Certification Body (CB)
Definition
An independent third-party organisation accredited to audit and certify that an ISMS conforms to ISO 27001. Examples include BSI, Bureau Veritas, DNV, and SGS. The CB issues the certificate and conducts all cycle audits.
- Full form
- Certification body
- Function
- Independent audit and certification of an ISMS
- Standard
- ISO/IEC 27001
- Examples
- BSI, Bureau Veritas, DNV, SGS
- Issues
- Certificate and conducts surveillance audits
Common questions
Is a certification body the same as an accreditation body?+
No, an accreditation body such as UKAS or NABCB oversees and approves certification bodies to ensure they audit competently. The certification body then audits individual organisations and issues the ISO 27001 certificate directly.
What happens after a certification body issues an ISO 27001 certificate?+
The certificate is not a one-time event. The CB conducts periodic surveillance audits, typically annually, and a full recertification audit at the end of the certification cycle to confirm the ISMS remains conformant.
Related terms
- Accreditation Body (AB)
- A national body that assesses and formally recognises the competence of certification bodies. Notable examples: UKAS (UK), DAkkS (Germany), COFRAC (France), NABCB...
- Major Nonconformity
- A finding that indicates the ISMS is absent in a required area or has failed systemically. Must be resolved with verified evidence...
- Minor Nonconformity
- A single lapse or gap that does not indicate systemic failure. The organisation must provide a corrective action plan and close the...
- Stage 1 Audit
- The documentation review phase of the initial certification audit. The auditor checks that the ISMS documentation exists, the scope is defined, the...
- Stage 2 Audit
- The on-site certification audit. The auditor tests whether controls described in the documentation are implemented and operating effectively. A Stage 2 pass...