Read the scope before relying on the certificate
ISO/IEC 27001 sets requirements for an information security management system (ISMS). An independent certification body certifies a defined scope. A certificate held by one group company does not automatically cover every affiliate, product or cloud environment. ISO develops the standard but does not certify organizations itself.
When a buyer requests a certificate, ask: Do the named organization and activities correspond to the contracting entity and the service under review? Verifying a certificate number without reading its scope can still leave the buyer’s question unanswered.
| Check | What to look for | If it does not match |
|---|---|---|
| Organization | Certificate holder and any listed affiliates | How does this entity relate to the contracting and operating entity? |
| Certified scope | Described activities, products or services | Is the purchased product clearly included? |
| Sites and boundaries | Listed locations and ISMS scope information | Are the relevant team and data-processing locations included? |
| Current status | Validity, certification body and verification channel | Is the certificate current, and has the scope changed? |
A group-company scenario
This is a hypothetical example, not a client case: a China-based development company holds a certificate, a US subsidiary signs the customer contract, and another affiliate operates the cloud service. “The group is certified” is not enough to establish that the US service is within scope. Compare the certificate and scope documentation with the entities, service, sites and outsourced dependencies, then confirm what the buyer will accept.
The scope need not include every activity in a group. A narrower scope that accurately covers the buyer’s service may be more useful than an unsupported claim that the entire group is certified.
Three checks before sharing it with a buyer
- Obtain the certificate and scope statement. Compare them with the contract, product and actual service path.
- Check the certification body, current status and any scope changes using the verification information associated with the certificate.
- If wording is ambiguous, clarify it with the certification body or project specialist and explain the boundary to the buyer. Do not extend the certificate to an unlisted entity or service by implication.
If the buyer specifically requests an independent report on service controls, an ISO/IEC 27001 certificate may not replace SOC 2. Read the ISO/IEC 27001 preparation guide and the SOC 2 comparison before deciding the next step. For specialist support, review the scope and responsibilities in our ISO/IEC 27001 readiness service.