Certification Body Selection Template (ISO/IEC 27001 and 27006-1)

Certification Body Selection: [Organization name]

Selection record for the certification body (CB) that will audit and certify the information security management system (ISMS) of [Organization name] against ISO/IEC 27001:2022 + Amd 1:2024. It covers the accreditation check, scope and sector coverage, auditor competence, how the CB sets audit time under ISO/IEC 27006-1:2024, the multi-site and remote audit approach, the cost of the full three-year cycle, transfer rules, the request for quotation (RFQ), a weighted scoring matrix and the final decision record. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal or procurement advice.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. Selection process
3. Requirements profile sent to bidders
4. Accreditation and recognition check
5. Scope coverage, impartiality and auditor competence
6. Audit time transparency
7. Multi-site approach
8. Remote and ICT-assisted audit policy
9. Cost of the full certification cycle
10. Transfer rules
11. Request for quotation questions
12. Scoring matrix
13. Decision record
14. Size tiers
15. Records and evidence
16. References

1. Purpose and scope

This document records how [Organization name] selected the certification body for its ISMS and why. It supports a single decision: which accredited CB will perform the Stage 1 and Stage 2 audits, the two surveillance audits and the recertification audit of the three-year cycle, and on what terms.

Out of scope for this document: implementation consulting, gap assessment (see compliance/iso-27001-gap-assessment) and the audit readiness work itself (see isms/stage-1-readiness-pack).

2. Selection process

The process has two hard gates and one weighted comparison. A bidder that fails a gate is excluded whatever its price.

3. Requirements profile sent to bidders

Send the same profile to every bidder so the quotes are comparable.

Worked example (Example: Quillmere Analytics Ltd): 46 persons in scope (38 employees and 8 contractors), one office plus remote staff in [n] countries, production on one public cloud provider in two regions, in-house development of one SaaS platform, processor of customer personal data, no other certifications, certificate needed within 6 months for two enterprise renewals.

4. Accreditation and recognition check

4.1 What changed in 2026

International recognition of accreditation bodies was run for many years by the International Accreditation Forum (IAF) through the IAF Multilateral Recognition Arrangement (MLA). From 1 January 2026 IAF and ILAC were brought together in Global Accreditation Cooperation Incorporated (Global ACI), and the IAF MLA was subsumed into the Global ACI Multilateral Recognition Arrangement (MRA). Existing accreditations stayed valid during the transition, and many contracts, tenders and regulations still say "IAF MLA". Treat an accreditation body that was an IAF MLA signatory for management system certification and is now a Global ACI MRA signatory as meeting the requirement, and check the current status on the Global ACI website before you rely on it. The IAF mandatory documents were re-issued by Global ACI (version 1.0 issued 10 July 2026, in force 28 August 2026) with new numbers, so this template cites both the IAF and the Global ACI number; check the current issue on global-aci.org. Legacy IAF MLA marks remain usable by accreditation bodies and accredited CBs during the mark transition set by accreditation bodies (check their notices for the end date); certified organizations generally may not use the IAF MLA or Global ACI MRA mark, only the CB's own mark under its rules (isms/certification-mark-usage).

4.2 Checks per bidder

Example result (Example): Bidder C offered a low fee but its accreditation schedule covered ISO 9001 only; its ISMS certificates were issued without accreditation. Bidder C fails gate 1 and is excluded, although section 12 shows its scores for illustration.

4.3 Red flags

• The CB offers to write your policies, run your risk assessment or "guarantee" a certificate. Accredited CBs must not consult on the system they certify, and no CB can promise the outcome of an audit.
• The certificate would carry only the CB's own mark and no accreditation mark, or an accreditation body you cannot find on the signatory list.
• Audit days far below the other quotes for the same profile, with no written calculation.
• The CB will not name or describe the auditors' competence before contract.

5. Scope coverage, impartiality and auditor competence

5.1 Impartiality (gate 2)

5.2 Competence and continuity

ISO/IEC 27006-1 sets competence requirements for ISMS auditors and for the people who make certification decisions. You cannot test those directly, but you can ask for evidence.

6. Audit time transparency

Ask each bidder for a written audit time calculation that shows:

1. the effective number of persons used, and how part-time staff, contractors and remote workers were counted;
2. each complexity factor applied (for example IT complexity, extent of outsourcing, development activity, regulatory environment, number of sites) and its effect;
3. the split between Stage 1, Stage 2, each surveillance audit and the recertification audit;
4. on-site, remote and off-site (report writing and planning) time;
5. any reduction or increase and its justification.

All day counts above are Example values to show the comparison format. They are not taken from any ISO/IEC 27006-1 table. Note that Bidder C counted 40 persons instead of 46 by leaving out contractors: a quote built on wrong data is not a saving, because the CB would correct it later.

7. Multi-site approach

Multi-site certification is governed by ISO/IEC 27006-1:2024 and IAF MD 1:2023 (audit and certification of a management system operated by a multi-site organization), now re-issued by Global ACI as Global ACI-TECH-3-001 (check the current issue). The CB decides whether sampling is possible after reviewing the organisation's structure.

Link the phased approach to isms/scope-extension-multisite-plan.

8. Remote and ICT-assisted audit policy

9. Cost of the full certification cycle

Worked example (Example: Quillmere Analytics Ltd, USD, figures for illustration only; use your local currency):

The selected Bidder B figures are the ones carried into the cycle budget in isms/certification-cycle-plan (DOC-ISMS-094) section 11.

Also ask about: fees for extra days to verify corrective actions, cancellation and rescheduling charges, fees for scope extensions, special audits, and certificate reissue.

10. Transfer rules

IAF MD 2:2023, now re-issued by Global ACI as Global ACI-TECH-3-002 (check the current issue), covers the transfer of accredited management system certification between accredited CBs. In outline, the receiving CB performs a pre-transfer review of the current certificate, the last audit reports, open nonconformities and complaints, and decides whether a visit is needed. Only valid, accredited certificates can be transferred.

11. Request for quotation questions

Accreditation and recognition

1. Provide your accreditation certificate and scope schedule for ISMS certification, and name the accreditation body.
2. Confirm that the accreditation body is a Global ACI MRA (formerly IAF MLA) signatory for management system certification.
3. Confirm that your accreditation covers ISO/IEC 27006-1:2024.
4. Confirm that our certificate will be listed in IAF CertSearch.

Audit approach

5. Provide your audit time calculation (section 6) with all assumptions.
6. Describe the Stage 1 approach: on site, remote or mixed, and what you expect to see.
7. State your expected interval between Stage 1 and Stage 2 and how you handle areas of concern found at Stage 1.
8. Describe your multi-site and sampling approach for our structure.
9. Describe your use of remote auditing under IAF MD 4:2025 (Global ACI-TECH-3-003) and the tools you use.
10. Describe how you would run an integrated audit with [other standards] under IAF MD 11:2023 (Global ACI-TECH-3-008), if requested.

Competence and continuity

11. Describe the proposed lead auditor's sector and technical experience.
12. Explain your auditor rotation policy across the three-year cycle.
13. State whether technical experts will join, and for which areas.
14. Confirm the audit languages available.

Commercial

15. Provide a full three-year cost breakdown (section 9 format).
16. List fees not included in the day rate.
17. State cancellation, rescheduling and extra-day terms.
18. State payment terms and price review rules over the cycle.

Process and service

19. Describe how you grade nonconformities and the deadlines you set for corrections and corrective actions.
20. State the typical time from Stage 2 closing meeting to certification decision and certificate issue.
21. Describe your complaints and appeals process.
22. Describe your rules for use of the certification mark and the accreditation mark (link isms/certification-mark-usage).
23. State how you protect the confidentiality of our evidence and how long you retain it.
24. Provide your transfer-in process if we come from another CB.

12. Scoring matrix

Weights (Example), agreed by the panel on YYYY-MM-DD before the quotes were opened:

Result (Example): Bidder B ranks first with 90.0. Bidder C has the lowest cost but fails gate 1 (section 4.2), so its score has no effect on the decision.

13. Decision record

Selecting a CB does not guarantee certification. The certification decision belongs to the CB after its audits.

14. Size tiers

15. Records and evidence

Register these records in DOC-ISMS-028 (documented information register) and map the CB contract in isms/control-evidence-matrix where it serves as evidence.

16. References

Related templates: compliance/ms-scope, compliance/iso-27001-gap-assessment, isms/stage-1-readiness-pack, isms/stage-2-audit-evidence-index, isms/certification-cycle-plan, isms/scope-extension-multisite-plan, isms/isms-budget-resource-plan, isms/certification-mark-usage, isms/certification-audit-explained, isms/control-evidence-matrix.

Standard and licence note

Structure aligned with the certification requirements in ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024 for ISO/IEC 27001:2022 + Amd 1:2024, and with the IAF mandatory documents MD 1, MD 2, MD 4, MD 11 and MD 29, of which MD 1, MD 2, MD 4 and MD 11 have been re-issued by Global ACI (Global ACI-TECH-3-001, -002, -003 and -008). The text, questions, scoring method and examples are original; no ISO/IEC or IAF text is reproduced, and audit-day and cost figures are illustrative. ISO and IEC standards are copyrighted: obtain the official standards from ISO (https://www.iso.org/standard/82875.html) or your national standards body. Check the current editions, the Global ACI documents and your certification body's rules before use. No certification body is named or recommended. This is a documentation format, not legal or procurement advice. Template licence: MIT.