ISO/IEC 27001 certification — how much is it really worth?

An ISO/IEC 27001 certification is one of the best-known pieces of evidence in information security. It can build trust, make tender processes easier and show customers that information security is managed systematically.

But a certificate alone does not automatically make a company secure. What matters is what was audited, who audited it and how the information security management system is lived day to day.

So what does an ISO/IEC 27001 certification actually say? Why does the accreditation of the certification body matter? And when is certification worth the effort at all?

What does an ISO/IEC 27001 certification confirm?

ISO/IEC 27001 is the internationally established standard for information security management systems, or ISMS for short. Certification confirms, through an independent certification body, that an organisation’s ISMS meets the requirements of the standard within a defined scope.

That is an important distinction. The certificate does not say: “This company is fully protected against cyber attacks.”

What it shows is: “This company has established a systematic management system with which information security risks are identified, assessed, treated and continuously monitored.”

That is where the real value of certification lies. ISO itself, incidentally, does not carry out certifications and does not issue ISO/IEC 27001 certificates. Audits are performed by independent certification bodies.

The first benefit: an independent outside view

Inside a company, people get used to existing processes. Everyone knows how something has “always” been done. Weaknesses may be accepted because they are familiar, and some assumptions go unquestioned for years.

An external audit brings a different perspective. Auditors check, among other things, whether requirements are implemented, whether processes work and whether the management system is genuinely lived.

In the process, deviations, weaknesses and improvement potential can become visible that had not been sufficiently examined internally.

The real benefit therefore does not lie only in the certificate at the end of the process. The path towards it can improve the organisation as well.

Certification creates attention at leadership level

Within companies, information security competes with many other topics for budget, resources and management attention. A planned certification often changes that perception.

Suddenly, questions have to be answered bindingly: Who is responsible for information security? Which risks do we accept? Which measures need to be prioritised? Which resources are required? And how do we measure whether our ISMS actually works?

This makes information security more of a leadership task. That is particularly valuable, because a functioning ISMS cannot be carried by IT or by a single information security officer alone. It needs support and decisions at management level.

Trust towards customers and partners

For customers it is difficult to fully assess a service provider’s information security themselves. Especially with cloud providers, IT service providers, software companies or other partners that process sensitive information or have access to important systems, an information problem arises: how can a customer judge whether a supplier organises information security professionally?

An ISO/IEC 27001 certification can provide a standardised answer. It shows that the ISMS has been audited by an independent body against an internationally recognised standard.

That can build trust and is an advantage particularly in international business relationships. ISO explicitly names certification as a way of showing stakeholders and customers that an organisation can manage information security systematically.

Fewer supplier audits — at least in part

Service providers know the situation: customer A sends a security questionnaire with 80 questions. Customer B has its own questionnaire with 150 questions. Customer C also wants to carry out an audit.

A recognised certification can reduce this effort. Some clients waive parts of their own assessment for certified suppliers or reduce its scope.

There is no guarantee, however. For particularly critical services in particular, customers will additionally want to know how their specific risks are treated. They then examine, for example, certain technical security measures, contractual terms, data protection requirements or business continuity processes.

An ISO/IEC 27001 certification therefore does not replace every supplier assessment. But it does create a common and recognised starting point. How supplier risks can be assessed in a structured way beyond that is shown in the article Transparent supplier security.

Certified is not the same as certified

When looking at a certificate, the ISO/IEC 27001 logo should not be the only point of interest. At least as important is the question: who issued the certificate?

This is where accreditation comes in. ISO clearly distinguishes between certification and accreditation: a certification body audits a company and, where appropriate, issues the certificate. An accreditation body in turn assesses the competence of the certification body.

Accreditation therefore provides an additional independent confirmation that the certification body works according to the relevant international requirements and has the necessary competence. At the same time, ISO explicitly points out that accreditation is not mandatory and that a non-accredited certification body is therefore not automatically disreputable.

The difference lies above all in the additional layer of trust.

What role does the Swiss Accreditation Service play?

In Switzerland, the Swiss Accreditation Service SAS is the national accreditation body. It is organisationally part of the State Secretariat for Economic Affairs SECO and assesses conformity assessment bodies on the basis of international requirements. For certification bodies auditing management systems, ISO/IEC 17021-1 in particular forms a central basis.

With accreditation, the SAS confirms the competence and reliability of a certification body. Companies can use the publicly accessible SAS database to check which certification bodies are accredited.

That creates transparency and makes it easier for companies and customers to put a certificate into context.

International recognition: what changed in 2026?

Until the end of 2025, discussions about the international recognition of accredited certifications frequently referred to the International Accreditation Forum (IAF) and its Multilateral Recognition Arrangement.

Since 1 January 2026 the international structure has changed. The former tasks of IAF and ILAC have been merged into the Global Accreditation Cooperation Incorporated — Global ACI. Global ACI now operates an international Multilateral Recognition Arrangement intended to support the mutual recognition of accredited conformity assessments.

At European level, the European co-operation for Accreditation (EA) continues to play a central role. National accreditation bodies within this system are regularly reviewed through peer evaluations. This is intended to create confidence that accreditations, and the certifications based on them, follow comparable requirements across the participating countries.

For internationally active companies this matters: accreditation should help ensure that certificates are recognised across borders and do not have to be fully reassessed again and again.

Do not look at the certificate alone

Even an accredited ISO/IEC 27001 certificate should not be filed away unchecked. Particularly important is the scope.

A company may have several sites, legal entities and services, while certification covers only part of them.

A hypothetical example: an IT service provider has ten services in its portfolio. Only the operation of one specific data centre is certified. A customer, however, uses a cloud application that lies outside this scope. The company does hold an ISO/IEC 27001 certificate — but its relevance for that specific customer relationship is clearly limited.

Anyone assessing a certificate should therefore always check:

• Is the certificate still valid?
• Does it refer to the current edition of the standard?
• Which legal entity or organisation is certified?
• Which sites and services does the scope cover?
• Is the specific service being purchased included?
• Which certification body issued the certificate?
• Is that body accredited for the relevant area?

Only then is it possible to judge what the certificate is actually worth for your own business relationship.

The path matters more than the certificate

Certification should not be the actual goal of an ISMS. In theory, a company can invest a great deal of energy in passing an audit and lose sight of the real purpose along the way. And that purpose is to keep information risks manageable over the long term.

On the way to certification, companies have to define their scope, assess risks, define responsibilities, implement security measures, carry out internal audits and have the ISMS reviewed regularly by management.

These processes create the real value. The certificate then confirms from the outside that this management system meets the requirements of the standard.

And after the certification audit?

Once certification is achieved, the work is not finished. An ISMS lives on continuous improvement.

New employees join. Systems are replaced. Companies introduce cloud services. Suppliers change. New vulnerabilities and attack methods emerge. Business models shift. With them, information security risks change too.

An effective ISMS has to absorb these developments continuously. Internal audits, management reviews, risk assessments and the tracking of improvement measures ensure that information security does not only work for the certification date.

The certificate is therefore not an end point. It is a milestone.

When is certification worthwhile?

Not every company necessarily needs an ISO/IEC 27001 certification. ISO/IEC 27001 can also be used as a best practice framework without subsequent external certification. ISO explicitly points out that organisations can decide for themselves whether to merely implement the standard or additionally pursue certification.

Certification can be particularly interesting when customers demand it, when it is required or rated positively in tenders, when the company processes sensitive data on behalf of third parties, when international customers expect recognised security evidence, when many individual supplier audits are to be reduced, or when the organisation needs independent evidence of its ISMS.

The decision should therefore not be: “Everyone has ISO 27001 these days — do we need it too?” But rather: “What concrete business and security benefit does certification bring us?”

Certification is not a security promise

An ISO/IEC 27001 certification is valuable. But only if its statement is understood correctly.

It does not guarantee that no cyber attack can succeed. Nor does it automatically confirm a uniform security level across all certified companies.

What it shows is that a company has established an information security management system according to internationally recognised requirements within the stated scope, and that this system has been audited by an independent body.

If the certification body is also accredited, an additional layer of independent confirmation of competence is added.

So when looking at a certificate, one question is always worth asking: what was certified — and by whom?

A certificate creates trust. A lived ISMS creates security.

Ultimately, the greatest value of ISO/IEC 27001 does not lie in the certificate on the wall. It lies in the structure behind it.

Risks are identified. Responsibilities are clarified. Measures are implemented. Results are reviewed. Improvements are tracked.

A good ISMS therefore also works between two audit dates. And that is exactly where it is decided whether certification is merely evidence — or an expression of a genuinely lived security culture.

The certificate confirms the process. Security emerges in daily action.