How to choose an ISO 27001 certifying body
An ISO 27001 certifying body is an accredited auditor that issues your certificate after a two-stage audit. Pick one by checking accreditation, sector experience and auditor-day pricing, not brand name alone.
What a certifying body actually does
A certifying body, sometimes called a certification body or registrar, is the organisation that audits your information security management system (ISMS) against ISO/IEC 27001 and issues the certificate. It does not help you build your ISMS, write your policies or fix your controls. That is the job of a consultant or a fractional CISO. The certifying body's only role is independent verification: it checks evidence, interviews staff, samples controls, and decides whether you meet the standard. If you mix these two roles up, you end up either paying a consultant to also audit you (which invalidates the certificate) or asking your auditor for implementation advice they are not allowed to give under accreditation rules.
Every legitimate certifying body is itself accredited by a national accreditation body, such as UKAS in the UK, ANAB in the US, or DAkkS in Germany. Accreditation is what makes the certificate mean anything to a customer's procurement team. If the body you're considering can't name its accreditor, or the accreditor doesn't list ISO 27001 in scope for that firm, walk away. I've seen companies pay for a certificate from an unaccredited body and then have to redo the whole audit eighteen months later because a key customer's security questionnaire rejected it outright.
How accreditation and the audit cycle fit together
The certification itself runs on a three-year cycle: an initial certification audit split into Stage 1 (documentation review) and Stage 2 (implementation review), followed by annual surveillance audits in years one and two, and full recertification in year three. The certifying body you choose at the start is the one you'll work with for at least three years, so continuity and auditor quality matter more than the logo on the certificate. Switching bodies mid-cycle is possible but awkward, and some will insist on a fresh Stage 1 if too much time has passed since your last audit.
Auditor-days are the real cost driver. ISO/IEC 27006 and the accreditation bodies set minimum audit duration based on headcount and number of sites, so quotes that look dramatically cheaper than competitors are usually cutting corners on audit time, not on margin. Ask for the exact number of auditor-days quoted for Stage 1, Stage 2 and each surveillance visit before comparing prices between bodies.
Comparing the common certifying bodies
There is no single correct answer here; the right body depends on your sector, your customers' expectations, and whether you need a name that's recognisable in a specific region. The table below covers bodies I've seen used by SaaS and services companies going through first-time certification.
| Body | Typical accreditor | Notable fit |
|---|---|---|
| BSI | UKAS | Strong recognition with UK public sector and enterprise procurement |
| DNV | ANAB / DAkkS | Broad international footprint, used in energy and maritime-adjacent sectors |
| Bureau Veritas | UKAS / COFRAC | Good for multi-site or multinational groups needing one auditor relationship |
| Schellman | ANAB | Popular with US SaaS companies already doing SOC 2 with the same firm |
| A-LIGN | ANAB | Combines ISO 27001 and SOC 2 audits, useful if you need both reports |
| TÜV SÜD / TÜV Nord | DAkkS | Strong in manufacturing and engineering supply chains |
If you already run SOC 2, checking whether your SOC 2 auditor's firm also does accredited ISO 27001 work can cut coordination overhead, since evidence collection overlaps heavily between the two frameworks.
Questions to ask before signing a contract
Get specifics in writing before you commit. Ask which accreditation body covers their ISO 27001 scope and confirm it on the accreditor's public register yourself rather than trusting a sales deck. Ask how many auditor-days are allocated to Stage 1 and Stage 2 specifically for your headcount and site count, and get the named lead auditor's sector background, since an auditor who has only ever audited manufacturing firms will ask different questions of a cloud-native SaaS company than one who understands AWS shared responsibility and CI/CD pipelines. Ask what happens if a nonconformity is raised at Stage 2, including timelines for corrective action and whether a follow-up visit is chargeable. Finally, ask for a fixed, itemised quote covering the full three-year cycle, not just the first-year number, because surveillance audit pricing is where some bodies recover margin they discounted on the initial engagement.
Where readiness work fits before you call a certifying body
Most of the actual work in getting certified happens before the certifying body ever shows up. Risk assessments, the Statement of Applicability, policy documentation, and evidence that controls have been operating for long enough to be auditable all need to exist first. Engaging a certifying body before this groundwork is done usually results in a failed or heavily caveated Stage 1, which wastes auditor-days you've already paid for. I generally recommend running a gap assessment and at least one internal audit cycle before booking Stage 1, so the certification audit itself is closer to a formality than a discovery exercise.
For cloud-native companies specifically, a lot of the Annex A control evidence (access control, logging, change management, network segmentation) maps directly onto how your AWS environment is architected and governed. Getting that mapping right before the auditor arrives saves repeated evidence requests during Stage 2.
Picking a body you won't need to replace
The cheapest quote at Stage 1 is rarely the cheapest over three years once surveillance audits and nonconformity follow-ups are priced in. Weight your decision towards accreditation scope, auditor sector experience, and total three-year cost, and treat brand recognition as a tiebreaker rather than the primary criterion unless a specific customer or regulator has named a preferred registrar.
Related: If you need help getting audit-ready before you engage a certifying body, see our ISO 27001 consultant services, or for ongoing security leadership through the certification cycle, our fractional CISO work. For AWS-specific control evidence and architecture alignment, see fractional cloud compliance architect.
Common questions
Can my ISO 27001 consultant also be my certifying body?
No. Accreditation rules require independence between the party that helps you implement controls and the party that audits them. Using the same firm for both invalidates the certificate. Consultants prepare you; certifying bodies audit you. Keep them separate even if one firm offers to do both for convenience.
How much does an ISO 27001 certifying body charge?
Cost depends on auditor-days, which scale with headcount, number of sites, and complexity of your ISMS scope. Expect a quote covering Stage 1, Stage 2, and two years of surveillance audits as one package. I won't quote a figure here since pricing varies too much by region and scope, but always ask for the full three-year cost, not just year one.
What happens if the certifying body finds a nonconformity?
Minor nonconformities usually require a corrective action plan with evidence submitted within a set timeframe, often 90 days, without a repeat visit. Major nonconformities typically require a follow-up audit before certification is granted. Ask your chosen body upfront how they classify findings and what a follow-up visit costs.
Does the certifying body need to be based in my country?
How long does it take to get certified once we engage a certifying body?
The Stage 1 and Stage 2 audits themselves can often be scheduled within a few weeks of each other once you're ready. The real variable is readiness: most first-time applicants spend several months on gap remediation, evidence collection and running at least one internal audit cycle before booking Stage 1 at all.
Can we switch certifying bodies partway through the three-year cycle?
Yes, but it's disruptive. The new body will usually require at least a transfer audit and may insist on a fresh Stage 1 if significant time has passed or documentation is incomplete. It's far cheaper to vet the body properly before signing than to switch mid-cycle over cost or service issues.
How this article was made: drafted with AI assistance from my own engagement notes and lab work, then fact-checked and edited by me (Sahil Dubey) before publishing. Corrections: hi@sahildubey.us.