How Do You Check What an ISO 27001 Certificate Actually Covers Before Trusting a Vendor?

Do not stop at the logo. Read the scope sentence on the certificate, confirm it names the legal entity, service, and locations you are buying from, check that it cites the 2022 edition and shows an active status, and ask for the current Statement of Applicability. A certificate is real evidence about a defined boundary, and the boundary is whatever the vendor chose to put around it.

When a security questionnaire comes back with "ISO 27001 certified," the answer feels settled. It usually is not, because the certificate does not certify a company. It certifies an information security management system (ISMS) whose boundaries the company set and an accredited certification body audited. A certificate can be entirely valid and still leave out the product, the support team, or the data center that handles your data.

This guide gives buyers, including MSSP clients and their procurement teams, a repeatable way to test what a certificate covers. It also explains what to put in a contract so the coverage you verified stays in place.

Where the boundary comes from

ISO/IEC 27001:2022 is edition 3, published in October 2022, and ISO's catalogue lists the 2013 edition as withdrawn. Under clause 4.3, the organization determines the boundaries and applicability of its ISMS. As one practitioner summary puts it, the clause asks the organization to consider its internal and external issues, the requirements of interested parties, and the interfaces and dependencies between its own activities and those performed by other organizations. Nothing in that approach requires the scope to cover the whole legal entity.

That flexibility is legitimate. A small business may certify a single service line first. A large provider may certify one delivery center. The problem arises only when a buyer assumes coverage that the scope sentence does not give.

A six-step check you can run in an afternoon

1. Confirm the certificate is real and current. Certificates from accredited certification bodies can be looked up in IAF CertSearch, which shows the validity and status of a certificate, the standard, the scope of certification, certified locations, the issuing certification body, and the accreditation body. Lookup requires the certified entity's name or certificate number, and records depend on what certification bodies have supplied, so also ask the vendor for the certificate itself and, if needed, confirm directly with the issuing body.
2. Check the edition. The transition from the 2013 edition to the 2022 edition ran 36 months from the end of the publication month, and under IAF's mandatory document all certifications based on ISO/IEC 27001:2013 expire or are withdrawn at the end of the transition period. With publication in October 2022, that period ended in October 2025. A certificate that still cites the 2013 edition, or cites no edition, deserves a direct question.
3. Read the scope sentence against what you buy. Look for the legal entity, the service or product, the sites, and any named exclusions. Compare each element to your order form. Ask, specifically, whether the support or operations team that will touch your data works at a certified site, whether the legal entity on the contract matches the certified entity, and whether the service you are buying is the one described.
4. Ask for the Statement of Applicability. The SoA lists the Annex A controls, whether each applies, and the justification for any that do not. The 2022 edition's Annex A has 93 controls. A provider may share the SoA under a nondisclosure agreement. If it declines to share even a summary, treat that as information. The IAF transition requirement also calls for the SoA to be updated as part of a transition audit, so ask which version of the SoA reflects the 2022 control set and when it was last updated.
5. Ask about dependencies outside the boundary. Cloud hosts, sub-processors, and outsourced support often sit outside the vendor's ISMS even when the vendor is certified. Ask which of them touch your data and how the vendor manages them through supplier controls.
6. Record the dates and re-check. Note the certification body's stated surveillance and recertification dates and set a reminder to verify status again before renewal. A certificate that was valid at signing can be suspended or withdrawn later.

Common mismatches to look for

• The certified entity is a parent or sister company, and the contracting entity is another.
• The scope names a platform or office, while your service is delivered by a different team or location.
• The scope sentence is broad ("information security for the organization"), but the SoA excludes controls that matter for your use case.
• The certificate and the vendor's marketing page describe different services.
• The certificate is valid, but the vendor cannot say which sub-processors fall inside the boundary.

None of these is proof of poor security. Each is a reason to ask a question before the answer goes into your risk register.

Put the coverage in the contract

Verification at signing is a snapshot. Ask the vendor to represent in writing that the services under your agreement are within the scope of its current certificate, to notify you if the scope narrows or the certificate is suspended or withdrawn, and to provide the new certificate after each recertification. If your provider handles security monitoring, pair these terms with the data and transition protections in our guide to MSSP exit clauses.

How ISO 27001 fits with other assurance

ISO 27001 and SOC 2 answer different questions. For the comparison, see SOC 2 Type II vs. ISO 27001, and for how to read an attestation report, see how to read an MSSP's SOC 2 report. The same scoping discipline applies to both: read the boundary first. When you are choosing a provider, add the certificate checks to your shortlist questions.

Where managed security fits

Supplier assurance reviews take time that many security teams do not have. Cyberuptive's virtual CISO service is one way to add experienced review capacity for vendor due diligence, including certificate scope checks and Statement of Applicability reviews. Your own risk owners still decide what coverage is acceptable for each supplier.

Frequently asked questions about ISO 27001 certificate scope

What does an ISO 27001 certificate actually certify?

It certifies that an accredited certification body found the organization's information security management system, within a defined scope, meets the requirements of ISO/IEC 27001. The organization defines the boundaries of that scope, so the certificate does not automatically cover the whole company or every service it sells.

Can a company be ISO 27001 certified but not cover the service I am buying?

Yes. The scope can cover a single service line, site, or business unit. Compare the scope sentence on the certificate with the legal entity, service, and delivery locations in your contract.

Is an ISO 27001:2013 certificate still valid?

No. Under IAF Mandatory Document MD 26, all certifications based on ISO/IEC 27001:2013 expire or are withdrawn at the end of the 36-month transition period, which ended in October 2025. A current certificate should cite the 2022 edition.

What is a Statement of Applicability and why should I ask for it?

It is the document listing each Annex A control, whether it applies, and the justification for any exclusion. It shows which controls the vendor decided not to apply, which the certificate alone does not.

How can I verify that a certificate is genuine?

Look it up in IAF CertSearch using the certified entity's name or certificate number, and confirm the status, standard, scope, and certification body. Because database coverage depends on certification bodies, you can also confirm with the issuing body directly.

What should an ISO 27001 clause in a vendor contract say?

That the contracted services are within the scope of the current certificate, that the vendor will notify you if the scope narrows or the certificate is suspended or withdrawn, and that it will provide the renewed certificate after recertification.