30 September 2026).

The clearest current example is the AI management system standard, ISO/IEC 42001. Some bodies accredited for ISO 27001 are also accredited for ISO 42001. Others are not yet, and their schedules say so.

On this site, 33 of the 140 providers are certification bodies, and each profile records what its UKAS schedule showed on the date we read it.

**Where to check a certification body**

![UKAS directory search fields for organisation type, name, customer number, region and country.](https://theassurancedesk.com/images/editorial/desk-library-ukas-search.jpg)

The screen shows a search box and filters for organisation type, organisation name, customer number, region and country. It also offers a Boolean search option, a Search button and Clear this search. Choose Certification Bodies as the organisation type when checking who can certify you. The search screen itself is not proof of accreditation. Read the organisation’s schedule for the relevant standard.

UKAS website, © UKAS. Cropped screenshot for the directory walkthrough. Captured 7 October 2026.
Source: UKAS directory, https://www.ukas.com/find-an-organisation/ (checked 7 October 2026)

## Is Cyber Essentials the same thing?

No, Cyber Essentials is not the same thing as ISO 27001. It is a separate United Kingdom scheme, the minimum standard of cyber security recommended by the government, developed by the [National Cyber Security Centre (NCSC)](https://www.ncsc.gov.uk/cyberessentials/overview) and built around five technical controls: firewalls, secure configuration, security update management, user access control, and malware protection ([National Cyber Security Centre (NCSC)](https://www.ncsc.gov.uk/cyberessentials/overview), checked 30 September 2026).

IASME is the NCSC's official Cyber Essentials delivery partner and manages a network of more than 400 cyber security organisations across the United Kingdom ([National Cyber Security Centre (NCSC)](https://www.ncsc.gov.uk/cyberessentials/overview), checked 30 September 2026).

Certification is renewed annually. There are two routes: a self led route where you complete a verified self assessment, and a supported route where you pay for help from a Cyber Advisor or a certification body ([IASME](https://iasme.co.uk/cyber-essentials/), checked 30 September 2026).

IASME publishes the price by organisation size: £320 plus VAT for nought to nine employees, £440 for ten to 49, £500 for 50 to 249, and £600 for 250 or more ([IASME](https://iasme.co.uk/cyber-essentials/), checked 30 September 2026).

Cyber Essentials Plus is a technical audit of your systems. The verified self assessment is a prerequisite for it, and you contact a certification body directly to arrange it ([IASME](https://iasme.co.uk/cyber-essentials/), checked 30 September 2026).

**ISO 27001 and Cyber Essentials answer different questions**

| Route | What it covers | What to check |
| --- | --- | --- |
| ISO/IEC 27001 | An information security management system | The certification body’s accreditation for this standard |
| Cyber Essentials | Five technical cyber security controls | The verified self assessment and annual renewal |
| Cyber Essentials Plus | A technical audit of your systems | The Cyber Essentials self assessment is a prerequisite |

Source: ISO/IEC 27001:2022, Information security management systems, ISO, https://www.iso.org/standard/27001 (checked 30 September 2026); Cyber Essentials, National Cyber Security Centre, https://www.ncsc.gov.uk/cyberessentials/overview (checked 30 September 2026); Cyber Essentials, IASME, the NCSC's official delivery partner, https://iasme.co.uk/cyber-essentials/ (checked 30 September 2026)

## What to do

1. Decide which standard the person asking actually wants. A customer asking for 'security certification' may mean ISO 27001, Cyber Essentials, or something else.
2. If it is ISO 27001, look up any certification body in the [UKAS directory of accredited organisations](https://www.ukas.com/find-an-organisation/) and read its schedule of accreditation for that standard before you engage it.
3. If a body is not listed for the standard you want, ask it directly what its accreditation covers. There are reasons a body may not be accredited for a given standard yet.
4. If it is Cyber Essentials, start with the free resources and the price bands published by [IASME](https://iasme.co.uk/cyber-essentials/), and decide between the self led and supported routes.
5. If you need Cyber Essentials Plus, remember the self assessment comes first, then the technical audit.

## Common questions

### Can the firm that helps me prepare also certify me?

No, not for an accredited ISO certificate such as ISO 27001. The certification body may not also offer consultancy on management systems, so your own team or a different firm does the preparation. The rule comes from ISO/IEC 17021-1, the standard that sets the impartiality rules for certification bodies ([European Accreditation](https://european-accreditation.org/sp_accordion_faqs/question-41-1-impartiality-cl-5-2-5-of-iso-iec-17021-12015/), checked 2 October 2026). If one group offers both, ask which company issues the certificate and under which accreditation. See [can the firm that prepares you also certify you?](/best/certification-seeking)

### Does ISO 27001 certification cover AI?

ISO 27001 covers information security management. AI management systems are a separate standard, ISO/IEC 42001, and accreditation for it is separate too. A body accredited for one is not automatically accredited for the other ([ISO/IEC 17021-1:2015](https://www.iso.org/standard/61651.html), checked 30 September 2026). See [our guide to ISO/IEC 42001 certification](/guides/iso-42001-certification-and-who-can-certify-you).

### Is Cyber Essentials enough on its own?

It depends on what you are being asked for. Cyber Essentials is described by the NCSC as the minimum standard of cyber security recommended by the government ([National Cyber Security Centre (NCSC)](https://www.ncsc.gov.uk/cyberessentials/overview), checked 30 September 2026). Some contracts ask for it specifically. Others ask for ISO 27001, which is a management system standard and a larger undertaking.

### How do I read a schedule of accreditation?

Find the body in the [UKAS directory of accredited organisations](https://www.ukas.com/find-an-organisation/), open its schedule, and look for the standard you want. The schedule lists what the body is accredited to certify. It is the document UKAS itself publishes, so it settles the question (checked 30 September 2026).

## Where next

- [Seeking ISO 42001 certification](https://theassurancedesk.com/best/certification-seeking.md)
- [After a ransomware or security incident](https://theassurancedesk.com/best/security-incident.md)
- [ISO 42001 in the UK: who certifies you, and what does it cost?](https://theassurancedesk.com/guides/iso-42001-certification-and-who-can-certify-you.md)
- [ISO 42001 or ISO 27001: which do you need, and which first?](https://theassurancedesk.com/guides/iso-42001-or-iso-27001.md)
- [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md)
- [How do you check an ISO certificate is genuine?](https://theassurancedesk.com/guides/check-iso-certificate-is-genuine.md)
- [ISO 27001 or SOC 2: which does your customer want?](https://theassurancedesk.com/guides/iso-27001-or-soc-2.md)
- [How long does ISO 27001 take?](https://theassurancedesk.com/guides/how-long-does-iso-27001-take.md)

## Sources

- ISO/IEC 27001:2022, Information security management systems, ISO: https://www.iso.org/standard/27001 (checked 30 September 2026)
- ISO/IEC 17021-1:2015, Requirements for bodies providing audit and certification of management systems, ISO: https://www.iso.org/standard/61651.html (checked 30 September 2026)
- About UKAS, the national accreditation body for the United Kingdom: https://www.ukas.com/about-us/ (checked 30 September 2026)
- UKAS directory of accredited organisations: https://www.ukas.com/find-an-organisation/ (checked 30 September 2026)
- Cyber Essentials, National Cyber Security Centre: https://www.ncsc.gov.uk/cyberessentials/overview (checked 30 September 2026)
- Cyber Essentials, IASME, the NCSC's official delivery partner: https://iasme.co.uk/cyber-essentials/ (checked 30 September 2026)
- European Accreditation, FAQ 41.1: impartiality, ISO/IEC 17021-1:2015 clause 5.2.5: https://european-accreditation.org/sp_accordion_faqs/question-41-1-impartiality-cl-5-2-5-of-iso-iec-17021-12015/ (checked 2 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.