Noru

Free template

Vendor ISO 27001 certificate review worksheet

One worksheet per vendor certificate: the five checks that decide whether it covers what you buy, and a record of what you concluded.

Fill one in per vendor certificate, and again at each renewal or at least every year, because surveillance audits are yearly and a certificate can be suspended between expiry dates.

The scope check is the one that most often fails. Read the scope statement for the service you buy and the locations that deliver it before anything else.

The guide behind it: How to Verify a Vendor's ISO 27001 Certificate: Accreditation, Scope, SoA and Status

Vendor ISO 27001 certificate review: [vendor]

Vendor[Name]
Service we buy[Service, and the data it handles]
Criticality[High / Medium / Low]
Reviewed by[Name, role]
Date[YYYY-MM-DD]

Certificate

ItemValue
Certificate number[Number]
Standard and edition[ISO/IEC 27001:2022]
Certification body[Name]
Accreditation body[For example Swedac, UKAS, DAkkS, ANAB]
Issue and expiry dates[YYYY-MM-DD] to [YYYY-MM-DD]

Verification

IAF CertSearch listing is voluntary, so an absence there is not proof of a problem; the certification body's own register is the authority.

  • Certification body accredited for ISO/IEC 27001 on the accreditation body's register: [Yes / No, date checked]
  • Certificate current on the certification body's register: [Yes / No, date checked]
  • Listed in IAF CertSearch: [Yes / No / Not listed]

Scope

Scope statement as printed: [Quote the scope statement]

  • Covers the service we buy: [Yes / No / Partly]
  • Covers the legal entity we contract with: [Yes / No]
  • Covers the locations that deliver and support the service: [Yes / No, which are missing]

Statement of Applicability

SoA version on the certificate: [Version / date]. Current version per the vendor: [Version / date].

Control we depend onApplicableImplementedNotes
[A.5.23 Information security for use of cloud services][Yes/No][Yes/No][Notes]
[A.8.13 Information backup][Yes/No][Yes/No][Notes]

Surveillance

  • Last surveillance or recertification audit: [YYYY-MM-DD]
  • Open major nonconformities: [None / Describe]

Other evidence

[SOC 2 report, penetration test summary, questionnaire answers, DORA addendum, data processing agreement.]

Decision

Decision[Accept / Accept with conditions / Reject]
Conditions or follow-up[What, owner, date]
Next review[YYYY-MM-DD]

All templates

FAQ

Frequently asked questions

Talk to us

Do we need to review every vendor's ISO 27001 certificate?

Review the certificates of vendors that handle your information or run part of your service, at least yearly. ISO 27001's own supplier controls, and NIS2 and DORA for entities in their scope, expect that review to be recorded.

What if the vendor will not share its Statement of Applicability?

Record the refusal and the controls you could not confirm, and decide whether the risk is acceptable for the data the vendor handles. Many vendors share the SoA under NDA, sometimes redacted.

Trust, settled.

Templates are the start. Noru drafts the policies from your own setup, tracks approvals and acknowledgements, and keeps the evidence.

Book a demoMore templates