When a new customer contract calls for ISO 27001 certification, first confirm the service scope, required assurance and deadline. Then plan implementation and independent assessment around evidence of an operating information security management system (ISMS). Initial certification normally involves Stage 1 and Stage 2 audits, followed by continuing surveillance and recertification arrangements. The certification body determines its audit programme and makes the certification decision. An applicable consultancy guarantee is a separate commercial commitment whose meaning and conditions belong in the agreed engagement terms.
This article explains the purpose of those stages and how to prepare useful evidence. ISO publishes standards but does not certify organisations, as its certification guidance explains. Preparation methods and examples below are recommendations, and the selected certification body’s current requirements and agreement govern its process.
Separate implementation, audit and certification decisions
Your organisation owns and operates the ISMS. An adviser can help interpret requirements, design processes and improve readiness. Internal audit provides the organisation with information about conformity and effective implementation. The certification body independently assesses the system and follows its decision process. Keep these roles clear in proposals and customer communications.
ISO/IEC 27006-1:2024 specifies additional requirements for bodies auditing and certifying ISMSs, alongside ISO/IEC 17021-1. Its focus includes competent, consistent and impartial certification activity. This is described in the ISO publication record for ISO/IEC 27006-1:2024. It is a standard for certification bodies, not a replacement for ISO 27001 implementation requirements.
Ask how independence and potential conflicts are handled. Do not assume that a combined commercial proposal means the same people can design the management system and make an unrestricted independent certification decision about it. The arrangement should be transparent and consistent with the certification body’s applicable rules.
Select a certification body for the intended scope
Describe the actual activities, legal entities, sites, workforce and external dependencies when requesting a proposal. Explain remote work and shared services. The body needs accurate information to determine the audit scope, competence and effort. A quote based on an incomplete picture may change later or leave the intended assurance unclear.
Verify accreditation where it is relevant to the customer’s requirement and your assurance objective. Check the certification body’s current accreditation scope with the relevant accreditation body, rather than relying only on a logo or marketing statement. ISO distinguishes certification from accreditation in its public explanation.
Compare more than the headline fee. Clarify audit stages, locations, remote arrangements, travel, corrective action review, follow-up, surveillance and recertification. Ask how scope changes affect the programme. A proposal is commercially useful when its assumptions and recurring commitments are visible before the organisation agrees a customer deadline.
Use Stage 1 to establish readiness for the main assessment
Stage 1 is generally a readiness review that examines the ISMS and preparation for Stage 2. Certification bodies describe the initial process as two stages; for example, BSI’s ISO 27001 guidance describes a two-stage audit, while SGS’s ISO 27001:2022 process overview distinguishes the initial review from confirmation of implementation.
Prepare to explain scope, context, risk assessment, treatment, the Statement of Applicability (SoA) and the management system’s operating arrangements. Ensure the evidence is current and consistent. A polished policy set will not resolve a contradiction between the scope statement, risk population and actual service delivery.
Treat concerns raised at Stage 1 as information that can affect readiness and planning. Assign owners, investigate the underlying issue and agree the next steps with the certification body. Avoid scheduling assumptions that leave no practical time to address a material gap before Stage 2.
Prepare Stage 2 evidence around actual operation
Stage 2 examines the implemented ISMS against the applicable certification criteria. SGS describes this stage as confirmation that the management system is fully implemented in its ISO 27001:2022 process overview. Confirm the detailed plan and evidence expectations with your selected body rather than assuming every audit follows an identical interview sequence.
Organise evidence around processes and decisions. A supplier sample should show requirements, assessment, approval and ongoing control. An access sample should connect identity, authorisation, provision, review and removal where relevant. A risk sample should connect the scenario, treatment, control and residual decision. These trails help demonstrate a functioning system.
Prepare process owners to explain their work honestly. They should know the current instruction, recent examples and how exceptions are handled. Coaching people to recite standard language is less useful than ensuring they understand their responsibilities and can retrieve reliable records. If a gap exists, describe it accurately and show the response.
Agree evidence expectations without inventing a universal waiting period
The organisation needs enough operating evidence for the assessment, but avoid treating a generic internet timetable as a universal ISO rule. Certification bodies may specify their own readiness expectations and programme arrangements. Discuss them early in relation to the scope, process frequency and maturity of the ISMS.
A control performed frequently may produce useful records quickly, while an infrequent process may need an appropriate planned test or a longer operating period. Internal audit and management review should be meaningful activities with real inputs and results. Creating them immediately before the audit without sufficient substance can leave important questions unanswered.
Do not backdate evidence or imply that a newly introduced process operated historically. Existing reliable records can support the relevant period, and gaps should be acknowledged. The readiness decision should reflect what the organisation can demonstrate now, not what it wishes had happened earlier.
Respond to findings through a disciplined corrective action process
Understand the criterion, evidence and nature of each finding. Ask for clarification where the facts or requirement are unclear. Then address immediate correction, causes, wider implications and effectiveness as appropriate. Follow the certification body’s requirements for submission, timing and verification; those arrangements should be confirmed directly rather than inferred from another organisation’s experience.
Keep responsibility with the people able to change the process. An ISMS coordinator can manage the response, but technical, service and business owners may need to deliver the action. Escalate resource or authority barriers early. A well-written response cannot compensate for an action that has not been implemented or verified.
Distinguish the audit team’s observations from the final certification decision. Do not tell a customer that certification has been awarded merely because the closing meeting was positive. Use the certification body’s confirmed outcome and issued documentation as the basis for external claims.
Check the issued certificate before using it commercially
Review the organisation name, scope, relevant locations, standard edition, dates and issuing body. Confirm that the wording corresponds to the service and entities assessed. Resolve errors promptly through the issuer. A certificate should not be used to imply coverage of products, subsidiaries or activities outside its stated scope.
Give sales and account teams approved wording. They should be able to explain what is certified and provide current verification information. A customer procuring one service needs to understand whether that service is covered. Avoid claims that the certificate guarantees no breach, certifies every product feature or automatically satisfies all legal obligations.
Maintain a controlled source for the current certificate and approved assurance material. Old versions can remain in proposals, portals and email attachments after scope or status changes. Assign responsibility for updating those channels so that commercial representations remain accurate.
Maintain the ISMS between certification and recertification
Certification is commonly maintained through a three-year cycle with surveillance activity between initial certification and recertification. NQA describes surveillance in the intervening years and recertification in year three in its certification process overview. Confirm exact dates, audit arrangements and conditions with the chosen certification body.
Continue the management processes that produced the initial evidence. Reviews, risk assessment, supplier oversight, incidents, internal audit, management review and corrective action remain relevant. An organisation that stops these activities after receiving the certificate will struggle to demonstrate an effective system later.
Notify the certification body of relevant changes as required by the agreement. New services, entities, locations or major operating changes may affect the programme or scope. Do not assume that a certificate automatically expands with the business. Discuss the change before relying on broader coverage in customer commitments.
Plan recertification around the accumulated operating record
Recertification should be supported by evidence from the continuing management system, not a reconstruction exercise near expiry. Maintain a history of significant changes, risk decisions, performance, audit results and improvement. This allows the organisation to explain how its ISMS has evolved and remained effective across the period.
Start planning early enough to resolve findings and complete the body’s decision process before relevant deadlines. Ask the certification body about its programme and availability. A certificate expiry date is a commercial constraint that should be visible to leadership and account teams, particularly where contracts depend on maintaining current certification.
Use the preparation to challenge scope and assumptions. The business may have changed substantially since initial certification. Confirm that the public scope still reflects the service and that controls remain appropriate. Renewal should not perpetuate an outdated assurance description simply because it was accepted previously.
Hypothetical example: a SaaS provider plans for a new enterprise contract
A hypothetical software-as-a-service (SaaS) provider is negotiating a contract that requires ISO 27001 certification covering its hosted service. The sales team initially promises a date based on a consultant’s standard project package. Discovery shows that the intended scope includes an overseas support provider and a shared development function not considered in that estimate.
The sponsor clarifies the required service scope with the customer, obtains a certification body proposal and builds the implementation plan around actual gaps. The team resolves supplier responsibilities, operates revised controls and completes meaningful internal assurance. Stage 1 concerns are addressed before the main assessment proceeds.
The company communicates progress accurately to the customer without presenting audit scheduling as certification. After the body’s decision, it checks that the issued scope matches the contracted service. The commercial outcome depends on a clear assurance requirement and credible evidence, rather than a promise of a certificate by an arbitrary date.
Hypothetical example: a distributor expands its certified scope
A hypothetical distributor holds certification for its central service operations and acquires a regional business. The acquired company uses different systems and local support arrangements. Sales wants to include the new business immediately in statements about the group’s certification.
The ISMS owner explains the existing scope and identifies the integration work needed. Leadership contacts the certification body about the change and plans the necessary assessment arrangements. Meanwhile, the organisation communicates the current coverage accurately and avoids treating ownership of the acquired company as automatic certification coverage.
Risk assessment and internal audit reveal differences in access removal and recovery evidence. The group addresses those gaps and verifies the revised processes before seeking the expanded assurance. The example shows why scope management remains important after initial certification and why acquisition dates and certification scope dates may differ.
Make a readiness decision that leaders can defend
Review whether the scope is stable, material risks have owners, necessary controls operate and evidence is retrievable. Examine internal audit findings, management decisions and unresolved corrective actions. Identify any assumptions that still depend on future work or unavailable supplier information.
Present leadership with the consequence of proceeding, delaying or adjusting the plan. A delay can have commercial implications, but an unsupported readiness claim can create greater uncertainty. The organisation should make the decision with a clear view of evidence and the certification body’s arrangements.
CyberVantage360’s ISO 27001 consulting service can support implementation and readiness planning. Discuss the customer requirement, service scope and target date to establish a realistic plan alongside the independent certification process.
Frequently asked questions
Does Stage 1 award certification?
No. Stage 1 is part of the initial assessment process and generally concerns readiness for Stage 2. Certification depends on the certification body’s full process and decision. Confirm the outcome directly and avoid presenting completion of one stage as an issued certificate.
How should a consultancy certification guarantee be understood?
An applicable consultancy guarantee is a commercial commitment whose scope and conditions should be confirmed in the agreed engagement terms. It does not transfer or predetermine the certification body’s independent assessment and decision. Confirm the responsibilities and remedies actually offered; do not assume a refund, fixed date or unconditional outcome that the agreement does not state.
Is there one mandatory implementation period for every organisation?
Do not assume a universal period from a generic guide. Agree readiness and evidence expectations with the selected body, considering process frequency, scope and maturity. The organisation needs genuine operating evidence and meaningful internal assurance, not records created to imply a history that does not exist.
Does a certificate automatically cover a newly acquired company?
No. Check the stated scope and discuss material changes with the certification body under the agreement. The acquired business may introduce new activities, systems and risks that require integration and assessment before broader coverage can be represented accurately.