{"id":736,"date":"2026-08-16T14:35:23","date_gmt":"2026-08-16T14:35:23","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=736"},"modified":"2026-08-16T18:04:29","modified_gmt":"2026-08-16T18:04:29","slug":"iso-27001-certification-body","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/iso-27001-certification-body\/","title":{"rendered":"Certification Body"},"content":{"rendered":"\n<!-- =========================================================================\n     OSTO GLOSSARY: CERTIFICATION BODY\n     Shared glossary design system. Paste into one Custom HTML block. No H1.\n     ========================================================================= -->\n\n<style>\n.og{\n  --navy:#1c267a; --text:#0f1538; --muted:#0f1538; --light:#0f1538;\n  --border:#e7e9f2; --divider:#eceef5; --white:#ffffff;\n\n  --peri-50:#f4f5fd;  --peri-100:#e9ecfa; --peri-200:#cfd5f2; --peri-700:#4a52a8;\n  --sage-50:#f2f8f5;  --sage-100:#e3f0e9; --sage-200:#c3ddce; --sage-700:#3a6f5d;\n  --apri-50:#fdf6f0;  --apri-100:#fbe9dc; --apri-200:#f2cdb2; --apri-700:#a2603a;\n  --plum-50:#f8f3f9;  --plum-100:#f0e6f3; --plum-200:#dcc6e2; --plum-700:#6b4576;\n  --sky-50:#f1f7fb;   --sky-100:#e2eff7;  --sky-200:#bfd9e9;  --sky-700:#2f6a89;\n\n  --shadow:0 6px 22px rgba(15,21,56,.05);\n  --font:'Inter',-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;\n  font-family:var(--font); font-size:17px; line-height:1.75; color:var(--text);\n}\n.og p{margin:0 0 22px}\n.og h2{font-family:var(--font);font-size:clamp(25px,3vw,31px);font-weight:700;line-height:1.25;letter-spacing:-.5px;color:var(--navy);margin:52px 0 8px;scroll-margin-top:92px}\n.og h2::after{content:\"\";display:block;width:46px;height:5px;border-radius:3px;margin:12px 0 18px;background:var(--peri-200)}\n.og h2.c-sage::after{background:var(--sage-200)}\n.og h2.c-apri::after{background:var(--apri-200)}\n.og h2.c-plum::after{background:var(--plum-200)}\n.og h2.c-sky::after{background:var(--sky-200)}\n.og ul,.og ol{padding-left:22px;margin:0 0 24px}\n.og li{margin-bottom:9px}\n.og strong{font-weight:600}\n\n.og .dek{font-size:20px;line-height:1.6;color:var(--muted);margin:0 0 18px}\n.og .tags{margin:0 0 30px;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:8px}\n.og .tags li{margin:0}\n.og .tag{display:inline-block;font-size:12px;font-weight:600;letter-spacing:.7px;text-transform:uppercase;padding:6px 13px;border-radius:20px}\n.og .t-peri{background:var(--peri-100);color:var(--peri-700)}\n.og .t-sage{background:var(--sage-100);color:var(--sage-700)}\n\n.og .short{background:linear-gradient(135deg,var(--peri-100) 0%,var(--sage-100) 100%);border-radius:22px;padding:28px 32px;margin:0 0 30px}\n.og .short .k{font-size:13px;font-weight:700;letter-spacing:1.4px;text-transform:uppercase;color:var(--peri-700);margin:0 0 10px}\n.og .short p{font-size:19px;line-height:1.65;margin:0;color:var(--text)}\n\n.og .toc{background:var(--peri-50);border-radius:20px;padding:24px 28px;margin:0 0 34px}\n.og .toc .k{font-size:12px;font-weight:700;letter-spacing:1.3px;text-transform:uppercase;color:var(--peri-700);margin:0 0 12px}\n.og .toc ol{margin:0;padding-left:20px;columns:2;column-gap:34px}\n.og .toc li{margin-bottom:8px;break-inside:avoid;font-size:16px}\n.og .toc a{color:var(--navy);text-decoration:none;border-bottom:1px solid rgba(28,38,122,.22)}\n\n.og .callout{border-radius:4px;padding:24px 28px;margin:0 0 30px;background:var(--white);border:2px solid var(--navy)}\n.og .callout .k{font-weight:700;font-size:17px;margin:0 0 8px;color:var(--navy)}\n.og .callout p:last-child{margin-bottom:0}\n.og .callout.c-plum{background:var(--plum-50);border:none;border-radius:20px}\n.og .callout.c-plum .k{color:var(--plum-700)}\n\n.og figure{margin:0 0 30px}\n.og .sx{overflow-x:auto;-webkit-overflow-scrolling:touch;border-radius:20px;background:var(--white);box-shadow:var(--shadow)}\n.og .sx svg{display:block;width:100%;height:auto;min-width:600px}\n.og figcaption{font-size:14px;line-height:1.6;color:var(--muted);margin-top:12px}\n.og .swipe{display:none}\n\n.og table{width:100%;border-collapse:collapse;margin:0 0 28px;font-size:15px;background:var(--white);border-radius:18px;overflow:hidden;box-shadow:var(--shadow)}\n.og th{text-align:left;padding:14px 16px;font-weight:700;font-size:12.5px;letter-spacing:.8px;text-transform:uppercase}\n.og td{border-bottom:1px solid var(--divider);padding:13px 16px;vertical-align:top;line-height:1.6}\n.og tr:last-child td{border-bottom:none}\n.og .h-peri th{background:var(--peri-100);color:var(--peri-700)}\n.og .h-sage th{background:var(--sage-100);color:var(--sage-700)}\n.og .h-plum th{background:var(--plum-100);color:var(--plum-700)}\n\n.og .trio{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:0 0 28px}\n.og .tcard{border-radius:18px;padding:20px 22px}\n.og .tcard .n{font-size:16px;font-weight:700;margin:0 0 4px}\n.og .tcard .g{font-size:13px;font-weight:600;margin:0 0 10px;opacity:.8}\n.og .tcard p{font-size:14px;line-height:1.55;margin:0;color:var(--muted)}\n.og .tcard.a{background:var(--sky-50)}   .og .tcard.a .n,.og .tcard.a .g{color:var(--sky-700)}\n.og .tcard.b{background:var(--sage-50)}  .og .tcard.b .n,.og .tcard.b .g{color:var(--sage-700)}\n.og .tcard.c{background:var(--plum-50)}  .og .tcard.c .n,.og .tcard.c .g{color:var(--plum-700)}\n\n.og .pill{display:inline-block;font-size:11px;font-weight:700;letter-spacing:.8px;text-transform:uppercase;padding:5px 11px;border-radius:20px;white-space:nowrap}\n.og .p-req{background:var(--plum-200);color:#4d2f57}\n.og .p-exp{background:var(--sky-100);color:var(--sky-700)}\n.og .p-imp{background:#eef0f4;color:var(--muted)}\n.og .p-ask{background:var(--apri-100);color:var(--apri-700)}\n\n.og details{background:var(--white);border-radius:14px;margin:0 0 10px;box-shadow:0 2px 10px rgba(15,21,56,.04)}\n.og summary{cursor:pointer;padding:16px 20px;font-weight:600;font-size:17px;color:var(--navy);list-style:none;display:flex;justify-content:space-between;gap:16px;align-items:flex-start}\n.og summary::-webkit-details-marker{display:none}\n.og summary::after{content:\"+\";font-size:22px;line-height:1;color:var(--peri-700);flex:0 0 auto}\n.og details[open] summary::after{content:\"\\2013\"}\n.og details p{padding:0 20px 18px;margin:0;font-size:16px;line-height:1.7}\n\n.og .related{font-size:15px;color:var(--muted);border-top:1px solid var(--divider);padding-top:22px;margin-top:40px}\n\n@media(max-width:700px){\n  .og{font-size:16px}\n  .og .dek{font-size:18px}\n  .og .short p{font-size:17px}\n  .og .short,.og .toc,.og .callout{padding:22px 20px}\n  .og .toc ol{columns:1}\n  .og .trio{grid-template-columns:1fr}\n  .og .swipe{display:inline;font-weight:600;color:var(--peri-700)}\n  .og table{font-size:14px}\n  .og th,.og td{padding:11px 12px}\n}\n<\/style>\n\n<div class=\"og\">\n\n<p class=\"dek\">A certification body is the independent organisation that audits your management system and issues the ISO 27001 certificate. It cannot also be the consultant that built it.<\/p>\n\n<ul class=\"tags\">\n  <li><span class=\"tag t-peri\">Glossary<\/span><\/li>\n  <li><span class=\"tag t-sage\">ISO 27001<\/span><\/li>\n<\/ul>\n\n<div class=\"short\">\n  <p class=\"k\">The short answer<\/p>\n  <p>A certification body, sometimes called a registrar, performs the Stage 1 and Stage 2 audits and issues your certificate. The credible ones are accredited by a national accreditation body such as UKAS, ANAB or NABCB, which audits the auditor. An unaccredited certificate is legally a piece of paper, and enterprise procurement teams increasingly check.<\/p>\n<\/div>\n\n<p>The distinction that catches people out: accreditation and certification are different things at different levels. You are certified. Your certification body is accredited.<\/p>\n\n<div class=\"toc\">\n  <p class=\"k\">On this page<\/p>\n  <ol>\n    <li><a href=\"#chain\">Accreditation, certification and you<\/a><\/li>\n    <li><a href=\"#does\">What a certification body does<\/a><\/li>\n    <li><a href=\"#cannot\">What it cannot do<\/a><\/li>\n    <li><a href=\"#choose\">Choosing one<\/a><\/li>\n    <li><a href=\"#osto\">Where Osto fits<\/a><\/li>\n    <li><a href=\"#faq\">FAQ<\/a><\/li>\n  <\/ol>\n<\/div>\n\n<h2 id=\"chain\">Accreditation, certification and you<\/h2>\n\n<figure>\n<div class=\"sx\">\n<svg viewBox=\"0 0 760 250\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" aria-label=\"An accreditation body accredits the certification body, which certifies your organisation.\">\n  <defs><marker id=\"cbA\" markerWidth=\"9\" markerHeight=\"9\" refX=\"7\" refY=\"4.5\" orient=\"auto\"><path d=\"M0,0 L9,4.5 L0,9 z\" fill=\"#4a52a8\"\/><\/marker><\/defs>\n\n  <rect x=\"200\" y=\"26\" width=\"360\" height=\"58\" rx=\"14\" fill=\"#e9ecfa\"\/>\n  <text x=\"380\" y=\"50\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"14\" font-weight=\"700\" fill=\"#4a52a8\">Accreditation body<\/text>\n  <text x=\"380\" y=\"70\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#0f1538\">UKAS, ANAB, NABCB and other national bodies<\/text>\n\n  <line x1=\"380\" y1=\"90\" x2=\"380\" y2=\"112\" stroke=\"#4a52a8\" stroke-width=\"2.5\" marker-end=\"url(#cbA)\"\/>\n  <text x=\"396\" y=\"106\" font-family=\"Inter,sans-serif\" font-size=\"11\" fill=\"#4a52a8\">accredits, against ISO 17021<\/text>\n\n  <rect x=\"200\" y=\"120\" width=\"360\" height=\"58\" rx=\"14\" fill=\"#e3f0e9\"\/>\n  <text x=\"380\" y=\"144\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"14\" font-weight=\"700\" fill=\"#3a6f5d\">Certification body<\/text>\n  <text x=\"380\" y=\"164\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#0f1538\">Runs Stage 1, Stage 2 and surveillance audits<\/text>\n\n  <line x1=\"380\" y1=\"184\" x2=\"380\" y2=\"206\" stroke=\"#4a52a8\" stroke-width=\"2.5\" marker-end=\"url(#cbA)\"\/>\n  <text x=\"396\" y=\"200\" font-family=\"Inter,sans-serif\" font-size=\"11\" fill=\"#4a52a8\">certifies, against ISO 27001<\/text>\n\n  <rect x=\"200\" y=\"214\" width=\"360\" height=\"34\" rx=\"12\" fill=\"#1c267a\"\/>\n  <text x=\"380\" y=\"236\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"13\" font-weight=\"700\" fill=\"#ffffff\">Your organisation<\/text>\n<\/svg>\n<\/div>\n<figcaption><span class=\"swipe\">Swipe to see the full diagram. <\/span>Check the accreditation body&#8217;s public register for your certification body before signing anything.<\/figcaption>\n<\/figure>\n\n<h2 id=\"does\" class=\"c-sage\">What a certification body does<\/h2>\n\n<table class=\"h-sage\">\n  <thead>\n    <tr><th>Activity<\/th><th>Detail<\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td>Determines audit duration<\/td><td>Set by accreditation rules based on headcount and scope complexity, not negotiable<\/td><\/tr>\n    <tr><td>Runs <a href=\"https:\/\/www.osto.one\/resources\/glossary\/stage-1-and-stage-2-audit\/\">Stage 1 and Stage 2<\/a><\/td><td>Documentation review followed by the certification audit<\/td><\/tr>\n    <tr><td>Raises nonconformities<\/td><td>Graded major or minor, with corrective action tracked to closure<\/td><\/tr>\n    <tr><td>Independent certification decision<\/td><td>A reviewer who did not audit you signs off the report before the certificate is issued<\/td><\/tr>\n    <tr><td>Conducts <a href=\"https:\/\/www.osto.one\/resources\/glossary\/surveillance-audit\/\">surveillance audits<\/a><\/td><td>Years one and two, then full recertification in year three<\/td><\/tr>\n    <tr><td>Suspends or withdraws<\/td><td>When a major nonconformity is unresolved or audits are missed<\/td><\/tr>\n  <\/tbody>\n<\/table>\n\n<h2 id=\"cannot\" class=\"c-apri\">What it cannot do<\/h2>\n\n<div class=\"callout\">\n  <p class=\"k\">Consulting and certifying are separated by rule<\/p>\n  <p>ISO 17021 prohibits a certification body from providing consultancy to an organisation it certifies. It cannot write your policies, build your <a href=\"https:\/\/www.osto.one\/resources\/glossary\/isms\/\">ISMS<\/a> or perform your <a href=\"https:\/\/www.osto.one\/resources\/glossary\/iso-27001-internal-audit\/\">internal audit<\/a> and then also certify you. Anyone offering both is either unaccredited or operating outside the rules.<\/p>\n<\/div>\n\n<p>Your auditor can tell you a control is inadequate. They cannot tell you what to build instead. That gap is deliberate, and it is why implementation happens separately from audit. The same separation exists in <a href=\"https:\/\/osto.one\/resources\/blog\/soc-2-for-startups\/\" target=\"_blank\" rel=\"noopener\">SOC 2<\/a>, where the CPA firm audits but does not build.<\/p>\n\n<h2 id=\"choose\" class=\"c-plum\">Choosing one<\/h2>\n\n<div class=\"trio\">\n  <div class=\"tcard a\">\n    <p class=\"n\">Verify accreditation<\/p>\n    <p>Check the national register directly. Do not rely on a logo on a proposal.<\/p>\n  <\/div>\n  <div class=\"tcard b\">\n    <p class=\"n\">Check the scope sector<\/p>\n    <p>Accreditation is granted per sector. Confirm the body is accredited for software and IT services.<\/p>\n  <\/div>\n  <div class=\"tcard c\">\n    <p class=\"n\">Compare on total cycle<\/p>\n    <p>Quote all three years including surveillance, not just the initial audit fee.<\/p>\n  <\/div>\n<\/div>\n\n<h2 id=\"osto\">Where Osto fits<\/h2>\n\n<p>Osto sits on the implementation side of that line. The platform deploys and runs the controls, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/mfa\/\">access management<\/a>, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/vapt\/\">vulnerability testing<\/a>, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/cspm\/\">cloud posture<\/a>, endpoint control and <a href=\"https:\/\/www.osto.one\/resources\/glossary\/siem\/\">monitoring<\/a>, generates policies and collects evidence mapped to <a href=\"https:\/\/www.osto.one\/resources\/glossary\/iso-27001\/\">ISO 27001<\/a> and <a href=\"https:\/\/www.osto.one\/resources\/glossary\/iso-27001-annex-a-controls\/\">Annex A<\/a>. The audit and the certificate come from an accredited certification body, independently, which is exactly how it should work.<\/p>\n\n<!-- ============ CTA ============ -->\n<div style=\"background:linear-gradient(135deg,#1c267a 0%,#3f4796 48%,#6b4576 100%);border-radius:22px;padding:38px 34px;margin:40px 0 12px;box-shadow:0 10px 26px rgba(28,38,122,.2);text-align:center;\">\n  <p style=\"display:inline-block;background:rgba(255,255,255,.16);color:#ffffff;font-family:'Inter',-apple-system,sans-serif;font-size:11px;font-weight:700;letter-spacing:1.2px;text-transform:uppercase;padding:6px 14px;border-radius:20px;margin:0 0 16px;\">Free security assessment<\/p>\n  <p style=\"color:#ffffff;font-family:'Inter',-apple-system,sans-serif;font-size:26px;line-height:1.3;font-weight:700;letter-spacing:-.4px;margin:0 0 12px;\">Implementation from Osto, certification from your auditor<\/p>\n  <p style=\"color:#cfd3ea;font-family:'Inter',-apple-system,sans-serif;font-size:16px;line-height:1.65;margin:0 auto 26px;max-width:520px;\">Osto builds and runs the controls and collects the evidence. The certificate comes from an accredited body, independently.<\/p>\n  <a href=\"https:\/\/osto.one\/contact\/\" style=\"display:inline-block;background:#ffffff;color:#1c267a;font-family:&#039;Inter&#039;,-apple-system,sans-serif;font-weight:700;font-size:16px;text-decoration:none;border-bottom:none;padding:14px 30px;border-radius:12px;margin:0 6px 10px;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#1c267a;\">Get a free security assessment<\/span><\/a>\n  <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:transparent;color:#ffffff;font-family:&#039;Inter&#039;,-apple-system,sans-serif;font-weight:600;font-size:16px;text-decoration:none;border:1.5px solid rgba(255,255,255,.5);border-radius:12px;padding:13px 28px;margin:0 6px 10px;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a platform walkthrough<\/span><\/a>\n  <p style=\"color:#b3b8d8;font-family:'Inter',-apple-system,sans-serif;font-size:13px;margin:14px 0 0;\">Security first &middot; Compliance as byproduct &middot; One platform, everything<\/p>\n<\/div>\n\n\n<h2 id=\"faq\">Frequently asked questions<\/h2>\n\n<details>\n  <summary>What is a certification body?<\/summary>\n  <p>An independent organisation, sometimes called a registrar, that audits your information security management system against ISO 27001 and issues the certificate. It also conducts the annual surveillance audits that keep it valid.<\/p>\n<\/details>\n\n<details>\n  <summary>What is the difference between accreditation and certification?<\/summary>\n  <p>Accreditation is the oversight of the auditor: a national body confirms the certification body is competent and impartial. Certification is what the certification body issues to you. You are certified, your auditor is accredited.<\/p>\n<\/details>\n\n<details>\n  <summary>Does the certification body need to be accredited?<\/summary>\n  <p>Not legally, but an unaccredited certificate carries little weight. Enterprise procurement and security questionnaires increasingly ask which body issued the certificate and whether it is accredited, and unaccredited ones get rejected.<\/p>\n<\/details>\n\n<details>\n  <summary>Can a certification body help implement ISO 27001?<\/summary>\n  <p>No. ISO 17021 prohibits consultancy to an organisation the body certifies, to protect impartiality. Implementation support has to come from a separate provider, tool or internal team.<\/p>\n<\/details>\n\n<details>\n  <summary>Can you change certification body mid-cycle?<\/summary>\n  <p>Yes. This is a transfer, and the new body reviews your existing certificate, audit reports and open nonconformities before taking it on. The three-year cycle usually carries over rather than restarting.<\/p>\n<\/details>\n\n<p class=\"related\"><strong>Related glossary terms:<\/strong> ISO 27001 &middot; Stage 1 and Stage 2 Audit &middot; Surveillance Audit &middot; Internal Audit &middot; ISMS &middot; Statement of Applicability<\/p>\n\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A certification body is the independent organisation that audits your management system and issues the ISO 27001 certificate. It cannot\u2026<\/p>\n","protected":false},"author":8,"featured_media":737,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-736","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/736","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=736"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/736\/revisions"}],"predecessor-version":[{"id":738,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/736\/revisions\/738"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/737"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=736"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=736"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=736"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}