Your certification journeyYour certification journey

Tell us about your organisation

You tell us about your organisation, information security management system, proposed certification scope, locations, people and Statement of Applicability.

We review this information to confirm that the scope is clear and that we have the competence, capacity and impartiality needed to take the work on. If anything is missing or unclear, we will ask for more information before proceeding.

Review, quotation and agreement

We determine the audit time required and whether the audit will be conducted remotely, on-site or through a combination of both.

You receive a clear quotation and certification agreement before audit activity begins. The quotation explains the audit time, fees and any applicable expenses.

Audits and reports are delivered in English. Using remote methods does not automatically reduce the audit time required.

Stage 1 — understand and plan

Stage 1 evaluates whether your ISMS is ready for the main certification audit.

We review your certification scope, documented arrangements, risk assessment and treatment process, Statement of Applicability, internal audit, management review and relevant operating conditions.

You receive a Stage 1 report identifying any areas of concern and whether you are ready to proceed to Stage 2. The findings also help us plan the Stage 2 audit.

If significant changes occur or the Stage 1 information is no longer reliable, some or all of Stage 1 may need to be repeated.

Stage 2 — see the system working

Stage 2 evaluates whether your ISMS is implemented, maintained and effective in practice.

The audit team interviews relevant people, reviews documented evidence, observes activities where appropriate and samples how your controls and processes operate.

Remote methods may be used where they provide reliable evidence. On-site activity is used where direct observation or access is needed.

Certification audits are based on sampling. They do not examine every transaction, system, record or security control.

Findings and corrective action

At the closing meeting, the audit team explains its conclusions and any findings. You then receive a written audit report.

If a nonconformity is identified, you have the opportunity to provide correction, cause analysis and corrective action.

Major nonconformities must be effectively addressed and verified before certification can be granted or renewed. For minor nonconformities, we may accept an appropriate correction and corrective-action plan before the certification decision and verify its effectiveness later.

The audit team makes a recommendation. It does not grant certification.

Independent review and decision

A competent reviewer examines the completed certification file. A separate authorised person who was not part of the audit team makes the certification decision.

The decision is based on the certification evidence. It is not influenced by sales targets, commercial pressure, payment status or the preference of the audit team.

If the decision is adverse, we will explain the reasons in writing and tell you how to appeal.

Receive your certificate

Following a positive decision, we issue your certificate and add its status and certified scope to our certification register.

An initial certification cycle lasts no more than three years. Certification remains valid only while the continuing certification requirements are met.

Certification confirms conformity on a sampling basis and at particular points in time. It is not a guarantee that a security incident, breach or other failure will never occur.

Keep your certification current

Surveillance audits take place throughout the certification cycle to confirm that your ISMS continues to operate effectively.

The first surveillance audit takes place no more than 12 months after the initial certification decision. Further surveillance takes place during the cycle.

Before your certificate expires, recertification evaluates the continued effectiveness of your ISMS and its performance across the certification cycle. A positive recertification decision begins the next cycle.

Significant changes, serious or persistent failures, missed required audits or misuse of certification may result in additional review, a special audit, suspension, reduction of scope or withdrawal.