Verifying a vendor's ISO 27001 certificate takes five checks. The certificate names a certification body accredited for ISO/IEC 27001 and carries the accreditation body's mark. The certificate is current on the certification body's own register, or in IAF CertSearch, remembering that CertSearch listing is voluntary, so absence there is not proof of a fake. The scope statement covers the service and the locations you depend on. The Statement of Applicability version the certificate references is the one in use and includes the controls you care about. And the surveillance audits are up to date. Then ask for what the certificate does not show: the SoA, a summary of the latest audit, and any open nonconformities.
A vendor sends a PDF with a logo and a date. Most security reviews stop there, which is why the IAF estimates that thousands of false or misleading management system certificates circulate every year, and why vendors with genuine certificates covering the wrong thing pass reviews they should not. The checks below take an hour and need no special access, and the free certificate review worksheet records them per vendor.
Why certificates get rejected
- The certification body is not accredited, or not accredited for ISO/IEC 27001.
- The certificate has expired, was suspended, or was issued against the 2013 edition, which has been invalid since 31 October 2025.
- The scope covers a department or another group company, not the service being bought.
- The locations that deliver or support the service are not in the scope.
- The SoA version on the certificate is years old, or the controls the buyer depends on are excluded.
- The surveillance audit is overdue, which can mean the certificate is suspended even if the register has not caught up.
The five checks
| Check | Where to look | Red flag |
|---|---|---|
| Accreditation | The accreditation body's register of certification bodies and their scopes | No accreditation mark on the certificate; a body not on the register; ISO/IEC 27001 missing from its scope |
| Currency | The certification body's register, then IAF CertSearch | Not found on the body's register; status suspended or withdrawn; a 2013 edition certificate |
| Scope | The scope statement on the certificate | A department or a sister entity; a service not named; a location missing; vague wording |
| Statement of Applicability | The SoA version on the certificate; the SoA itself under NDA | No SoA reference; a version older than the vendor's current one; your controls excluded |
| Surveillance | The vendor, and the register where it shows audit dates | No surveillance within the last twelve months; open major nonconformities |
Accreditation and CertSearch
Accreditation is what makes a certificate mean something: a national accreditation body has assessed the certification body against ISO/IEC 17021-1 and ISO/IEC 27006-1 and keeps assessing it. Bodies accredited by IAF members recognise each other's certificates. IAF CertSearch is the IAF's database for validating accredited certificates, and it is the quickest check when the certificate is there. Listing is voluntary for certification bodies and their clients, so a certificate that is not found is not necessarily false; the certification body's own register is the authority, and a vendor can always point you to it. The certification body article explains accreditation from the vendor's side.
Scope and the Statement of Applicability
The scope statement is where most genuine certificates fail a review. Read it for the service you buy, the legal entity you contract with, and the sites that deliver and support the service, including support centres in other countries. The scope article shows what good and bad statements look like. The SoA version on the certificate identifies the control set the audit was based on; the Statement of Applicability article explains what it contains. When you depend on specific controls, ask for the SoA under NDA and check that those controls are marked applicable and implemented rather than excluded or planned.
What the certificate does not tell you
A certificate says that an audit found the ISMS conforming, within the scope, on the dates audited. It does not say how the controls are configured, whether an incident has happened since, or how the vendor handles your data in particular. For those, ask for the SoA, a summary of the last audit and its findings, the incident history relevant to your service, and the answers to your own questionnaire. A vendor with a current, accredited certificate and a precise scope should be able to produce all of it quickly; one that cannot is telling you something.
Where this sits in third-party risk
The certificate check is one step of supplier assessment under ISO 27001's own A.5.19 to A.5.22, and of the due diligence NIS2 and DORA expect. Record what you checked, with the certificate number, scope, SoA version, expiry and last surveillance date, and re-check at least yearly and at each renewal. Noru keeps the vendor register, the evidence each vendor provides and the review of it in the same programme as the controls, so the certificate, its scope and the review date sit on the vendor record; the TPRM solution describes it. The SOC 2 report review covers the equivalent for the other common document.
Primary sources
- IAF CertSearch — validation of accredited certifications, International Accreditation Forum
- ISO/IEC 17021-1:2015 — requirements for bodies providing audit and certification of management systems, ISO
- ISO/IEC 27006-1:2024 — requirements for bodies providing audit and certification of information security management systems, ISO