How to Verify a Supplier's ISO 27001 Certificate

A supplier’s website badge is a claim, not a completed verification. Before relying on ISO/IEC 27001 certification, establish that the certificate is authentic, current and relevant to the entity and service you are buying. Then record what you checked and what the result allows you to conclude.

These are related but separate decisions. A genuine certificate may cover a different legal entity or activity. A relevant certificate may have been suspended since the PDF was issued. A valid certificate may still leave important customer responsibilities outside the supplier’s assurance.

Define the proposition you need to verify

Write a specific verification question before searching. For example: “Does the legal entity providing our hosted case-management service hold current ISO/IEC 27001 certification covering the operation and support of that service?”

Capture the proposed contracting entity, service name, delivery arrangements, important locations and relevant assurance requirement. Include any requirement for accredited certification. This prevents a reviewer from accepting an impressive-looking document that answers a different question.

For the underlying boundary concepts, see the ISMS scope guide. Scope is a description of what the management system covers, not a decorative sentence on the certificate.

Keep three decisions separate

Decision	Evidence sought	Example of an unresolved issue
Authenticity and status	Independent issuer or recognised verification record	PDF is available, but current status cannot be confirmed
Relevance	Entity, scope and applicable site information	Certificate names the parent while the contract names a subsidiary
Sufficiency for the purchase	Relevant controls, responsibilities and service commitments	Certificate is valid, but recovery arrangements remain unclear

Completing the first decision does not automatically complete the other two. This separation also makes escalation useful: procurement can identify exactly what is missing rather than marking the supplier simply “not compliant.”

Obtain the complete certification record

Ask for a current certificate and any associated scope or site schedule. Record the certificate number, standard and edition, certified organisation, issuing body, dates and accreditation details where applicable. Preserve the document as received, together with the date and supplier contact.

Read the content rather than relying on the filename. A document labelled with ISO 27001 may actually be a training certificate, a different management-system certificate, or a statement that certification is planned. None establishes the organisational certification being requested.

If the supplier provides only an image or a logo, ask for a verifiable identifier. Avoid treating a sales presentation as equivalent to a certification record.

Establish the entity and service connection

Compare the certificate name with the contracting and operating entities. Trading names, acquisitions and group structures can create legitimate differences, but the relationship needs evidence. A shared brand does not automatically bring every subsidiary into one certified ISMS.

Read the scope and accompanying schedules together. For distributed or cloud services, a single address may be the administrative location rather than a complete list of every technical dependency. Equally, a registered office address does not prove that all delivery locations are covered. Resolve the actual scope with the supplier and, where necessary, the issuer.

Ask the service owner to explain how the purchased service maps to the certified activities. If that explanation depends on an annex, obtain it. Where wording is ambiguous, retain the clarification rather than silently interpreting it in the supplier’s favour.

Check current status through an independent route

Use the issuing body’s official verification service or contact details obtained independently from its official website. Enter the certificate identifier and compare the result with the supplied document. Do not rely solely on a verification link embedded in an untrusted PDF.

Relevant directories can assist. ISO’s certification guidance points readers to national accreditation bodies and IAF CertSearch when looking for accredited certification. UKAS CertCheck is a database for management-system certificates issued under UKAS accreditation. These services have defined coverage; they are not interchangeable lists of every possible certificate.

If no result appears, record the search terms, date and source, then investigate spelling, identifiers, legal names and the directory’s coverage. Absence from one search is not sufficient evidence of fraud. Seek confirmation from the issuer before making that conclusion.

Printed validity dates remain useful, but a future expiry date does not establish current status by itself. Confirm whether the certification is active and whether any restriction affects the relevant scope. If status cannot be verified, record it as unresolved rather than active by assumption.

Verify the accreditation claim where it matters

Certification concerns the organisation’s management system. Accreditation concerns the certification body’s competence for specified activities. ISO develops standards; it does not issue the supplier’s certificate.

Where accredited certification is a procurement requirement, check the issuing body’s accreditation with the named accreditation body’s official records. Confirm the relevant management-system scheme and scope, not merely that the issuer has some form of accreditation.

An accreditation mark printed on a certificate is an input to verification, not the final evidence. Conversely, lack of accreditation does not automatically mean a certificate is fabricated. It may mean the supplier has not met your particular assurance condition. Document that distinction when referring the case for a purchasing decision.

The certification-process guide provides background on the roles involved. It should help reviewers distinguish an organisational certificate from an individual’s training or professional qualification.

Evaluate the gap between scope and your requirements

After verification, assess what further service evidence is needed. The certificate may support your confidence in the ISMS while leaving specific questions about information location, subcontractors, recovery, access or incident notification unanswered.

A relevant Statement of Applicability excerpt or an explanation of control responsibilities can be useful. Do not assume you have an automatic entitlement to every sensitive internal document, or that an SoA by itself proves all controls operate effectively. Agree proportionate evidence and confidentiality arrangements.

For ongoing oversight, connect the outcome to the supplier-security lifecycle. The certificate review should inform due diligence, contracting and monitoring rather than remain an isolated attachment.

Record a reproducible result

AuditPrepared recommends a compact verification record with:

• supplier and service identifiers;
• certificate number and document version;
• issuer and claimed accreditation;
• certified entity, scope and relevant schedules;
• verification source and access date;
• observed current status;
• identified mismatch or unanswered question;
• supporting evidence location;
• reviewer and decision authority; and
• next review date or event trigger.

Store a permissible record of the result, such as an exported confirmation or dated review note. Avoid retaining unnecessary personal information from correspondence. Someone reviewing the decision later should be able to distinguish what was verified from what the supplier merely asserted.

Handle common outcomes consistently

Verified and relevant: the independent result matches the document, status is current, and entity and service coverage are established. Proceed to any remaining service-risk evaluation.

Verified but incomplete for the purchase: the certificate is authentic, but a delivery function or legal entity is outside the demonstrated scope. Request additional assurance or an authorised exception.

Unresolved: the issuer’s record cannot be accessed or information conflicts. Keep the assurance condition open and define interim restrictions appropriate to the risk.

Confirmed invalid or misrepresented: independent evidence establishes withdrawal, expiry without renewal, alteration or a materially false claim. Escalate through the supplier-governance process with the evidence and business impact.

These are suggested decision categories, not mandatory ISO audit grades. An unresolved database lookup should not be reported as deliberate deception.

Reverify when the basis changes

Set review triggers for renewal, significant scope changes, changes in legal entity, acquisition, service expansion and relevant adverse information. Do not wait for an annual calendar reminder if the certified service has materially changed.

The ISO 27001 clause explainer can help the internal ISMS team connect assurance findings to context, requirements and risk decisions. It does not validate certificate numbers or replace an issuer’s records.

Older guidance on identifying certified firms used control-count and location wording that should not be treated as a current universal rule. The method above centres on the actual certificate, independent status, complete scope and a recorded purchasing decision.