ISO 27001 accreditation and ISO 27001 certification are not the same thing, although many people use the words as if they were. Your organisation gets certified. The body that audits you is accredited. This guide explains the difference and why it matters when you pick an auditor.
What ISO 27001 Certification Means
Certification is an independent audit confirming that your information security management system (ISMS) meets ISO 27001. A certification body carries out the audit in two stages. If you pass, you receive a certificate, usually valid for three years with annual surveillance audits.
Our guide to ISO 27001 ISMS certification walks through the stages.
What ISO 27001 Accreditation Means
ISO 27001 accreditation, in the strict sense, refers to the certification body itself being accredited by a national accreditation authority (JAS-ANZ in Australia) to issue ISO 27001 certificates. Most people searching "ISO 27001 accreditation" actually mean certification for their own organisation — the two terms get used interchangeably in everyday conversation, even though they describe different things.
Accreditation is formal recognition that a certification body is competent to carry out certification audits. In Australia and New Zealand, the accreditation body is JAS-ANZ.
So when someone talks about ISO 27001 accreditation, they are usually describing the auditor. Organisations are certified, not accredited.
Why the Difference Matters When You Choose an Auditor
Customers and tender panels often expect your certificate to come from an accredited certification body. A certificate from a body that is not accredited may not be accepted.
Before you book an audit, ask the certification body which accreditation body recognises it, and check that its accreditation covers ISO 27001.
A Different Meaning: RFFR Accreditation
Accreditation also appears in a different context. DEWR grants Right Fit For Risk accreditation to Providers that meet its IT security requirements. It is a decision by the department, and Category 1 Providers need an independently certified ISO 27001 ISMS to get there. Read more about Right Fit For Risk accreditation or our guide to DEWR RFFR accreditation.
What to Do Next
Decide your scope, run a gap assessment and fix the gaps before you book an audit. Our ISO 27001 service covers each step, and a ISO 27001:2022 gap assessment is a sensible first move.
Frequently Asked Questions
Is ISO 27001 accreditation the same as certification?
No. Certification is for organisations that pass an audit. Accreditation is for the certification bodies that carry out those audits.
Who accredits ISO 27001 auditors in Australia?
JAS-ANZ, the Joint Accreditation System of Australia and New Zealand, accredits certification bodies.
Can my organisation be ISO 27001 accredited?
Your organisation is certified. People often say accredited by mistake, but certification is the correct term.
How long is an ISO 27001 certificate valid?
Usually three years, with annual surveillance audits in between.
What does ISO 27001 accreditation mean for my business?
For most businesses, "ISO 27001 accreditation" means becoming ISO 27001 certified — having an accredited certification body audit and certify your information security management system. True accreditation applies to the certifying body, not to your organisation, but the search term is commonly used for both.