ISO/IEC 27001 explained: what it guarantees your users

Two companies can display the same ISO/IEC 27001:2022 seal and be certified for very different things. One certificate may cover the entire platform it sells you, and the other only its administrative office. Both are valid. What separates them is the scope, a line in the document itself.

The joint IAF and ISO document on what can be expected from accredited certification starts precisely there. Its central formula begins with "For the defined certification scope". Everything the certificate assures is valid within that scope, and outside it, it assures nothing.

ISO/IEC 27001 certifies a management system, not a product

ISO/IEC 27001 is a requirements standard for an information security management system (ISMS). ISO describes it this way: "It defines requirements an ISMS must meet." Complying with it means that the organization has set up a system to manage risks to the data it has or handles. The current edition was published in October 2022, and in 2024 it received a one-page amendment that requires assessing whether climate change is a relevant issue for the system.

Clauses 4 to 10 are the requirements, and the auditing practices group of the committee that writes the standard (ISO/IEC JTC 1/SC 27) is explicit: none can be excluded. Annex A is a reference catalog of 93 controls that the organization compares against the ones it selected, to verify that it did not omit any necessary one. Compared with the 2013 edition, which had 114, the 2022 edition adds 11 new controls, merges 24, and updates 58, according to the IAF transition document.

The result of that comparison is the Statement of Applicability: the document where the organization lists which controls it needs, why, whether they are implemented, and why it excludes the Annex A controls that do not apply. A control is not mandatory just because it is in Annex A. The organization itself decides based on its risk assessment.

This separates it from ISO/IEC 30107-3, which is a testing standard: it defines how to measure the performance of a presentation attack detection mechanism, and excludes from its scope the security assessment of the full system. A test of that type, such as the one performed by the iBeta laboratory, measures a specific mechanism. ISO/IEC 27001 audits how an organization manages risk, and one result says nothing about the other.

What the certificate does guarantee your users

An accredited certificate guarantees to whoever receives it that, within the declared scope, the organization has policies and processes to meet the objectives of the standard, and that an independent third party audited it. The IAF and ISO document on expected outcomes frames it as confidence that the organization has a management system that meets the applicable requirements of the standard.

Among the outcomes that document lists, the ones most useful to a client are these:

• A system suited to the organization’s context and to the scope of certification.
• Risks and opportunities identified and treated according to that context.
• Internal audit and management review implemented and effective.

Added to this is continual improvement, which ISO includes in the very description of the standard: establishing, implementing, maintaining, and continually improving the system.

For users, the practical consequence is that the confidentiality, integrity, and availability of information are managed through a risk process that a third party reviews every year. The certification cycle lasts three years, with a two-stage initial audit, surveillance audits in the first and second year, and recertification in the third, before expiration.

What the certificate does not guarantee

An ISO/IEC 27001 certificate does not guarantee that the product is secure, nor does it cover anything outside its scope. The IAF and ISO document says so, in its section on what accredited certification does not mean: management system standards set requirements for the system, not specific performance criteria. A management system audit is also not a full legal compliance audit. And within its scope, certification does not imply that the organization offers a superior product, nor that its product or service is certified against a standard.

Read from the user’s side:

• The product. The fact that a provider has ISO/IEC 27001 says nothing about whether its biometric engine detects an attack. That is measured by a test such as ISO/IEC 30107-3.
• Incidents. IAF and ISO do not say it in those words, but it follows from the above: if the standard does not set a performance level, a valid certificate does not promise that there will be no breach. It promises that there is a system to manage that risk and respond.
• What remains outside the scope. A service, site, or process that the certificate does not name is not covered, even if it is provided by the same company.

A certificate issued to a large cloud provider, reissued in January 2026, states it in the document itself: it clarifies that due to the sample-based nature of the assessment, it expresses no guarantee regarding the performance of the certified organization.

The scope is the fine print that defines everything

The scope is the part of the certificate that says which activities, products, services, and sites it covers, and it is the part that carries the most weight. The checklist with which an accreditation body reviews certifiers, built on ISO/IEC 17021-1, requires the certificate to identify:

• The organization and the location of each included site.
• The grant and expiration dates.
• A unique identification code.
• The standard, with its edition.
• The scope, by product, service, or process at each site.
• The name of the certifier and, if applicable, the accreditation mark.

In ISO/IEC 27001, the Statement of Applicability is added. The guidance from the SC 27 auditing group indicates that certification documents must reference the version of the Statement of Applicability. That guidance cites the 2015 edition of the standard governing certifiers. The 2024 edition maintains a section on certification documents, although we could not read its text, and a certificate reissued in January 2026 still includes the date of its Statement of Applicability.

Among the examples of forged certificates given by IAF is one whose scope is presented as broader than it really is.

How to verify a certificate before trusting it

A certificate is verified by looking at the edition, who issued it, the public registry, and the scope. The edition comes first: since the last day of April 2024, initial certifications and recertifications are carried out only against ISO/IEC 27001:2022. The transition ended on October 31, 2025, and according to IAF MD 26 all certifications based on the 2013 edition "shall expire or be withdrawn". An accredited certificate that today says 2013 is not valid, even if the printed date is later.

Then, who issued it. ISO does not certify anyone, and the phrase "certified by ISO" is incorrect. It is issued by a certification body, and the additional trust comes from an accreditation body having confirmed its competence. Since January 1, 2026, IAF ceased operations and its role was assumed by Global Accreditation Cooperation (Global ACI); accreditations recognized under IAF remain valid during the transition.

The public registry helps, with one limit. IAF CertSearch allows the status of an accredited certificate to be confirmed, but it is not exhaustive. The document that regulates it acknowledges that a certifier may not upload data due to privacy laws or regulatory requirements, or may mark data as confidential, and the German accreditation body, DAkkS, clarified in November 2024 that it does not require its use. If a certificate does not appear, the certifier listed on it should be asked.

Finally, the scope, with specific questions: does it include the service provided to me?, does it cover the sites from which it is operated?, which version of the Statement of Applicability does it reference?, when was the last surveillance audit?

In the region, this reading falls on the buyer’s side. None of the standards we reviewed from the financial regulators of Brazil, Mexico, Colombia, and Argentina requires ISO/IEC 27001 by name. In Brazil, Resolução CMN 4.893 requires the institution to verify that its cloud provider adheres to the certifications that the institution itself requires, and to have access to that provider’s independent auditor reports. Which certificate to request and how to read it is the entity’s decision.

What VU does

VU has ISO/IEC 27001:2022 and ISO/IEC 27017:2015 certification. ISO/IEC 27017 is a control guide for cloud services, currently in its 2026 edition. It is not certified on its own: its controls are incorporated into the ISO/IEC 27001 management system through the Statement of Applicability. If you are evaluating an identity platform, request the scope and the Statement of Applicability as part of the evaluation. Learn about Verify, VU’s identity verification.

An ISO/IEC 27001 certificate is worth exactly what its scope says, and that is read, asked about, and verified.

If you are evaluating an identity provider and want to review what the certifications it shows you truly cover,
let’s talk.