Operational guidance, not legal advice. This page distills named public sources (regulator guidance and industry practice). It is not a legal determination, not a notification decision, and not a substitute for your counsel, insurer, or a retained DFIR firm. Verify applicability and current deadlines for your facts and jurisdiction.
How do you choose an ISO certification body?
Last verifiedChoose a certification body that is accredited for ISO/IEC 27001 by an IAF-MLA accreditation body, then verify the listing in IAF CertSearch. This page ranks no body. This page is not legal advice, does not determine YOUR obligations, does not start a clock, and does not file.
Selection guide, last verified 10 September 2026. ISO 27001 is a voluntary standard, not a law. The body is accredited against ISO/IEC 17021-1 and ISO/IEC 27006. UKAS and ANAB are examples of accreditation bodies, not winners. Never treat an unaccredited PDF as equivalent.
What this page is, and what it is not
Audience: a buyer of certification services who needs a recognised certificate.
This page is not legal advice. It does not determine YOUR obligations, does not start a clock, and does not file an application. Last verified 10 September 2026.
It is vendor-neutral. No certification body is named as better, cheaper, or guaranteed. Criteria first; then verify.
Criteria, why they matter, how to verify
Use the table as a scorecard you fill in. Do not turn it into a public ranking. Last verified 10 September 2026. Not legal advice.
| Criterion | Why it matters | How to verify | Kind of text |
|---|---|---|---|
| IAF-MLA accreditation for ISO/IEC 27001 | Only accredited bodies issue certificates that other IAF-MLA economies are set up to recognise. | IAF CertSearch; the accreditation body’s directory (examples: UKAS, ANAB). | Accreditation requirement. |
| Accreditation body is in the IAF MLA | A “certificate” from a body accredited by a non-MLA outfit may not travel. | IAF membership / MLA lists at iaf.nu; then the AB’s own register. | IAF arrangement. |
| Scope includes ISO/IEC 27001 (and your sector if they claim sector expertise) | Accreditation is scheme-specific. A body’s food-safety accreditation does not certify an ISMS. | The AB schedule attached to the CB; ask for the scope schedule. | Accreditation practice. |
| Audit-day proposal cites IAF MD 5 / ISO/IEC 27006 | Days should follow accreditation math, not a discount that skips the standard. | Ask them to show the MD 5 calculation in the proposal. | IAF mandatory document / CB standard. |
| Geography, language, and site access | Stage 2 and surveillance have to be performable for your locations. | Proposal and contract. Not a quality ranking. | Commercial / logistical criterion. |
| Independence from your implementer | ISO/IEC 17021-1 impartiality: the party that built the ISMS is often the wrong party to certify it. | Ask both firms how they meet impartiality. This page does not decide your facts. | CB standard (impartiality). |
Legal requirement, regulatory guidance, best practice, or our recommendation
Accreditation is how recognition works; it is still not a law that you must certify. Last verified 10 September 2026. Not legal advice.
| Statement | Which kind of authority | What it does not mean |
|---|---|---|
| Recognised certificates come from IAF-MLA accredited certification bodies. | Accreditation arrangement. | Does not rank UKAS above ANAB or the reverse. |
| ISO/IEC 17021-1 and ISO/IEC 27006. | Standards the certification body is accredited against. | Does not replace ISO/IEC 27001 Clauses 4–10 for your ISMS. |
| Verify before you sign. | Industry best practice. | Does not start a clock. |
| Unaccredited “ISO certificates” sold online. | Red flag — not a recognised accredited certificate. | Does not mean every low price is fraudulent; verify rather than assume. |
| Fill the criteria table yourself; do not ask this product to pick a winner. | ShipReady Metrics recommendation. | Does not issue a certificate and does not broker a body. |
Accreditation body compared with certification body
An accreditation body (UKAS in the United Kingdom, ANAB in the United States, and peers) accredits the certification body. The certification body audits you and, if you pass, issues the ISO/IEC 27001 certificate. Do not hire an accreditation body to “certify your ISMS.” Last verified 10 September 2026. Not legal advice.
Checklist
This is the how-to-verify checklist artifact. Last verified 10 September 2026. Not legal advice.
- Search IAF CertSearch for the legal name on the proposal.
- Confirm the scheme is ISO/IEC 27001, not a different ISO management system only.
- Open the accreditation body’s register (UKAS, ANAB, or the AB they claim) and match the certificate number.
- Ask for the IAF MD 5 day count in writing.
- Ask how they handle impartiality if a consultant already worked on your ISMS.
- Refuse to treat this page as a ranked list of “best” bodies.
What to do now
These steps do not file an application.
- Shortlist two or more accredited bodies using the criteria table — no public ranking.
- Read the certification-process and cost pages so days and fees stay attached.
- Read how to get certified if the ISMS is not yet built.
- Keep unpublished provider-roundup paths out of your bookmarks; name bodies in prose only until those pages exist.
- Re-verify sources; last verified 10 September 2026.
Where this shows up in ShipReady Metrics
Only shipped behaviour is described here. ShipReady Metrics does not issue certificates, does not produce an auditor's opinion, and is not a downloadable evidence binder.
If you already have a session: signed-in app → Compliance helps you prepare evidence. It does not recommend or rank certification bodies. ISO 27001 is in the 24-framework library; Annex A crosswalk density is coverage, not a pass.
Choosing the body is your commercial decision after accreditation checks.
Primary sources (last verified 10 September 2026)
IAF and IAF CertSearch; UKAS and ANAB as example accreditation bodies; ISO/IEC 17021-1 and ISO/IEC 27006 as the CB standards. Not legal advice. Not a directory of winners.