To check a vendor's ISO 27001 certificate, confirm the legal entity, the certified scope, the dates and standard version, and the certification body. Then ask for the Statement of Applicability under NDA. A certificate with the wrong scope tells you nothing about the service you plan to use.
What the certificate says
An ISO/IEC 27001 certificate is issued by a certification body after an audit of an information security management system. It is not a product rating. It says a management system within a stated scope met the standard when audited. It does not say the vendor cannot be breached.
Five checks on the certificate itself
- Legal entity. Does the name match the company on your contract? Parent and subsidiary mismatches are common.
- Scope statement. Does it name the product, hosting and locations you use? Scopes can be narrow, for instance one office or one product line.
- Dates. Check issue and expiry. Certificates run on a cycle with surveillance audits in between, so ask when the last one happened.
- Standard version. Check which edition is named. If it is an older edition, ask about the transition plan and confirm the current status yourself.
- Certification body. Confirm the body exists and is accredited. Many bodies publish an online register where you can verify the certificate number.
I could not fetch a primary source for transition dates, so check the current position with the certification body or ISO before you rely on a particular deadline.
The Statement of Applicability
The Statement of Applicability (SoA) lists the controls from the standard's Annex A and says whether each applies, with a reason. Vendors often share it only under NDA.
When you read it:
- Look at excluded controls. Exclusions around access control, cryptography, logging or monitoring need an explanation.
- Check the version and date against what the certificate refers to.
- Compare "implemented" claims with what the questionnaire says. They should agree.
Ask for audit outcomes
Ask whether the last audit raised nonconformities and how they were closed. A vendor with a mature program usually answers calmly. You are not asking for the full report, only for a summary of findings and status.
What certification does not do
It does not test your specific use case, and an audit is a sample. Treat the certificate as one input beside your own review. A vendor with a good certificate and a poor answer on your key control still has a poor answer.
Record it
Store the certificate, scope, expiry and your notes in the vendor record, and set a reminder for a month before expiry. Safeguard's compliance and evidence automation can hold documents like these alongside your own evidence, if you want them in one place.
Quick check
Is an ISO 27001 certificate proof a vendor is secure?
No. It shows an audited management system within a stated scope. Check that the scope covers your service.
Why ask for the Statement of Applicability?
It shows which controls the vendor claims apply and which it excluded, which a certificate alone does not.
Last reviewed: 19 October 2026.
