Certification bodies audit your Information Security Management System and decide whether to issue the certificate; consultants build the system but cannot certify their own work. This directory includes only role-safe records with primary evidence of ISO 27001 certification authority, then exposes the legal entity, accreditation, scope, location, evidence date, and source buyers need to verify.
Every listed firm has current primary evidence that it can perform certification audits and issue ISO/IEC 27001 certificates. Search by firm, accreditation authority, location, scope, or industry.
Selection and evidence key
Rows follow the source dataset’s deterministic order. Paid placement does not change eligibility or order.
Showing 20 certification bodies.
St. Petersburg, FL, USA
Tampa, FL, USA
San Ramon, CA, USA
Kansas City, MO, USA
Chicago, IL, USA
San Jose, CA, USA
USA, USA
Dresher, PA, USA
Nashville, TN, USA
Tampa, FL, USA
Annapolis, MD, USA
Pleasanton, CA, USA
Atlanta, GA, USA
London, UK, UK
El Dorado Hills, CA, USA
Palo Alto, CA, USA
Calgary, AB, Canada
Toronto, ON, Canada
Denver, CO, USA
New York, NY, USA
No certification bodies match that search. Clear the field to restore the full verified list.
A record qualifies only when the firm’s own current material or an accreditor registry states that the named certification body can audit and issue ISO/IEC 27001 certification. We checked all 20 legacy candidates on August 5, 2026. A consultancy, an unaffiliated referral partner, a lead-auditor credential, or an ISO certificate held by the firm does not qualify.
The directory publishes an accreditation authority or scope only when the primary record supports it; otherwise the row says “Not published” or “Not verified.” SOC 2 prices and timelines are deliberately absent because those fields describe a different engagement. Paid placement cannot change eligibility, order, verification, or recommendation. Read the full directory methodology →
Separate the two roles before comparing proposals. The same brand group may offer both only through impartial legal entities and teams.
| Factor | ISO 27001 consultant | Certification body |
|---|---|---|
| Primary job | Design and prepare the ISMS | Audit the ISMS and decide certification |
| Typical work | Scope, risk assessment, SoA, policies, remediation | Stage 1, Stage 2, surveillance, recertification |
| Can issue the certificate? | No | Yes, inside accredited scope |
| Evidence to verify | Named practitioners and deliverables | Accreditor record, legal entity, standard and scope |
Shortlist by accredited scope and geography first, then compare sector experience, audit-day assumptions, transfer rules, and coordination with your independent consultant.
Match the proposal to the legal entity in the primary evidence. Confirm ISO/IEC 27001 is active in the accreditor record; a generic ISO badge, lead-auditor credential, or certificate held by the provider does not prove authority to certify you.
Ask which office and accreditation cover the engagement, whether remote audit methods fit the proposed scope, and whether the assigned audit team has experience with your industry, cloud architecture, and integrated management systems.
Require the quote to separate Stage 1, Stage 2, annual surveillance, travel, certificate administration, and year-three recertification. The lowest initial fee can be the higher lifecycle cost when surveillance or audit-day assumptions are omitted.
Keep implementation consulting outside the certification decision. Ask how the body handles complaints, appeals, certificate suspension, scope changes, and transfers if service quality or commercial terms change during the cycle.
The role, accreditation, audit-stage, independence, and verification questions to settle before signing a certification proposal.
Send the ISMS scope, locations, headcount, and certification deadline. We manually review the request before any certification body receives an anonymized brief.
Menu