Independent ISO Certifications
Whether you’re establishing a security program or expanding privacy controls, our team delivers clear, actionable reports that reflect the rigor of ISO/IEC frameworks — and the realities of your business.
ISO/IEC 27001
ISO/IEC 27017 & 27018 Extensions
ISO/IEC 27701
Looking to integrate privacy into your ISMS?
ISO/IEC 27035 & ISO/IEC 27036
Strengthen incident response and third-party governance with independent validation against ISO/IEC 27035 and ISO/IEC 27036 — extensions that go deeper than ISO/IEC 27001 alone. This assessment:
Evaluates incident handling roles, escalation paths, and post-incident learning controls
Validates supplier onboarding, monitoring, and offboarding governance across complex ecosystems
Provides objective evidence that incident and third-party risk controls meet expanded ISO expectations
Ready to validate your extended control posture?
ISO/IEC 42001
Support ethical, transparent, and secure artificial intelligence with ISO/IEC 42001 — the first international framework for AI management systems. This assessment:
Frequently Asked Questions
What is the difference between ISO 27017 and ISO 27018?
ISO 27017 provides guidance on security controls specific to cloud service providers and cloud customers — addressing how responsibilities are shared between the two parties in a cloud environment. ISO 27018 focuses specifically on the protection of personally identifiable information (PII) in public cloud services, establishing controls for how cloud providers handle personal data on behalf of their customers. The two standards are complementary: 27017 addresses cloud security broadly, while 27018 addresses the privacy dimensions of cloud data processing. Organizations that handle customer PII in cloud infrastructure often pursue both.
Do ISO 27017 and 27018 require ISO 27001 first?
ISO 27017 and 27018 are designed as extensions of ISO 27001 — they build on the foundational ISMS structure rather than replacing it. Most organizations pursue ISO 27001 certification first and then extend their scope to include 27017 and/or 27018. In practice, the additional controls required for the extensions can often be incorporated into the same audit cycle, reducing the overall time and effort involved.
What does ISO 27035 cover and who needs it?
ISO 27035 addresses information security incident management — covering how organizations plan for, detect, report, assess, respond to, and learn from security incidents. It goes deeper than the incident management controls embedded in ISO 27001, providing a structured framework for organizations that want objective validation of their incident response capability. It is particularly relevant for organizations in regulated industries, those handling high-value data, and technology providers whose customers expect documented incident handling processes.
What does ISO 27036 address?
ISO 27036 addresses information security in supplier relationships — covering how organizations govern third-party risk across the full supplier lifecycle, from onboarding and contracting through ongoing monitoring and offboarding. As supply chain security requirements increase across frameworks and regulations, ISO 27036 provides a structured basis for demonstrating that third-party risk controls are designed and operating effectively. It is relevant for organizations with complex vendor ecosystems or those subject to supply chain security requirements from customers or regulators.
Who should consider ISO 42001 certification?
ISO 42001 is relevant for any organization that develops, deploys, or uses AI systems in a material way — including technology companies building AI-powered products, enterprises integrating AI into operations, and service providers offering AI-driven services to regulated-industry clients. As AI governance requirements emerge from regulators in the EU, UK, and other jurisdictions, ISO 42001 provides a structured, internationally recognized basis for demonstrating responsible AI management. Organizations that already hold ISO 27001 certification will find meaningful control overlap with 42001.
How does ISO 42001 relate to the EU AI Act?
ISO 42001 and the EU AI Act address overlapping concerns around AI governance, risk management, and transparency — but they are distinct instruments. The EU AI Act is a legal regulation with binding requirements for organizations deploying AI in the EU, particularly for high-risk AI systems. ISO 42001 is a voluntary international standard providing a management system framework for responsible AI. Implementing ISO 42001 can support compliance with AI Act requirements, but certification under the standard does not substitute for regulatory compliance. Organizations subject to the AI Act should assess both independently.
What is the initial ISO certification audit process?
An initial ISO certification follows a two-stage audit process. Stage 1 is a documentation review — the auditor evaluates whether the organization’s ISMS documentation, policies, and management system design meet the requirements of the relevant standard. Stage 2 is the certification audit — the auditor assesses whether controls are actually implemented and operating effectively across the organization’s scope. Successful completion of both stages results in certification, which is valid for three years. Annual surveillance audits in years one and two confirm the management system remains effective, and a recertification audit is required at the end of the three-year cycle.
What is the scope of an ISO 27001 certification?
Scope defines which parts of the organization, which systems, and which locations are covered by the ISMS and included in the certification. Scope is determined by the organization and documented in the ISMS before the audit begins. A narrowly defined scope reduces the volume of evidence required but may limit the commercial value of the certificate if customers expect broader coverage. Scope decisions should reflect both information security objectives and what customers or regulators are likely to scrutinize.
What happens after ISO 27001 certification is granted?
ISO 27001 certification is valid for three years from the date of issue, subject to annual surveillance audits conducted at approximately 12-month intervals. Surveillance audits are narrower than the initial certification audit — they verify that the ISMS is being maintained, that corrective actions from prior audits have been addressed, and that no significant changes have occurred that would affect the scope or effectiveness of the management system. At the end of the three-year cycle, a full recertification audit is required to renew the certificate.
Why Choose Insight Assurance?
We use our deep expertise to help teams across industries navigate ISO/IEC assessments with clarity, confidence, and client satisfaction.
What sets us apart?
Proven Experience
Global Coverage
Smarter Audit Workflows
Hands-On Engagement
Insights You Can Act On
Retention Rate
Retention rate remains at 97%