Free check
Check an ISO certificate
about.biz does not look the certificate up for you and gives no verdict on it. The terms of IAF CertSearch and of several certification bodies do not allow automated lookups. What you enter here stays in your browser.
What stands out
Nothing stands out from what you entered. Work through the steps below.
The check in four steps
01
Is the body accredited?
In the Netherlands the Raad voor Accreditatie (RvA) accredits. Look up the body, open the scope of its accreditation and see whether the standard is in it. A foreign body you check with the accreditation body of its country.
02
Look the certificate up at the source
Start with the register of the body that issued it. Then look in IAF CertSearch, the international database of accredited certificates. Not found does not automatically mean fake: then ask the body.
03
Does it fit what you buy?
A real certificate can be about something other than your service. Compare the name, the scope and the locations with your contract.
04
Is it still valid?
Look at the status in the register, not only at the date on paper: a suspended or withdrawn certificate can still look valid on paper.
Checklist
Tick what you checked. It goes into your record.
Check record
Your own record of this check, for your file.
- Date of the check
- not entered
- Standard and version
- ISO/IEC 27001
- Certification body
- not entered
- Certificate number
- not entered
- Certificate holder
- not entered
- Valid until
- not entered
- What stood out
- Nothing, based on what was entered.
- Sources consulted
- RvA: all accredited bodies · IAF CertSearch
- Not tickedThe body is accredited for this standard (scope of accreditation).
- Not tickedThe certificate shows as valid in the body's register, or the body confirmed it.
- Not tickedThe name on the certificate is exactly the legal entity you contract with.
- Not tickedThe scope covers the service you buy, and the locations it is delivered from.
- Not tickedThe version of the standard is current.
- Not tickedYou know which controls the supplier excluded in its Statement of Applicability, and why.
- Not tickedThere is no ISO logo on the certificate. ISO says organisations should not use the ISO logo to show their certification.
This record is your own. about.biz did not check this certificate and gives no verdict on it.
Next check: at the latest on the expiry date.
Why you check a certificate yourself
ISO itself issues no certificates. A certificate comes from a certification body, and what it is worth depends on three things: was that body itself checked, does the certificate really exist, and does it cover what you buy?
Accreditation is not compulsory. A certificate from a body that is not accredited is therefore not automatically fake, but nobody then checked how that body works. For a supplier that matters, treat such a certificate as a statement by the supplier, not as independent evidence.
Under the Dutch NIS2 law this counts double. The explanatory note to article 10 of the Cyberbeveiligingsbesluit names certification of suppliers as a way to test them. Then you need to know whether the certificate holds, and be able to show you checked it.
A certificate does not say everything either. It shows that an assessed information security management system works within the scope. For a critical supplier also ask for concrete things, such as the latest penetration test and the incident procedure.
Frequently asked questions
- How long is an ISO 27001 certificate valid?
- A certification cycle usually lasts three years, with surveillance audits in between. The expiry date is on the certificate; also check the status in the register.
- Why does about.biz not look the certificate up automatically?
- Because that is not allowed. IAF CertSearch and several certification bodies exclude automated lookups and reuse in their terms. So this page gives you the right place to do it yourself.
- I cannot find the certificate in IAF CertSearch. Is it fake?
- Not necessarily. A company can keep its name confidential, some bodies only submit totals, and certificates from bodies that are not accredited are never in it. Ask the body directly.
- What does about.biz do with a certificate in a passport?
- Our staff check it in the certification body's register and record where and when. When it expires, its label changes to “expired” by itself. We show a certificate as text, never as a logo.