ISO 27001 certificate verification checklist

Collect the certificate and identifiers

Request the actual certificate and any scope schedule. Record the certificate number, named entity, issuing body, standard edition, dates, and locations. Keep the source and verification date with the record; a logo or sales assertion is insufficient context.

Compare scope with your dependency

Read the scope statement alongside your contract, service description, and relevant locations. Identify products, activities, or entities that are not clearly covered and ask the supplier to explain. Certification concerns the stated management-system boundary; it is not a guarantee about every product feature.

Verify the issuer and accreditation

ISO develops standards but does not issue certificates. Identify the certification body and check relevant accreditation through the accreditation body’s records. Match the legal entity and standard scope rather than assuming any accreditation logo covers the engagement.

Check current status through a reliable record

Use the issuing body’s validation route and, where applicable, IAF CertSearch. Compare the certificate number, entity, scope, status, and dates. If a record is missing or inconsistent, contact the issuing body or registry rather than concluding from a missing search result alone that the certificate is fraudulent.

Document unresolved questions

Record what was verified, the source, date, remaining scope questions, reviewer, and decision. Set a review trigger for expiry, service changes, or a changed status. Keep a dated verification note instead of relying indefinitely on a downloaded PDF.

For your own certification project, use the engagement planning guide. Verification and buying a certification engagement are separate tasks.