Based on standard, headcount, sites, scope, complexity and readiness.
Consulting and certification-body audit fees must remain separately identified to protect impartiality.Explore this page · jump to a section
ISO CERTIFICATION • ACCREDITATION-AWARE
ISO/IEC 27001:2022 Information Security Management System Certification
Build a risk-based information-security system with controlled assets, access, suppliers and incidents.
RegisCorp helps define the certification scope, assess gaps, structure management-system evidence and coordinate an independent certification-body audit. ISO itself does not certify organisations.
01 • STANDARDISO/IEC 27001:2022Information Security Management System
02 • AUDITIndependentCertification body decision
03 • VALIDITYTypically 3 yearsSubject to surveillance
Clarity continues beyond the first step.
The original page-specific roadmap is retained here, with every detail available after the quick enquiry panel.
Accreditation matters. Ask who accredits the certification body, confirm the precise standard and scope, and independently verify the certificate. A non-accredited certificate may not satisfy a tender, customer or regulator.
Compare certification routes THE OUTCOME YOU ARE BUYING
Buy a credible ISO/IEC 27001:2022 certification route, not a decorative certificate.
The intended outcome is a risk-based information-security system with controlled assets, access, suppliers and incidents, supported by implemented controls and an independently verifiable audit trail.PRICE • PROOF • COVERAGE
Clear scope. Visible confidence.
Understand the starting commercial position and the service model before sharing documents or approving work.
UNDERSTAND THE STANDARD
ISO/IEC 27001:2022 is a management system, not a certificate purchased without implementation.
ISO/IEC 27001:2022 focuses on information-security risk treatment, statement of applicability and controls, incident, supplier and access governance. The applicable system must reflect the organisation's actual scope, processes, risks and evidence.ISO develops standards but does not issue certificates. An external certification body audits conformity; accreditation provides independent confirmation of that body's competence for the relevant scope.
Request a gap assessment WHAT IS INCLUDED
Know exactly what the engagement delivers.
Standard and scope assessment
Confirm the correct standard, sites, activities, exclusions and intended accredited route.
Gap-assessment report
Map current practices against applicable clauses and prioritise corrective actions.
Management-system documentation
Develop proportionate policies, procedures, registers and templates around actual operations.
Implementation support
Assign ownership, communicate controls and build objective evidence.
Internal audit and management review
Test readiness and close findings before the external audit.
Certification coordination
Support certification-body evaluation, audit scheduling and finding closure without guaranteeing approval.
WHO THIS IS FOR
Suitable users of ISO/IEC 27001:2022
- SaaS, IT and technology companies
- Businesses handling client or personal data
- Vendors answering enterprise security reviews
WHO THIS IS NOT FOR
A credible certification route is not suitable when:
- Buyers seeking an instant certificate without implementation
- Businesses that cannot disclose the actual certification scope
- Anyone expecting ISO or RegisCorp to issue or guarantee a certificate
STANDARD REQUIREMENTS
What the ISO/IEC 27001:2022 management system must control.
01
Information-security risk treatment
Define responsibilities, criteria and controlled information.
02
Statement of Applicability and controls
Implement controls and preserve objective evidence.
03
Incident, supplier and access governance
Measure results, correct gaps and improve the system.
DECISION TABLE
Choose an accredited or non-accredited route with the end use visible.
| Route | What it means | Best considered for | Verification |
|---|---|---|---|
| 01Accredited certification | Certification body is accredited for the relevant standard and scope | Tenders, enterprise supply chains and wider recognition | Accreditation body and certificate database |
| 02Non-accredited certification | Certification body operates without recognised accreditation for that certificate | Only where the buyer expressly accepts it | Issuer records; recognition may be limited |
| 03Implementation only | Organisation uses the standard without third-party certification | Internal improvement where no certificate is required | Internal audit and performance evidence |
| 04Guidance standard | A standard not designed for certification, such as ISO 26000 | Guidance and organisational learning | No legitimate accredited certificate |
CLEAR DIFFERENTIATION
ISO, accreditation bodies, certification bodies and consultants have different roles.
ISO develops standards
ISO does not audit organisations or issue ISO certificates.
Accreditation body oversees competence
It accredits certification bodies for defined standards and scopes.
Certification body decides certification
It independently conducts audits and issues, maintains, suspends or withdraws certificates.
RegisCorp supports readiness
We assist with scope, gaps, documentation, implementation and coordination; we do not guarantee certification.
WHY REGISCORP
One organised route from eligibility to operations.
Outcome-first selection
Start with the buyer, tender, customer or operational need.
Proportionate system design
Build usable controls instead of unnecessary documents.
Accreditation clarity
Make issuer, accreditation, scope and verification visible before purchase.
Evidence-led readiness
Connect policies to records, internal audit and management review.
DOCUMENT READINESS
Prepare the operational evidence required for ISO/IEC 27001:2022.
Exact documented information depends on the chosen scope and organisational context.Request a tailored checklist- Asset and risk registers
- Statement of Applicability
- Policies, control evidence and internal audits
- Organisation structure, sites, processes and scope
- Applicable legal, customer and contractual requirements
- Objectives, competence, communication and corrective-action evidence
OUR WORKFLOW
Scope. Gap assess. Implement. Audit. Improve.
01
Scope and commercial-use review
Confirm standard, sites, activities, tender expectations and accreditation needs.
02
Gap assessment and action plan
Compare current controls against the standard and assign owners.
03
Implementation and readiness review
Build records, internal audit the system and conduct management review.
04
Independent certification audit
Coordinate Stage 1, Stage 2, finding closure and certificate verification.
INDICATIVE TIMELINE
Understand the stages before completion.
- 01
Scoping
Usually begins after organisation, site and process information is available.
- 02
Implementation
Often requires several weeks or months depending on maturity and evidence.
- 03
Certification audit
Stage 1 and Stage 2 timing is controlled by the selected certification body.
- 04
Ongoing cycle
Surveillance audits are normally periodic, followed by recertification before expiry.
COMMON MISTAKES
Avoid preventable delays, rework and scope gaps.
Choosing by lowest certificate price
This can produce an unrecognised certificate or inadequate scope.
Confusing ISO with the certifier
ISO does not audit or issue certificates.
Ignoring accreditation scope
An accredited body may not be accredited for every standard or sector.
Copying generic documentation
Documents that do not match operations collapse during interviews and sampling.
Excluding important sites or activities
An artificially narrow scope may not meet the buyer's requirement.
Stopping after certification
Surveillance, changes, incidents and continual improvement remain necessary.
RISK CONTROL
Copy-paste controls without implementation evidence can create both audit failure and false security assurance.
Verify the end user's requirement before appointing a certification body or promising certification in a bid.- Recognition riskThe customer or tender may reject a non-accredited or incorrectly scoped certificate.
- Misrepresentation riskMisusing the ISO logo or claiming certification by ISO can mislead stakeholders.
- Audit riskMissing implementation evidence can produce nonconformities or failed readiness.
- Lifecycle riskSuspension, expiry or missed surveillance can invalidate reliance on the certificate.
Common mistakes to avoid
- Choosing a scope so narrow that customers do not accept the certificate.
- Copying a Statement of Applicability without checking each control.
- Having policies but no evidence that they are followed.
- Assuming ISO 27001 covers your data protection law duties.
ISO CERTIFICATION QUESTIONS
ISO/IEC 27001:2022 certification FAQs
Standards, transition periods and accreditation arrangements change. Confirm the current edition and certification-body accreditation before contracting.Ask an expert question01What is ISO/IEC 27001:2022?+
ISO/IEC 27001:2022 is the relevant international management-system standard for information security management system. Its requirements must be applied to the organisation's defined scope.
02Does ISO issue the certificate?+
No. ISO develops and publishes standards. Independent certification bodies perform audits and issue certificates.
03What is IAF versus non-IAF certification?+
The practical distinction is accredited versus non-accredited certification. IAF and ILAC ceased operations on 1 January 2026 as Global Accreditation Cooperation Incorporated assumed their former roles; verify the current accreditation chain and live certificate status before relying on it.
04Is accreditation compulsory?+
Accreditation is not always legally compulsory, but it provides independent confirmation of certification-body competence and may be required by customers, tenders or regulators.
05How long is certification valid?+
Management-system certificates commonly operate on a three-year cycle with surveillance, subject to the certification body's rules and continued conformity.
06Can certification be guaranteed?+
No. The independent certification body decides certification after audit and closure of applicable findings.
07Can ISO 26000 be certified?+
No. ISO states that ISO 26000 is guidance and is not intended or appropriate for certification.
08How do I verify a certificate?+
Check the legal entity, standard, scope, sites, issue and expiry dates, certification body, accreditation body and live certificate status using recognised sources.
PRIMARY ISO REFERENCES