ISO 27001 CERTIFICATION
Smith + Howard audits your information security management system (ISMS) and, when it meets the standard, issues an accredited ISO 27001 certificate. It's the proof enterprise customers and partners ask for.
Accredited by ANAB
Your certificate carries the accreditation procurement teams look for.
Recognized internationally
Accepted by customers and partners outside the U.S.
Clear from day one
Scope and price for all three years agreed up front.
Report you can act on
Plain-language findings, with the evidence behind each one.
Why organizations certify
A customer request is often what starts the conversation. The value of certification goes further.
Answer security reviews and RFPs with one accredited certificate instead of repeated questionnaires.
An independent auditor tests whether your controls operate as intended, not just whether they're written down.
ISO 27001 requires you to identify, treat, and regularly review information security risks, so your program evolves as your business does.
A certified ISMS gives you a strong foundation for privacy and security regulations and the security terms in customer contracts.
Why accreditation matters
An accredited certificate means an independent accreditation body has assessed the certification body itself: its auditors, its methods, and its impartiality. Smith + Howard is accredited by ANAB, the ANSI National Accreditation Board. Because ANAB is part of the International Accreditation Forum's recognition arrangement, the certificates we issue are recognized internationally, not just in the U.S.
ANAB regularly reviews our office and observes our audits to confirm we meet the international requirements for certification bodies.
Your customers can confirm your certificate’s status, scope, and expiry on IAF CertSearch, the International Accreditation Forum’s global database of accredited certificates, or by emailing us at [email protected].
Certification bodies may not design or implement the systems they certify. Certification decisions are made by people who didn’t perform your audit.
How certification works
Here’s what happens at each step, who’s involved, and what you receive.
For the full written walkthrough, download our ISO 27001 certification guide.
Stage 01
Stage 02 · readiness review
Stage 03 · certification audit
Stage 04
Stage 05 · years 2 and 3
Stage 06 · end of year 3
Before your certification audit
We can only certify an ISMS that's actually running. The more of this list you've finished before Stage 1, the smoother your audit and the shorter your list of findings.
Your side
Our side
Your certification body
We bring the discipline of a public accounting firm to ISO certification: a documented methodology, independent review of every decision, and reports written for the people who have to act on them.
Every engagement is led by a qualified ISO 27001 lead auditor, with senior leadership involved from scoping through the certification decision.
Plain-language findings tied to the specific clause or control, graded major or minor, with the evidence behind them. We note opportunities for improvement but never prescribe solutions.
One proposal covering the full cycle, built on an audit-time calculation we’ll explain line by line.
A consistent engagement team that knows your business, with auditors rotated when our impartiality rules require it.
Already certified?
You can transfer an accredited ISO 27001 certificate to us at any point in your cycle. Following the international rules for certificate transfers, we complete a pre-transfer review of your current certificate, your most recent audit reports, and the status of any open findings. If everything is in order, we pick up your cycle where it stands and issue your certificate under our accreditation at your next surveillance or recertification audit.
You're eligible to transfer if:
Who we certify
We certify organizations across regulated and data-intensive industries, including:
Answer enterprise security reviews with a certificate procurement teams already recognize.
Show a systematic approach to protecting patient and research data alongside your HIPAA obligations.
Give agencies and prime contractors independent evidence of a mature security management system.
Support bank vendor due diligence and build a foundation for operational-resilience requirements such as DORA.
Meet the security and integrity expectations of regulators and operators, including lotteries working to the WLA Security Control Standard, which builds on ISO 27001.
Protect client-confidential information and qualify for work that requires certified suppliers.
Secure the operational and supply-chain data your customers depend on.
Meet the practice leader
Principal and ISO Leader, Cyber Risk Management + Compliance
Tulsi leads Smith + Howard's ISO/IEC 27001 certification practice, directing audit teams for clients across regulated and data-intensive industries through Stage 1 readiness, Stage 2 certification, and the full three-year surveillance cycle. He translates the requirements of the standard into plain language, so teams understand what conformity looks like well before the audit begins.
FAQ
Straight answers on timing, cost, findings, transitions, and what an accredited certification body can and cannot do.
It depends on your scope and how mature your ISMS is. If your ISMS is already operating, with an internal audit and management review completed, organizations typically move from Stage 1 to certificate in a few months. If you’re still building your ISMS, most organizations spend six to twelve months on implementation before they’re ready for Stage 1.
Fees are driven by audit time, which the accreditation rules tie to the number of people working within your scope, the number of sites, and the complexity of your environment. Our proposal covers the full three-year cycle, including initial certification, both surveillance audits, and recertification, so you can budget with confidence.
Stage 1 confirms that your ISMS is designed and documented to the standard and that you’re ready for Stage 2. Stage 2 tests whether it actually operates as designed, through interviews, evidence review, sampling, and observation. The certificate follows a successful Stage 2.
A finding isn’t an automatic failure. A minor nonconformity needs an accepted corrective action plan. A major nonconformity must be corrected, and we must verify the correction, before certification can be granted. We discuss findings as we go, so nothing in the final report comes as a surprise.
Yes. We can conduct all or part of an audit remotely when it’s effective to do so. Depending on your scope, such as the inclusion of data centers or physical security controls, some on-site verification may be required. We confirm the approach with you during scoping.
The transition period to ISO/IEC 27001:2022 ended on October 31, 2025, and certificates issued against the 2013 version are no longer valid. If your certificate lapsed, contact us, and we’ll outline the quickest route back to accredited certification.
A 2024 amendment to ISO 27001 requires you to determine whether climate change is a relevant issue for your ISMS, and notes that your stakeholders may have climate-related requirements. It doesn’t require a climate program, but we’ll ask how you considered it.
ISO 27001 certifies that your ISMS conforms to an international standard; the result is a certificate you can share publicly. SOC 2 is an attestation report issued under AICPA standards and typically shared under NDA. ISO 27001 is recognized globally; SOC 2 is most common with U.S. buyers. Many organizations benefit from both.
Recertification must be completed and decided before your certificate expires. If it does expire, certification can be restored within six months, provided the outstanding recertification activities are completed; after that, at least a Stage 2 audit is required. We schedule recertification early to avoid this.
ISO’s logo can’t be used to indicate certification, and the ANAB symbol has strict usage rules. Once certified, you can use the Smith + Howard certification mark according to our guidelines. For example, you can use it on your website and in proposals, but never on products or in a way that implies a product is certified.
Get started
Share your scope, timeline, and any customer deadlines. We'll reply promptly with next steps and a proposal timeline.
Or call 404-874-6244
Email [email protected]
Opens an email to our certification team.
Resources
Smith + Howard PC is accredited by the ANSI National Accreditation Board (ANAB) as a management systems certification body (ANAB certificate MS-2666). ISO is a registered trademark of the International Organization for Standardization; Smith + Howard is not affiliated with ISO.
ANAB: ANSI National Accreditation Board. ISMS: Information Security Management System. Our certification activities are conducted in accordance with ISO/IEC 17021-1 and ISO/IEC 27006. ISO/IEC 27001 certification is a certification of an information security management system — not an attest service, and not a certification of any product, service, or process — and it applies only to the scope stated on the certificate. To safeguard impartiality, the accreditation rules prohibit us from designing or implementing the management systems we certify; our audit teams may identify opportunities for improvement but do not recommend specific solutions. Certification does not by itself establish compliance with any law or regulation. Clients may appeal a certification decision, and any individual or organization may submit a complaint; both are handled by personnel who were not involved in the audit or the decision under review.
Subscribe to our newsletters to get inside access to timely news, trends and insights from Smith + Howard.
