# Does an ISO/IEC 27001 certificate cover the service your buyer is purchasing?

> An ISO/IEC 27001 certificate attests to a defined management-system scope. Compare the named organization, activities and sites with the service your buyer is purchasing before treating it as relevant evidence.

Canonical page: https://assurelane.ai/en/insights/iso-27001-certificate-scope/
Updated: 2026-09-26 · Sources checked: 2026-09-26

## Read the scope before relying on the certificate

ISO/IEC 27001 sets requirements for an information security management system (ISMS). An independent certification body certifies a defined scope. A certificate held by one group company does not automatically cover every affiliate, product or cloud environment. ISO develops the standard but does not certify organizations itself.

When a buyer requests a certificate, ask: **Do the named organization and activities correspond to the contracting entity and the service under review?** Verifying a certificate number without reading its scope can still leave the buyer's question unanswered.

| Check | What to look for | If it does not match |
| --- | --- | --- |
| Organization | Certificate holder and any listed affiliates | How does this entity relate to the contracting and operating entity? |
| Certified scope | Described activities, products or services | Is the purchased product clearly included? |
| Sites and boundaries | Listed locations and ISMS scope information | Are the relevant team and data-processing locations included? |
| Current status | Validity, certification body and verification channel | Is the certificate current, and has the scope changed? |

## A group-company scenario

This is a hypothetical example, not a client case: a China-based development company holds a certificate, a US subsidiary signs the customer contract, and another affiliate operates the cloud service. “The group is certified” is not enough to establish that the US service is within scope. Compare the certificate and scope documentation with the entities, service, sites and outsourced dependencies, then confirm what the buyer will accept.

The scope need not include every activity in a group. A narrower scope that accurately covers the buyer's service may be more useful than an unsupported claim that the entire group is certified.

## Three checks before sharing it with a buyer

1. Obtain the certificate and scope statement. Compare them with the contract, product and actual service path.
2. Check the certification body, current status and any scope changes using the verification information associated with the certificate.
3. If wording is ambiguous, clarify it with the certification body or project specialist and explain the boundary to the buyer. Do not extend the certificate to an unlisted entity or service by implication.

If the buyer specifically requests an independent report on service controls, an ISO/IEC 27001 certificate may not replace SOC 2. Read the [ISO/IEC 27001 preparation guide](https://assurelane.ai/en/frameworks/iso-27001/) and the [SOC 2 comparison](https://assurelane.ai/en/insights/soc-2-or-iso-27001/) before deciding the next step. For specialist support, review the scope and responsibilities in our [ISO/IEC 27001 readiness service](https://assurelane.ai/en/services/iso-27001/).

## Sources

- [ISO — ISO/IEC 27001:2022](https://www.iso.org/standard/27001)
- [ISO — Certification](https://www.iso.org/certification.html)

---
General information only; not legal, audit or certification advice. AssureLane does not issue SOC 2 reports or ISO certificates.