Not on its own. An ISO 27001 certificate proves that a certification body audited your management system for a stated scope and found it conforming. It does not prove the controls are strong. You decide what good enough looks like for each control, so a genuine certificate can sit alongside slow patching, unwatched logs and a restore nobody has timed.
This guide covers what a certificate proves, controls that pass without working well, how to check a certificate is real, ISAE 3402 and SOC 2, NIS2, and closing the gap.
| Question | Does the certificate answer it? | Where the answer is |
|---|---|---|
| Is there an audited management system? | Yes, sampled at audit and each surveillance | Certificate, audit reports |
| Is the service you buy covered? | Only if you read the scope | Scope statement on the certificate |
| Would an intrusion be noticed? | No | Detection coverage, tested alerts |
| How long do critical vulnerabilities stay open? | No | Remediation times from the scanner and tickets |
| Can the company restore in the time it promised? | No | A timed full restore |
| Is the certificate real and current? | Not by looking at it | IAF CertSearch, the certification body |
What does an ISO 27001 certificate actually prove?
Start with the fair part. A certificate is not theatre. It means a third party sampled your management system and found it operating. It opens doors, shortens security reviews, and often decides whether you are eligible for a contract. None of what follows is an argument against getting one.
It is an argument about what it measures. ISO/IEC 27001 is a management system standard. You assess risk (clause 6.1.2), decide on controls and record them in a Statement of Applicability (6.1.3), implement them, audit them (9.2), review them (9.3) and improve. Annex A lists 93 reference controls to compare your choices against.
The important word is decide. The standard does not tell you what good looks like for any control. It tells you to decide, document the decision, and show the control operates. That design makes the standard usable by a bank and a twelve-person software company alike. It is also where the gap lives.
A certificate runs for three years, with surveillance audits in years two and three. Each audit samples; none measures how secure you are.
Can a company be ISO 27001 certified and still insecure?
Yes. Take four operational controls from ISO/IEC 27001:2022 and ask what a minimum passing implementation looks like.
A.8.8, management of technical vulnerabilities. Vulnerability information is obtained, exposure evaluated and “appropriate measures” taken. The control sets no deadline; your own policy does. A monthly scan, a report and a procedure that says “remediate based on risk” usually survive a sample while critical findings stay open for months. The control asked for a process and got one.
A.8.15, logging. Logs are “produced, stored, protected and analysed”. The control does not say how often or how deeply, so a monthly review note can evidence the analysis. Whether anyone could say who logged in to the admin console last Tuesday, and from where, is not tested.
A.8.16, monitoring activities. Networks, systems and applications are monitored for anomalous behaviour, with action to evaluate potential incidents. This is the widest gap. A documented procedure, default alerts and a named owner can pass while nothing would raise an alert at two in the morning.
A.8.13, information backup. Backups are maintained and “regularly tested” in line with your own backup policy. Restoring a few files each quarter can satisfy it. Whether a full restore has been timed against the recovery objective you promised a customer is a question the control does not force.
None of this criticises auditors. A certification audit checks that the controls you declared operate as described, not whether your security is good.
What questions does a certificate not answer?
What a customer actually cares about, whatever the questionnaire asks:
- Would you notice? If someone was in your environment now, would anything tell you, and how long would it take?
- How long do known problems stay open? Not whether you scan, but your median time to fix a critical finding.
- Can you actually recover? Not whether backups run, but whether a restore has been timed end to end against the objective you promised.
- Can the account that left still get in? Not whether you have a leaver process, but whether it caught the tokens, the SaaS logins, the registrar and the billing portal.
A certificate can be entirely genuine while all four answers are bad. That is not a loophole. It is the scope of the instrument.
The gap widens over time. Certification rewards stability: the cheapest way to keep a certificate is to keep the system as described. Security rewards change, because the estate keeps moving. And a consultant engagement scoped to certification ends when the certificate is issued, often before the technical gaps are closed.
It often surfaces as a customer question: what is your mean time to detect? The certificate has no answer. Answering security questionnaires covers responding with evidence.
How do you check an ISO 27001 certificate is genuine?
In practice, the common problem is not a forged certificate but a genuine one covering something other than what you buy. Check both.
- Read the certificate. ISO/IEC 17021-1 (clause 8.2.2) requires it to identify the organisation and locations, the grant date, the expiry or recertification date, a unique code, the standard and edition, the scope, and the certification body’s name, address and mark.
- Check the edition and dates. It must say ISO/IEC 27001:2022. The transition from the 2013 edition ended on 31 October 2025.
- Look at the accreditation symbol. It shows the certification body is accredited, not the certified company. It should belong to a national accreditation body; in the EU each Member State appoints a single one (Regulation (EC) No 765/2008, Article 4(1)).
- Check the body is accredited for ISO/IEC 27001. Accreditation is per scheme: ISMS certification bodies are accredited against ISO/IEC 17021-1 with ISO/IEC 27006-1:2024, which replaced ISO/IEC 27006:2015. Accreditation for ISO 9001 alone does not cover it. Check the accreditation body’s register.
- Search IAF CertSearch. IAF CertSearch is the global database of accredited management system certificates, set up by the International Accreditation Forum. Global ACI, which replaced IAF and ILAC on 1 January 2026, still points to it. Since 26 October 2024, IAF MD 28 has required accredited certification bodies to upload each certificate’s number, standard, expiry date and status (active, suspended or withdrawn) at least monthly. A few checks are free.
- Ask the certification body. Under ISO/IEC 17021-1 (clause 8.1.2) it must, on request, give the status, standard, scope and location of a certified client. MD 28 allows some records to be confidential or excluded, so a missing record is a reason to ask, not proof of fraud.
- Read the scope against what you buy. “Development and operation of the platform” and “IT support at the head office” are very different certificates. ISO/IEC 27006 has the certificate refer to a specific version of the Statement of Applicability; in practice, ask for it under NDA. Scope and the Statement of Applicability explains what to look for.
What does a fake ISO 27001 certificate look like?
ISO issues no certificates and permits nobody to use its logo in connection with certification, so an ISO logo or “certified by ISO” is a red flag. So are a 2013 edition, a missing expiry date or number, and an accreditation mark from a body that is not a recognised national accreditation body. Accreditation is not compulsory, and ISO says an unaccredited body is not necessarily disreputable. But no accreditation body has checked its competence, and CertSearch will not list it.
ISO/IEC 27001 CERTIFICATE CHECK
Supplier: Date checked:
Certificate number:
Edition is ISO/IEC 27001:2022 [ ]
Issue date: Expiry date:
Certification body:
Accredited for ISO/IEC 27001 by:
National accreditation body, register checked [ ]
IAF CertSearch record found [ ]
Status: active / suspended / withdrawn
If not found, confirmed with certification body [ ]
Scope statement (copy word for word):
Service we buy is inside the scope [ ]
SoA version referenced: SoA received [ ]
Red flags: ISO logo / 2013 edition / no expiry /
no number / unknown accreditation mark
Recheck before: (expiry date or next surveillance)ISO 27001 vs ISAE 3402 and SOC 2: what is the difference?
An ISO 27001 certificate is pass or fail against a standard. It reports no individual control results.
ISAE 3402 is an IAASB assurance standard: an auditor reports on a service organisation’s controls relevant to its customers’ internal control over financial reporting. A type 1 report covers the design of controls at a date. A type 2 report adds operating effectiveness throughout a period, with the tests and their results.
SOC 2 is an AICPA report, issued by a CPA firm, on controls relevant to security, availability, processing integrity, confidentiality or privacy. A type 2 report comes closer to answering “did the controls work”, but only for the controls and period it describes. Neither report is a certificate.
Does an ISO 27001 certificate satisfy NIS2?
No, and there is no NIS2 certificate. Article 21 requires measures appropriate to the risk. Supervisors can ask for “evidence of implementation of cybersecurity policies, such as the results of security audits carried out by a qualified auditor” (Article 32(2)(g) for essential entities; Article 33(2)(f), ex post, for important entities). A certificate helps; after an incident, what the measures did matters more. ISO 27001 vs NIS2 shows where an ISMS covers the directive and where it falls short.
What does closing the gap look like?
Not more auditing. The audit is not the constraint.
Make the operational controls testable rather than reviewable. Restore a backup and time it. Pick a leaver at random and hunt for live credentials. Follow one scanner finding to closure with a date. Put those tests in the internal audit programme so they run on a schedule.
Attach a clock to findings, not just an owner. A vulnerability with an owner and no deadline is still a vulnerability. The number that matters is how long criticals stay open, and in our experience few smaller companies measure it.
Let the tooling produce the evidence. Detection, vulnerability management, cloud posture and backup verification generate records as a by-product. Run them and you get the evidence and the actual security, which is the point.
That is how the CloudSoul platform works: an automated platform with human-in-the-loop expertise, keeping controls and technical findings in one evidence record. A security audit tells you which gaps are documentation and which are technical before you spend on either. The certification programme is on the ISO 27001 page.
Get the certificate. It is worth having. Then answer the four questions separately, because the certificate does not.
ISO 27001 certificate checklist
- Confirm the scope covers the service or systems that matter.
- Check the certificate is to ISO/IEC 27001:2022 and in date.
- Confirm the certification body is accredited for ISO/IEC 27001.
- Find the certificate in IAF CertSearch, or confirm it with the certification body.
- Ask for the Statement of Applicability version the certificate refers to.
- For your own ISMS, time a full restore against your recovery objective.
- Measure how long critical vulnerabilities stay open, not just whether you scan.
- Pick a leaver at random each quarter and check for live access.
Sources
- ISO/IEC 27001:2022, clauses 6.1.2, 6.1.3, 9.2, 9.3 and Annex A controls 8.8, 8.13, 8.15, 8.16, ISO.
- ISO/IEC 17021-1:2015, clauses 8.1.2 and 8.2.2, ISO.
- ISO/IEC 27006-1:2024, ISO.
- ISO, Certification: ISO does not certify, logo use, accreditation, ISO.
- IAF MD 28:2023, Upload and Maintenance of Data on IAF Database, IAF.
- IAF CertSearch, database and FAQ.
- Global Accreditation Cooperation Incorporated launch, 1 January 2026, IAF.
- Regulation (EC) No 765/2008, Article 4, EUR-Lex.
- ISAE 3402, Assurance Reports on Controls at a Service Organization, IAASB.
- SOC 2, SOC for Service Organizations: Trust Services Criteria, AICPA.
- Directive (EU) 2022/2555 (NIS2), Articles 21, 32 and 33, EUR-Lex.
Frequently asked questions
Does ISO 27001 certification mean a company is secure?
Not on its own. It means a certification body audited the company's information security management system against ISO/IEC 27001 for a stated scope and found it conforming. The standard lets the company decide how strong each control is, so a genuine certificate can sit alongside slow patching, unwatched logs and untested recovery.
How do I check if an ISO 27001 certificate is genuine?
Look it up in IAF CertSearch, the global database of accredited management system certificates, and confirm it with the certification body named on it. Check that the body is accredited for ISO/IEC 27001, that the certificate is to the 2022 edition and in date, and that the scope covers the service you buy.
What are the warning signs of a fake ISO 27001 certificate?
An ISO logo or the words "certified by ISO", since ISO issues no certificates. Also a 2013 edition, a missing expiry date or certificate number, an accreditation mark from a body that is not a recognised national accreditation body, and a certificate that neither IAF CertSearch nor the certification body can confirm.
What is the difference between ISO 27001 and ISAE 3402 or SOC 2?
ISO 27001 certifies that a management system conforms to a standard. ISAE 3402 and SOC 2 are assurance reports on a service organisation's controls, and a type 2 report covers whether they operated effectively over a period. ISAE 3402 is aimed at customers' financial reporting; SOC 2 at security, availability, processing integrity, confidentiality or privacy.
Does an ISO 27001 certificate satisfy NIS2?
There is no NIS2 certificate. NIS2 requires risk-management measures appropriate to the risk, and authorities can ask for evidence of implementation such as security audit results. An ISO 27001 certificate is useful evidence but does not replace that assessment.
