Compliance › ISO 27001 › Choose a certification body
Choose a certification body or consultantHow to choose an ISO 27001 certification body or consultant
Two different kinds of provider are involved, and they are often confused. This guide explains who does what, how to check that a certification body is genuinely accredited, what to ask before you sign and which warning signs to watch for.
Free for buyers · provider-funded introductions · Updated October 2026
How do you choose an ISO 27001 certification body?
Start with accreditation. Choose a certification body that is accredited for ISO/IEC 27001 by a recognised national accreditation body, and confirm it yourself in that body’s public directory. Then check impartiality: the certifier should not also have consulted on your ISMS. Only after that, compare audit days, scope, language, region and price. A consultant is a separate and optional choice, and you can pick one without picking your certifier.
- An unaccredited certificate may not be accepted by customers or regulators that ask for accredited certification. Check what yours requires before you buy.
- Certification bodies and consultants do different jobs. Accreditation rules keep them apart for the same client.
- A cheaper quote is not comparable until you know the audit days behind it. See the cost guide.
Certification body, consultant, platform: four parties, four jobs
Most mistakes in this choice come from treating these as one thing.
Accreditation bodies include ANAB in the US, UKAS in the UK, NABCB in India and JAS-ANZ in Australia and New Zealand. Check which one applies to your market.
| Party | What it does | What it must not do |
|---|---|---|
| Accreditation body | Assesses certification bodies for competence and impartiality and accredits them | Issue your certificate |
| Certification body | Audits your ISMS against ISO/IEC 27001 and issues the certificate | Consult on, or help build, the ISMS it certifies |
| Consultant | Helps you design, document and run the ISMS | Issue a recognised certificate |
| Compliance platform | Tracks controls and evidence and automates tasks | Certify you. It is a tool, not an audit |
| You | Own the ISMS, the risks and the evidence | Treat the certificate as a one-off purchase |
In SOC 2 the word is auditor and it means a licensed CPA firm. In ISO 27001 the word is certification body. If you are weighing both, see the SOC 2 auditor guide and SOC 2 vs ISO 27001.
How to check a certification body is really accredited
It takes a few minutes, it is free and it is the single most useful check.
Ask for two things
The name of the accreditation body that accredited them, and the accreditation or certificate number. A real body gives both without hesitation.
Look them up at the source
Go to the accreditation body’s own website, not the provider’s. For example ANAB publishes a directory of accredited bodies. Other countries have their own accreditation body and directory.
Check the scope
Accreditation is granted for specific standards. Confirm ISO/IEC 27001 information security management systems is listed, not only other standards.
Match the details
The legal name, address and status should match your quote. Check the accreditation is current, not suspended or withdrawn.
Check existing certificates
Where a certificate database is available, you can look up a certificate and see which body issued it. The IAF has published a global database for accredited certificates called CertSearch. The IAF and ILAC have since combined into the Global Accreditation Cooperation, so check the current location of such databases.
Why recognition matters: accreditation bodies that belong to the international IAF arrangement recognise each other’s accredited certificates. Existing IAF accreditations continue to be recognised under the Global Accreditation Cooperation, which began full operations on 1 January 2026.
Nine criteria to compare certification bodies
Score each provider against the same list. Put accreditation and impartiality first, because they are pass or fail.
| Criterion | What to ask | Good sign | Warning sign |
|---|---|---|---|
| Accreditation | Which body accredited you, and for what scope? | Listed in the accreditation body directory for ISO/IEC 27001 | Cannot name the accreditation body, or only shows a logo |
| Impartiality | Do you or an affiliate consult on ISMS for clients you certify? | A clear separation policy | Offers to prepare you and certify you |
| Sector competence | Which auditors would audit us, and what is their experience with our type of business? | Named auditor competence for your sector | Generic answers |
| Audit days | How many auditor-days, and how were they calculated? | A method tied to ISO/IEC 27006-1 and your scope | A fixed price with no days shown |
| What is excluded | What is not in the quote: travel, follow-ups, certificate fees? | A written list | Surprises after signing |
| Surveillance | What are the years 2 and 3 fees and days? | Quoted up front | Only year 1 quoted |
| Region and language | Can you audit in our country and language, remotely or on site? | Auditors available where you operate | Auditors flown in at your cost without notice |
| Integrated audits | Can you audit ISO 27001 with our other standards together? | Yes, with days adjusted in writing | Only vague promises |
| References | Can we speak to a similar client? | Willing to connect you | Refuses or deflects |
Why the certifier and the consultant must stay separate
This is the rule buyers most often do not know about.
- The standard for bodies that audit management systems, ISO/IEC 17021-1, says a certification body must not offer or provide management system consultancy.
- It also restricts a body from certifying a system it consulted on until a waiting period has passed after the consultancy ends. Check the current text for the length.
- Auditing cannot be outsourced to a consultancy organisation, and a certification body may not market itself as linked to one.
Partnerships and referrals. Some consultants, platforms and certification bodies recommend each other, and money may change hands. That is not automatically wrong. Ask whether an arrangement exists, whether it affects the price and whether you may use a different body. The same applies to us: we are funded by providers we introduce, so judge our suggestions with the same questions.
Do you need a consultant, a platform or neither?
| Option | Fits when | Watch for |
|---|---|---|
| Do it yourself | You have an experienced owner and a small, well-understood scope | Time cost, and gaps found only at the audit |
| Compliance platform | You want help tracking controls and evidence | A tool does not certify you or write your risk decisions |
| Consultant | You lack ISO experience or time | Scope of work, who writes the documents and whether you can run it afterwards |
| Consultant plus platform | You want both guidance and tracking | Overlap in cost, and who owns the evidence |
- Scope of work: ask exactly what they will write, run and hand over.
- Ownership: the ISMS should be yours to run once they leave.
- Fixed or hourly: know what happens if the scope grows.
- Audit support: ask if they attend the audit, and at what cost.
- Not a guarantee: no consultant can promise a result, because the certification body decides.
- Certifier link: ask which certification bodies they work with and why.
Questions to ask every provider
- Which accreditation body accredited you, and what is your accreditation number?
- Is ISO/IEC 27001 within your accredited scope?
- Do you or any affiliate provide consulting to your certification clients?
- How many auditor-days do you propose and how were they set?
- What is excluded from this quote?
- What are the surveillance and recertification costs?
- Who will audit us, and what is their experience in our sector?
- How do you handle a major nonconformity, and is a follow-up audit charged?
- Can the audit be done remotely, in our language and in our time zone?
- What happens to our certificate if we change certification body later?
Red flags when choosing a provider
- The certificate arrives with almost no audit. A real audit involves interviews and evidence. Very quick, low-effort offers deserve questions.
- No verifiable accreditation. A logo or the word “accredited” without a body and number is not enough.
- The same firm prepares you and certifies you. This conflicts with the impartiality rules above.
- A pass is promised. Audit outcomes depend on your evidence and the auditor’s findings.
- Pressure to sign quickly, or a price that changes once the scope is discussed.
These are signs to question, not proof of bad faith. Ask for the answer in writing.
Choosing in India, the UAE or elsewhere
The checks are the same everywhere. The accreditation body is not.
- For India, see ISO 27001 consulting in India and the India cost guide. India’s accreditation body is NABCB.
- For the UAE, see ISO 27001 certification in Dubai.
- Elsewhere, find your country’s accreditation body and use its directory.
Related ISO 27001 guides
Choosing an ISO 27001 certification body: questions answered
What is the difference between a certification body and a consultant?
How do I check that a certification body is accredited?
Does the certification body have to be accredited?
Can the company that consults for me also certify me?
Do I need a consultant for ISO 27001?
Is a compliance platform the same as a certification body?
Why do certification body quotes differ so much?
What is IAF CertSearch?
What does the IAF multilateral arrangement mean for me?
Can I switch certification bodies later?
What should I ask about the audit team?
Does ZCyberSecurity certify companies?
Ready to compare providers? Get matched.
Free for buyers · provider-funded introductions · Reviewed October 2026 by the ZCyberSecurity compliance team