What ISO 27001 is
ISO/IEC 27001 sets out requirements for an information security management system (ISMS): identifying information risks, choosing controls and keeping the system under review. Certification covers a defined scope, which can be one service or the whole organisation.
Who needs it
Organisations that handle customer data or sell to security-conscious buyers: software, managed services, professional services and suppliers to regulated firms. Scope is a major cost lever.
How certification works
Certification is carried out by an independent certification body. The usual shape is a first-stage audit that checks your documents and readiness, a second-stage audit that checks the system is working in practice, then a certificate valid for three years. In between, surveillance audits happen at least annually, and a recertification audit closes the cycle. The certification bodies we read describe the same cycle (three-year certificate, annual surveillance).
Cost and time: the short version
- What ISO 27001 costs: published ranges, who published them, and what moves the number.
- How long ISO 27001 takes: from about three months for a small, prepared organisation, to a year in some accounts.
- Certification bodies for ISO 27001: 14 listed from their own pages, with the page we checked for each.
Some bodies that certify to ISO 27001
Choose the right certification body
Accreditation matters, and it is checked per standard and sector. GOV.UK says the UK national accreditation body is UKAS and that government only recognises UKAS accreditation of organisations operating in the UK. Read the checklist.