Skip to content
ISO 9001:2026 published · transition until 30 Sep 2029

We use cookies needed for the site to work and, if you accept, others to measure use and improve our communications. You can change your choice at any time. See the details

ISO/IEC 27001Information security

It requires assessing and treating information security risks and declaring the applicability of the Annex A controls.

ISO/IEC 27001:2022Certification under accreditation
Start ISO/IEC 27001 certificationRequest a proposal How the process worksProcess
Illustrative image

What it demonstrates

  1. It requires assessing and treating information security risks and declaring the applicability of the Annex A controls.
  2. The audit checks that the selected controls operate and that the system is measured and improved.
Sectors
  • Technology
  • Financial services
  • Telecommunications
  • BPO and professional services
Edition
ISO/IEC 27001:2022
Discipline
Information security
Topic
Technology and information
Public status
Third-party certification · published accredited scope

Accredited scope published in the Trust Center · 30-06-2026

Certificates and sites reported worldwide

Reported certificates
96,709
Sites covered
179,877

Certificates and sites are different units. Sums across standards do not count unique companies or locations.

ISO Survey 2024 · Overview · Corte: 31/12/2024

Explore the data · CSV · 2024

Why now

The transition to the 2022 edition closed on 31 October 2025: every valid accredited certificate must be on that edition. Annex A has 93 controls in four themes.

ISO/IEC 27001, step by step

Initial certification follows these steps.

See how the process works
  1. Enquiry and scope

    What you are asked for, what activities you carry out, and at which sites and in which country you operate.

  2. Proposal

    In writing, sized to the standard, the activities, the sites and the country.

  3. Audit

    The assigned team assesses the documentation and the operation with evidence.

  4. Verifiable certificate

    A function separate from the audit team decides. The certificate can be checked by its code.

  5. Continuity

    Continuity of the cycle is agreed for your case.

Who audits
The audit team assigned to the case, with declared competence for the standard.
Who decides
A function separate from the audit, in accordance with ISO/IEC 17021-1.
Who issues
G-CERTI Co., Ltd.
Where it is checked
The public certificate register, by code. Verify

Issuance depends on the audit and an independent decision.

FAQ

How much does certification cost?

There is no list price: the proposal is sized on standard, scope, sites, headcount, activities, system complexity and delivery mode. The request is reviewed first and the proposal is then issued.

What happens if the audit raises findings?

Findings are documented and classified. The organization submits correction, root cause and corrective action with evidence; the audit team evaluates it and only then does the file go to decision.

Who decides on certification?

A competent function separate from the audit team. Those who audit do not decide, and no outcome is anticipated before that review.

Where can an issued certificate be checked?

In the public certificate register, by code.

Verify a certificate

Standards commonly integrated

See the full catalogue
An organization's team with its certificates
Certificate deliveryG-CERTI archive

Request your ISO/IEC 27001 proposal

The proposal arrives in writing, with the standard, the scope and the timeline.

Start ISO/IEC 27001 certificationRequest a proposal Verify certificateVerify