"ISO 27001 certified" means an accredited certification body audited the ISMS at Stage 1 and Stage 2 and issued a certificate that is current and listed on its register. "Compliant" means the organisation says it meets the standard, with no independent audit or with a consultant's assessment. "Aligned", "based on" or "following" mean the standard informed the controls and nothing has been checked against its requirements. An unaccredited certificate sits in between: an audit took place, but by a body no accreditation body oversees. For a buyer, only an accredited, current certificate with the right scope is evidence to rely on without auditing the vendor. For your own status, use the exact words and keep "certified" for the certificate.
Security pages and questionnaire answers use four words for ISO 27001 status as if they were one. They are not, and buyers' reviewers know it. This article sets out what each claim means, what was checked by whom, and how to describe where you are without having to walk it back later.
The four claims
| Claim | What it means | What was checked, by whom | What a buyer can rely on |
|---|---|---|---|
| Certified (accredited) | An accredited certification body audited the ISMS and issued a certificate within a defined scope | Stage 1 and Stage 2 audits by an independent body that is itself assessed by a national accreditation body; yearly surveillance | The ISMS conformed within the scope on the audit dates, and is re-checked every year; verifiable on the body's register |
| Certified (unaccredited) | A body with no accreditation audited the ISMS and issued a certificate | An audit of unknown rigour by a body nobody oversees | Little; treat as a self-assessment with a logo |
| Compliant | The organisation states that it meets the standard's requirements | Nothing independent, or a consultant's gap assessment | The organisation's word and whatever evidence it shares |
| Aligned, based on, following, ready | The standard informed the controls, or certification is planned | Nothing against the standard's requirements | That the organisation knows the standard exists |
What accreditation adds
Any company can call itself a certification body and issue certificates. Accreditation means a national accreditation body, Swedac in Sweden, UKAS in the United Kingdom, DAkkS in Germany, ANAB in the United States, has assessed that body against ISO/IEC 17021-1 and the ISMS-specific requirements of ISO/IEC 27006-1, witnesses its audits and keeps reviewing it. Accreditation bodies that belong to the IAF recognise each other's work, which is why an accredited certificate issued in one country is accepted in another. An unaccredited certificate has none of that behind it, and the vendor certificate article explains how to tell the two apart.
Compliance without certification: when it is legitimate
Every certified organisation was compliant first. Running an ISMS to the standard without certifying it is a reasonable choice when no buyer requires the certificate, when the cost of the audit cycle is not yet justified, or during the months between implementation and the Stage 2 audit. The claim becomes a problem when it is dressed as something more: a "compliant" badge designed to look like a certificate, or a questionnaire answer that says certified when the audit is booked for next quarter. The timeline article covers how long the gap usually is.
What buyers should ask for each claim
- Certified: the certificate, the certification body's register entry, the scope statement and the SoA version, then the SoA under NDA where it matters.
- Unaccredited certificate: treat as compliant; ask the same questions you would ask with no certificate.
- Compliant: the Statement of Applicability, the latest internal audit report, the management review minutes and the date of the planned certification audit, plus your own questionnaire.
- Aligned or ready: your questionnaire, evidence for the controls you depend on, and a date for when the picture will change.
How to describe your own status
- Certified: "Certified to ISO/IEC 27001:2022 by [body], accredited by [accreditation body], certificate number, scope: …". Link the register entry.
- Between Stage 2 and the certificate: "Stage 2 audit completed on [date]; certificate pending the certification decision."
- Before the audit: "ISMS implemented to ISO/IEC 27001:2022; certification audit scheduled for [month]."
- Building: "Security programme based on ISO/IEC 27001:2022; certification planned for [year]."
- Never: an ISO 27001 badge or logo without a certificate, or the ISO logo at all, which ISO does not license to certified organisations; use the certification body's mark under its rules.
The same confusion with SOC 2
SOC 2 is an attestation report from a CPA firm, not a certification, so "SOC 2 certified" is inaccurate in the same way "ISO 27001 compliant" overstates. The precise claims are "ISO 27001 certified" and "SOC 2 Type 2 report available". The ISO 27001 and SOC 2 comparison covers what each document shows a buyer.