Worth an hour

Check a supplier's ISO 27001 certificate in 3 fields

Somebody sends you a PDF. It has a logo, a number, a date and a signature, and the covering email says “as requested, our ISO 27001 certificate”. You file it.

Most supplier assurance stops there, and it stops one step too early — because a certificate is a structured document with required contents, and three of those fields answer the questions the filing was supposed to answer.

The certificate has to tell you these things

This is not a matter of what a certification body chooses to print. ISO/IEC 17021-1 clause 8.2.2 sets out what a certification document shall identify, and an accredited body is assessed against it.

Seven items. Three of them do almost all the work in supplier assurance, and they are the three nobody reads.

Field 1 — the edition, from item (e)

Item (e) requires the standard “including indication of issue status (e.g. revision date or number)”. In plain terms: the certificate has to say which edition you were audited against.

Why this is the first thing to check

ISO/IEC 27001:2013 was withdrawn. Certificates issued against it ceased to be valid on 31 October 2025, and the transition rule is explicit that certificates expire or are withdrawn at the end of the transition period.

A certificate does not change appearance when the edition behind it is withdrawn. It still has the logo, the number, the scope, and an expiry date that may well be in the future. If nobody reads the edition, nothing looks wrong.

The organisations most exposed are the ones that did this properly

They collected certificates, filed them, recorded the expiry dates, and set calendar reminders against those dates. The reminder fires when the certificate says it expires — which, for a certificate against the withdrawn edition, is not when it stopped meaning anything.

So the folder assembled carefully in 2024 is now partly out of date by definition rather than by date, and the system built to keep it current is the reason nobody noticed.

Field 2 — the dates, from items (b) and (c)

Item (b) is the effective date, item (c) the expiry or recertification due date “consistent with the recertification cycle”.

What the cycle actually is

Three years, with a surveillance audit in each of the first two and recertification in the third. So a certificate is a statement about a point in time plus an ongoing obligation, and the obligation is the part that can quietly stop being met.

What the dates cannot tell you

Whether the certificate has been suspended or withdrawn since it was issued. That does not announce itself to you, and the printed expiry date is unaffected by it. If a supplier matters, the certification body named on the certificate maintains a register of what it has issued, and item (d) gives you the unique identification code to quote when asking.

Field 3 — the scope, from item (f)

Item (f) is the one worth slowing down for. The document must identify the scope “with respect to the type of activities, products and services as applicable at each site without being misleading or ambiguous”.

That last phrase is in the requirement because scope is where this fails.

The three ways a scope fails to cover what you buy

Geography. A scope covering a supplier’s UK operations does not cover the service delivered from elsewhere. Item (a) requires the geographical location of each certified site, so the certificate tells you this too.

Product line. A supplier with four products may be certified for one. The certificate says which. Read it before filing the PDF.

Function. A scope covering the hosted platform may exclude the support desk that can see your data. This is the one that survives longest undetected, because the supplier is not being evasive — the scope genuinely covers the thing they think of as the product.

The question that resolves all three

“Does the scope on your certificate cover [the specific service we buy]?” It is one sentence, it is answerable from the document they already sent you, and asking it is normal.

The rule about a second standard on the certificate

Here is one almost nobody knows, and it changes how a certificate should be read.

Where certification documents reference other standards as a source of controls, ISO/IEC 27006:2015/Amd 1:2020 clause 8.2.1 requires that the reference “shall be clearly stated as being only a control set source for controls applied in the Statement of Applicability and not a certification thereof”.

So a second framework named on an ISO 27001 certificate may mean we selected controls from this, not we are certified to this. The certificate is required to make that distinction legible. If a supplier is presenting it as two certifications, the document itself is the counter-evidence — and the Statement of Applicability is where you see which controls were actually taken.

Why an auditor cares about your folder

If you are certified yourself, none of this is housekeeping. It is a control.

The supplier relationship controls in Annex A require you to manage information security risk in your supply chain and to monitor and review supplier service delivery. A folder of certificates nobody has examined is visible evidence of a control that is documented but not operating, and that distinction is what a Stage 2 or surveillance auditor is trained to find.

The awkward version goes like this: you present the supplier register, the auditor picks one supplier, asks for the assurance evidence, and the certificate produced names a withdrawn edition of the very standard being audited. It is a small finding with an unhelpful amount of symbolism attached.

What the register should record, beyond the PDF

A folder of certificates is evidence that you collected certificates. A register is evidence that you reviewed them, and the difference is four columns: what you checked, when, who checked it, and what you concluded.

That turns the annual hour into something an auditor can sample. “We hold a certificate for this supplier” invites the next question; “we checked the edition, the dates and the scope on 14 March, the scope covers the hosted service we buy, and the certificate is current to 2027” ends it. The conclusion column matters most, because a review that always concludes “fine” and never once concluded “ask them” is not a review anyone will believe.

It also gives you somewhere to record the suppliers who have no certificate at all, and what you decided to do about that instead — which is a legitimate answer, and a far better one than an empty row.

While you have the folder open

Two more things, because you will not open it again for a year.

Is it accredited?

An accredited certificate comes from a body assessed by a national accreditation body, and carries an accreditation symbol and a number you can resolve against a register. A non-accredited one comes from a body nobody has assessed. Both look like certificates, and the difference is what happens when somebody checks.

Item (g) covers this: the certificate must carry the certification body’s name, address and mark, and other marks such as an accreditation symbol “may be used provided they are not misleading or ambiguous”.

Is anything there at all for your most critical suppliers?

Most registers are complete for the suppliers who volunteered a certificate and thin for the ones who did not. The second group is worth listing before you start reading the certificates you do have.

The whole check, in order

1. Edition — ISO/IEC 27001:2022, or a withdrawn one?
2. Dates — current, and on a recertification cycle that is still running?
3. Scope — does it cover the service you actually buy, at the site it is delivered from?
4. Accreditation — is there a symbol, and does the issuing body appear on a register?
5. Any second standard named — control-set source, or a separate certification?

Five questions, most of them answerable from the document already in your folder. It is an hour once a year, and the calendar entry is better set against your own management review than against the dates printed on other people’s paperwork.

All notes · Cost calculator · ISO 27001 consultants