Menu
Auditors
Our picks by fit, each with a passed peer review
Every listed firm, filterable by price and timeline
Consultants
Readiness, pentest, vCISO, and ISO 27001 firms in one list
Software
Every platform we profile, with sourced prices and fit
Our picks by buyer fit, with the tradeoffs
Published prices, add-ons, and audit fees
Learn
Articles on cost, controls, timelines, and auditor choice
Free Tools
A few questions, then your best-fit auditors
Fit-ranked platforms with observed price bands
Certification bodies are the ISO 27001 auditors: they run Stage 1 and Stage 2 on your Information Security Management System and decide whether to certify it. Consultants build the system but cannot certify their own work. Each record shows legal entity, accreditation, scope, and source.
Every listed firm has current primary evidence that it can perform certification audits and issue ISO/IEC 27001 certificates. Search by firm, legal entity, accreditation authority, location, scope, or industry.
Selection and evidence key
Rows are listed alphabetically. Paid placement does not change eligibility or order.
Showing 34 certification bodies.
St. Petersburg, FL, USA
Tampa, FL, USA
Atlanta, GA, USA
Denver, CO, USA
Seattle, WA, USA
Atlanta, GA, USA
San Ramon, CA, USA
Chicago, IL, USA
Kansas City, MO, USA
London, UK
London, UK
Chicago, IL, USA
Oshawa, ON, Canada
El Dorado Hills, CA, USA
Fairfax, VA, USA
San Jose, CA, USA
London, UK
Durham, NC, USA
Palo Alto, CA, USA
Brentwood, UK
Dresher, PA, USA
Colorado Springs, CO, USA
Birmingham, UK
Calgary, AB, Canada
Dunstable, UK
Nashville, TN, USA
Toronto, ON, Canada
Tampa, FL, USA
Annapolis, MD, USA
San Jose, CA, USA
Ellesmere Port, UK
New York, NY, USA
Boxborough, MA, USA
Munich, Germany
No certification bodies match that search. Clear the field to restore the full verified list.
A record qualifies only when the firm’s own current material or an accreditor registry states that the named certification body can audit and issue ISO/IEC 27001 certification. The list draws on two sources: firms in our SOC 2 auditor directory that qualify as ISO/IEC 27001 certification bodies (25, checked between August 5, 2026 and November 5, 2026), and 9 independent certification bodies drawn from their accreditors’ records on IAF CertSearch (Bureau Veritas, Complade, DNV, Intertek, LRQA, NQA, SGS, TÜV Rheinland, and TÜV SÜD; checked between October 6, 2026 and October 19, 2026), each listed under the legal entity that issues the certificate. A consultancy, an unaffiliated referral partner, a lead-auditor credential, or an ISO certificate held by the firm does not qualify.
The directory publishes an accreditation authority or scope only when the primary record supports it; otherwise the row says “Not published” or “Not verified.” SOC 2 prices and timelines are deliberately absent because those fields describe a different engagement. Read the full directory methodology →
Separate the two roles before comparing proposals. The same brand group may offer both only through impartial legal entities and teams.
| Factor | ISO 27001 consultant | Certification body |
|---|---|---|
| Primary job | Design and prepare the ISMS | Audit the ISMS and decide certification |
| Typical work | Scope, risk assessment, SoA, policies, remediation | Stage 1, Stage 2, surveillance, recertification |
| Can issue the certificate? | No | Yes, inside accredited scope |
| Evidence to verify | Named practitioners and deliverables | Accreditor record, legal entity, standard and scope |
Shortlist by accredited scope and geography first, then compare sector experience, audit-day assumptions, transfer rules, and coordination with your independent consultant.
Match the proposal to the legal entity in the primary evidence. Confirm ISO/IEC 27001 is active in the accreditor record; a generic ISO badge, lead-auditor credential, or certificate held by the provider does not prove authority to certify you.
Ask which office and accreditation cover the engagement, whether remote audit methods fit the proposed scope, and whether the assigned audit team has experience with your industry, cloud architecture, and integrated management systems.
Require the quote to separate Stage 1, Stage 2, annual surveillance, travel, certificate administration, and year-three recertification. The lowest initial fee can be the higher lifecycle cost when surveillance or audit-day assumptions are omitted.
Keep implementation consulting outside the certification decision. Ask how the body handles complaints, appeals, certificate suspension, scope changes, and transfers if service quality or commercial terms change during the cycle.
The role, accreditation, audit-stage, independence, and verification questions to settle before signing a certification proposal.
Send the ISMS scope, locations, headcount, and certification deadline. We manually review the request before any certification body receives an anonymized brief.