# Certification Body Selection: [Organization name]

> Selection record for the certification body (CB) that will audit and
> certify the information security management system (ISMS) of
> [Organization name] against ISO/IEC 27001:2022 + Amd 1:2024. It covers
> the accreditation check, scope and sector coverage, auditor competence,
> how the CB sets audit time under ISO/IEC 27006-1:2024, the multi-site
> and remote audit approach, the cost of the full three-year cycle,
> transfer rules, the request for quotation (RFQ), a weighted scoring
> matrix and the final decision record. Replace every `[bracketed]` value
> and every row marked *Example*. This is a documentation format, not
> legal or procurement advice.

<!--
Guidance: How to use this template
- When to use: three to six months before the planned Stage 1 audit, once
  the ISMS scope (`compliance/ms-scope`) is stable enough to describe in
  an RFQ. Re-use it at each recertification or when you consider a
  transfer to another CB.
- Fill first: section 3 (requirements profile). Every quote you receive is
  only as good as the scope, headcount and site data you send. A CB that
  receives incomplete data quotes too few days and adds days later.
- Main pitfall: choosing on day rate alone. The cheapest quote is often
  the one with the fewest audit days, an accreditation that does not cover
  ISO/IEC 27001, or a certificate your customers will not accept.
- Never ask the CB for consulting. An accredited CB must not design or
  implement your ISMS; asking for it is a warning sign if they agree.
- Related templates: `isms/stage-1-readiness-pack`,
  `isms/certification-cycle-plan`, `isms/scope-extension-multisite-plan`,
  `isms/isms-budget-resource-plan`, `isms/certification-mark-usage`,
  `isms/certification-audit-explained`, `compliance/ms-scope`.
-->

## Document control

<!-- Guidance: Treat this as a procurement and governance record. Auditors rarely ask for it, but top management, procurement and the next recertification team will. Keep the signed decision in section 13. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-090 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@ciso], [@cfo], [@procurement-lead], [@ceo] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal / Confidential (contains commercial quotes)] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024; CB requirements ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024 |
| ISMS scope reference | DOC-ISMS-002 (ISMS scope), version [n] |
| Target Stage 1 window | [YYYY-MM-DD to YYYY-MM-DD] |
| Bidders invited | [n] |
| Selected CB | [CB legal name], accreditation [accreditation body, certificate number] |
| Next scheduled review | [Before recertification RFQ, YYYY-MM-DD] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS manager (prepared) | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Finance | [@cfo] | [Budget confirmed] | YYYY-MM-DD |
| Top management | [@ceo] | [Approved / Rejected] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 *(Example)* | YYYY-MM-DD | [@isms-manager] | Requirements profile and RFQ issued to three bidders |
| 1.0 *(Example)* | YYYY-MM-DD | [@isms-manager] | Scoring completed, Bidder B selected, approved by top management |

## Contents

1. Purpose and scope
2. Selection process
3. Requirements profile sent to bidders
4. Accreditation and recognition check
5. Scope coverage, impartiality and auditor competence
6. Audit time transparency
7. Multi-site approach
8. Remote and ICT-assisted audit policy
9. Cost of the full certification cycle
10. Transfer rules
11. Request for quotation questions
12. Scoring matrix
13. Decision record
14. Size tiers
15. Records and evidence
16. References

## 1. Purpose and scope

<!-- Guidance: Say what decision this document supports and which certificate it leads to. Questions to answer: which standard(s), which scope, single or integrated audit, first certification or transfer? Pitfall: selecting a CB before the scope is settled, then paying for a scope change before Stage 1. -->

This document records how [Organization name] selected the certification
body for its ISMS and why. It supports a single decision: which accredited
CB will perform the Stage 1 and Stage 2 audits, the two surveillance audits
and the recertification audit of the three-year cycle, and on what terms.

| Item | Value |
|---|---|
| Certification sought | ISO/IEC 27001:2022 + Amd 1:2024 [and, if integrated: ISO 9001, ISO 22301, ISO/IEC 27701:2025, ISO/IEC 42001:2023] |
| Type | [Initial certification / Transfer from another CB / Recertification tender] |
| Scope statement (draft) | [Copy from DOC-ISMS-002] |
| Legal entities | [list] |
| Sites and cloud regions | [list, or "see section 3"] |
| Decision needed by | YYYY-MM-DD |

Out of scope for this document: implementation consulting, gap
assessment (see `compliance/iso-27001-gap-assessment`) and the audit
readiness work itself (see `isms/stage-1-readiness-pack`).

## 2. Selection process

<!-- Guidance: Show the steps so a reviewer can see that the decision was structured and fair. Keep the gates (accreditation, impartiality) as pass or fail, not as weighted scores, so a low price cannot buy back a failed gate. -->

The process has two hard gates and one weighted comparison. A bidder that
fails a gate is excluded whatever its price.

```mermaid
flowchart TD
  A["Requirements profile (section 3)"] --> B["Long list of candidate CBs"]
  B --> C{"Gate 1: accredited for ISO/IEC 27001 by a recognised AB?"}
  C -- "No" --> X["Exclude and record reason"]
  C -- "Yes" --> D{"Gate 2: no impartiality conflict?"}
  D -- "No" --> X
  D -- "Yes" --> E["Issue RFQ (section 11)"]
  E --> F["Receive quotes and audit time calculations"]
  F --> G["Clarification call with each bidder"]
  G --> H["Weighted scoring (section 12)"]
  H --> I["Decision record and approval (section 13)"]
  I --> J["Sign contract and agree Stage 1 dates"]
```

| Step | Owner | Output | Example duration |
|---|---|---|---|
| Requirements profile | [@isms-manager] | Section 3 complete | *Example:* 1 week |
| Long list and gate checks | [@isms-manager] | Sections 4 and 5 | *Example:* 1 week |
| RFQ and responses | [@procurement-lead] | Quotes, audit time calculations | *Example:* 3 weeks |
| Clarification calls | [@isms-manager], [@ciso] | Call notes per bidder | *Example:* 1 week |
| Scoring and decision | Evaluation panel | Sections 12 and 13 | *Example:* 1 week |

## 3. Requirements profile sent to bidders

<!-- Guidance: This is the data a CB needs to calculate audit time under ISO/IEC 27006-1. Questions to answer: how many persons do work under the organization's control within scope (including contractors and part-time staff), how many sites, which complexity factors apply? Pitfall: sending the employee count only and leaving out contractors, shifts or remote staff. Auditors re-check headcount at Stage 1 and can change the audit time. -->

Send the same profile to every bidder so the quotes are comparable.

| Field | Value | Source |
|---|---|---|
| Organization and legal entities | [names] | Company register |
| Draft ISMS scope statement | [text] | DOC-ISMS-002 |
| Persons doing work under the organization's control in scope | [n employees + n contractors, full-time equivalent if part-time] | HR system, supplier register |
| Shift or seasonal work | [Yes / No, details] | HR |
| Sites in scope (physical) | [n, with address, activity and headcount per site] | DOC-ISMS-002 |
| Remote workers | [n, countries] | HR |
| Cloud and hosting | [providers, regions, service models] | `isms/cloud-services-security-policy` |
| Sector and regulated activities | [e.g. health data, financial services, OT] | DOC-ISMS-014 legal register |
| IT complexity indicators | [n of business applications, in-house development Yes/No, outsourced IT Yes/No] | Asset inventory DOC-ISMS-012 |
| Other certifications held | [ISO 9001, ISO 22301, SOC 2 report, with CB names kept internal] | Certificates |
| Integrated audit wanted | [Yes / No, with which standards] | Management decision |
| Audit languages | [languages for interviews and reports] | HR |
| Target dates | Stage 1 [month], Stage 2 [month], certificate needed by [date] | DOC-ISMS-030 roadmap |
| Customer requirements | [e.g. customers require an accredited certificate within 12 months] | Contracts |

**Worked example** *(Example: Quillmere Analytics Ltd)*: 46 persons in
scope (38 employees and 8 contractors), one office plus remote staff in
[n] countries, production on one public cloud provider in two regions,
in-house development of one SaaS platform, processor of customer personal
data, no other certifications, certificate needed within 6 months for two
enterprise renewals.

## 4. Accreditation and recognition check

<!-- Guidance: Accreditation is the first gate. Questions to answer: is the CB accredited for ISO/IEC 27001 (not only ISO 9001) by an accreditation body that is a signatory of the international recognition arrangement, and does that accreditation cover the countries and sector you need? Pitfall: "accredited" logos from bodies that are not recognised, or a certificate that customers and regulators reject. Auditor check: the certificate you receive will show the accreditation body; procurement teams at your customers will look it up. -->

### 4.1 What changed in 2026

International recognition of accreditation bodies was run for many years
by the International Accreditation Forum (IAF) through the IAF
Multilateral Recognition Arrangement (MLA). From 1 January 2026 IAF and
ILAC were brought together in Global Accreditation Cooperation
Incorporated (Global ACI), and the IAF MLA was subsumed into the Global ACI
Multilateral Recognition Arrangement (MRA). Existing accreditations stayed
valid during the transition, and many contracts, tenders and regulations
still say "IAF MLA". Treat an accreditation body that was an IAF MLA
signatory for management system certification and is now a Global ACI MRA
signatory as meeting the requirement, and check the current status on the
Global ACI website before you rely on it. The IAF mandatory documents
were re-issued by Global ACI (version 1.0 issued 10 July 2026, in force
28 August 2026) with new numbers, so this template cites both the IAF and
the Global ACI number; check the current issue on global-aci.org. Legacy
IAF MLA marks remain usable by accreditation bodies and accredited CBs
during the mark transition set by accreditation bodies (check their
notices for the end date); certified organizations generally may not use
the IAF MLA or Global ACI MRA mark, only the CB's own mark under its
rules (`isms/certification-mark-usage`).

### 4.2 Checks per bidder

| # | Check | How to verify | Bidder A | Bidder B | Bidder C |
|---|---|---|---|---|---|
| 4.2.1 | CB holds a valid accreditation for ISMS certification (ISO/IEC 27001) against ISO/IEC 17021-1 and ISO/IEC 27006-1 | Accreditation certificate and scope schedule published by the accreditation body | [Pass / Fail] | [Pass / Fail] | [Pass / Fail] |
| 4.2.2 | Accreditation body is a recognised signatory (Global ACI MRA, formerly IAF MLA) for management system certification | Signatory list on the Global ACI website | [Pass / Fail] | [Pass / Fail] | [Pass / Fail] |
| 4.2.3 | Accreditation scope covers your sector or technical area | Scope schedule of the accreditation | [Pass / Fail] | [Pass / Fail] | [Pass / Fail] |
| 4.2.4 | CB is accredited against ISO/IEC 27006-1:2024 (the transition under IAF MD 29:2024 ended on 31 March 2026, so an accreditation still referring only to ISO/IEC 27006:2015 needs an explanation) | Accreditation schedule and its date, CB statement | [Pass / Fail] | [Pass / Fail] | [Pass / Fail] |
| 4.2.5 | CB uploads accredited certificates to IAF CertSearch (still operating under Global ACI; check) so customers can verify them | Search for an existing certificate of the CB in IAF CertSearch | [Pass / Fail] | [Pass / Fail] | [Pass / Fail] |
| 4.2.6 | No suspension or withdrawal of the accreditation | Accreditation body register | [Pass / Fail] | [Pass / Fail] | [Pass / Fail] |

Example result *(Example)*: Bidder C offered a low fee but its accreditation
schedule covered ISO 9001 only; its ISMS certificates were issued without
accreditation. Bidder C fails gate 1 and is excluded, although section 12
shows its scores for illustration.

### 4.3 Red flags

- The CB offers to write your policies, run your risk assessment or
  "guarantee" a certificate. Accredited CBs must not consult on the system
  they certify, and no CB can promise the outcome of an audit.
- The certificate would carry only the CB's own mark and no accreditation
  mark, or an accreditation body you cannot find on the signatory list.
- Audit days far below the other quotes for the same profile, with no
  written calculation.
- The CB will not name or describe the auditors' competence before
  contract.

## 5. Scope coverage, impartiality and auditor competence

<!-- Guidance: Gate 2 is impartiality. Then compare competence. Questions to answer: has the CB, or a related consultancy, provided consulting or internal audit to you in the last years? Does the audit team understand your sector, technology and regulations? Pitfall: a team with only generic management system experience auditing a cloud platform or an OT network, which leads to shallow audits and weak assurance for customers. -->

### 5.1 Impartiality (gate 2)

| Question | Bidder A | Bidder B | Bidder C |
|---|---|---|---|
| Has the CB or a body linked to it provided ISMS consulting, internal audit or training with tailored content to [Organization name] within the period the CB's impartiality rules set? | [Yes / No] | [Yes / No] | [Yes / No] |
| Does any proposed auditor hold another role with us (former employee, consultant, shareholder)? | [Yes / No] | [Yes / No] | [Yes / No] |
| Does the CB offer bundled consulting and certification? | [Yes / No] | [Yes / No] | [Yes / No] |
| Gate result | [Pass / Fail] | [Pass / Fail] | [Pass / Fail] |

### 5.2 Competence and continuity

ISO/IEC 27006-1 sets competence requirements for ISMS auditors and for the
people who make certification decisions. You cannot test those directly,
but you can ask for evidence.

| Criterion | What good looks like | Evidence to request |
|---|---|---|
| Sector experience | Lead auditor has audited organisations in your sector or technical area | Anonymised summary of relevant audits |
| Technology competence | Team can assess cloud, software development, OT or other key technology in scope | Auditor profiles, technical expert availability |
| Regulatory awareness | Team understands the laws you list in DOC-ISMS-014 (for example GDPR, NIS2, DORA, US sector rules) | Profile, clarification call |
| Language | Interviews and report in your working language without interpreters, or interpreter cost included | Written confirmation |
| Continuity | Same lead auditor for Stage 1 and Stage 2, rotation policy explained | CB rotation policy |
| Integrated audit capability | Auditors qualified for each standard in an integrated audit (IAF MD 11:2023, now re-issued as Global ACI-TECH-3-008; check the current issue) | Qualification list |

## 6. Audit time transparency

<!-- Guidance: The CB determines audit time from ISO/IEC 27006-1, starting from the number of persons doing work under the organization's control and adjusting for complexity factors. You do not set the days, but you can ask to see the calculation. Pitfall: comparing quotes with different day counts as if they were the same service. Auditor check: at Stage 1 the auditor confirms the data behind the calculation; a wrong headcount can change the Stage 2 duration. -->

Ask each bidder for a written audit time calculation that shows:

1. the effective number of persons used, and how part-time staff,
   contractors and remote workers were counted;
2. each complexity factor applied (for example IT complexity, extent of
   outsourcing, development activity, regulatory environment, number of
   sites) and its effect;
3. the split between Stage 1, Stage 2, each surveillance audit and the
   recertification audit;
4. on-site, remote and off-site (report writing and planning) time;
5. any reduction or increase and its justification.

| Item | Bidder A | Bidder B | Bidder C |
|---|---|---|---|
| Persons counted *(Example)* | 46 | 46 | 40 |
| Complexity adjustments stated *(Example)* | Yes, written | Yes, written | Not provided |
| Stage 1 days *(Example)* | 1.5 | 1.5 | 1.0 |
| Stage 2 days *(Example)* | 3.5 | 3.5 | 3.0 |
| Initial audit total *(Example)* | 5.0 | 5.0 | 4.0 |
| Each surveillance audit *(Example)* | 2.0 | 1.5 | 1.5 |
| Recertification *(Example)* | 3.5 | 2.5 | 3.0 |

All day counts above are *Example* values to show the comparison format.
They are not taken from any ISO/IEC 27006-1 table. Note that Bidder C
counted 40 persons instead of 46 by leaving out contractors: a quote built
on wrong data is not a saving, because the CB would correct it later.

## 7. Multi-site approach

<!-- Guidance: Complete this section if you have more than one site or a central function with several locations. Questions to answer: can the CB apply sampling, and under which conditions? Pitfall: assuming sampling applies automatically. Sampling is allowed only when the sites run the same ISMS under central control and an internal audit covers every site. -->

Multi-site certification is governed by ISO/IEC 27006-1:2024 and
IAF MD 1:2023 (audit and certification of a management system operated
by a multi-site organization), now re-issued by Global ACI as Global
ACI-TECH-3-001 (check the current issue). The CB decides whether sampling is
possible after reviewing the organisation's structure.

| Question to the CB | Bidder A | Bidder B | Bidder C |
|---|---|---|---|
| Will you treat our sites as one multi-site organisation, and under which conditions? | [answer] | [answer] | [answer] |
| Which sites must be visited at Stage 2 and at each surveillance? | [answer] | [answer] | [answer] |
| How will you treat sites with different activities (for example a data centre versus an office)? | [answer] | [answer] | [answer] |
| What happens if a nonconformity is found at one sampled site? | [answer] | [answer] | [answer] |
| How do you handle a phased scope that adds sites later? | [answer] | [answer] | [answer] |

Link the phased approach to `isms/scope-extension-multisite-plan`.

## 8. Remote and ICT-assisted audit policy

<!-- Guidance: Most CBs now run part of the audit remotely. IAF MD 4:2025 sets the requirements for using information and communication technology in conformity assessment (application from 30 January 2026); Global ACI re-issued it as Global ACI-TECH-3-003, in force from 28 August 2026 (check the current issue). Questions to answer: which parts can be remote, which need a visit, and what tools and evidence-sharing rules apply? Pitfall: agreeing to share confidential evidence through the CB's file portal without checking it against your own transfer rules. -->

| Topic | Our requirement | Bidder A | Bidder B | Bidder C |
|---|---|---|---|---|
| Parts proposed remote | [e.g. Stage 1 document review, interviews with remote staff] | [answer] | [answer] | [answer] |
| Parts requiring a visit | [e.g. office physical controls, colocation suite] | [answer] | [answer] | [answer] |
| Video platform | [Our platform / CB platform, recording not allowed] | [answer] | [answer] | [answer] |
| Evidence sharing | Screen share by default; no upload of Confidential records (DOC-ISMS-043) | [answer] | [answer] | [answer] |
| Fallback if connection fails | [rescheduling rule] | [answer] | [answer] | [answer] |
| Data protection of audit records | CB confidentiality terms, retention of copies | [answer] | [answer] | [answer] |

## 9. Cost of the full certification cycle

<!-- Guidance: Compare the full three-year cycle, not the Stage 2 fee. Include audit days, travel, annual or certificate fees, report fees, and the recertification. Use local currency; the examples use USD. Pitfall: quotes that exclude travel, annual administration fees or extra days for findings, which surface later. -->

Worked example *(Example: Quillmere Analytics Ltd, USD, figures for
illustration only; use your local currency)*:

| Cost item | Bidder A | Bidder B | Bidder C |
|---|---|---|---|
| Day rate | 1,600 | 1,500 | 1,200 |
| Initial audit (Stage 1 + Stage 2) | 5.0 d = 8,000 | 5.0 d = 7,500 | 4.0 d = 4,800 |
| Surveillance year 2 | 2.0 d = 3,200 | 1.5 d = 2,250 | 1.5 d = 1,800 |
| Surveillance year 3 | 2.0 d = 3,200 | 1.5 d = 2,250 | 1.5 d = 1,800 |
| Travel (year 1 / year 2 / year 3) | 1,000 / 500 / 500 | Included in the day rate | 0 / 0 / 0 (remote only) |
| Annual administration or certificate fee | 600 x 3 = 1,800 | 600 x 3 = 1,800 | 400 x 3 = 1,200 |
| **Year 1 total** | **9,600** | **8,100** | **5,200** |
| **Year 2 total** | **4,300** | **2,850** | **2,200** |
| **Year 3 total** | **4,300** | **2,850** | **2,200** |
| **Three-year total** | **18,200** | **13,800** | **9,600** |
| Recertification (start of next cycle, for comparison) | 3.5 d = 5,600 | 2.5 d = 3,750 | 3.0 d = 3,600 |

The selected Bidder B figures are the ones carried into the cycle budget
in `isms/certification-cycle-plan` (DOC-ISMS-094) section 11.

Also ask about: fees for extra days to verify corrective actions,
cancellation and rescheduling charges, fees for scope extensions, special
audits, and certificate reissue.

## 10. Transfer rules

<!-- Guidance: Know the exit before you enter. IAF MD 2:2023, now re-issued by Global ACI as Global ACI-TECH-3-002, sets how an accredited certificate moves from one CB to another. Questions to answer: what would the new CB review, and what blocks a transfer? Pitfall: trying to transfer while a major nonconformity is open, which most receiving CBs will not accept until it is closed. -->

IAF MD 2:2023, now re-issued by Global ACI as Global ACI-TECH-3-002
(check the current issue), covers the transfer of accredited management
system certification between accredited CBs. In outline, the receiving CB
performs a pre-transfer review of the current certificate, the last audit
reports, open nonconformities and complaints, and decides whether a visit
is needed. Only valid, accredited certificates can be transferred.

| Question | Our position |
|---|---|
| Notice period to end the contract with the selected CB | [n months, from the contract] |
| Ownership of audit reports | [We keep copies of all reports; contract allows sharing with a new CB] |
| Transfer conditions we must keep met | No open major nonconformity, certificate not suspended, surveillance up to date |
| When we would consider a transfer | [e.g. loss of accreditation, repeated auditor changes, unresolved complaint, sector competence gap] |

## 11. Request for quotation questions

<!-- Guidance: Send the requirements profile (section 3) with these questions. Ask for written answers so you can score them. Delete questions that do not apply, but keep the accreditation, audit time and cost questions. -->

**Accreditation and recognition**

1. Provide your accreditation certificate and scope schedule for ISMS
   certification, and name the accreditation body.
2. Confirm that the accreditation body is a Global ACI MRA (formerly IAF
   MLA) signatory for management system certification.
3. Confirm that your accreditation covers ISO/IEC 27006-1:2024.
4. Confirm that our certificate will be listed in IAF CertSearch.

**Audit approach**

5. Provide your audit time calculation (section 6) with all assumptions.
6. Describe the Stage 1 approach: on site, remote or mixed, and what you
   expect to see.
7. State your expected interval between Stage 1 and Stage 2 and how you
   handle areas of concern found at Stage 1.
8. Describe your multi-site and sampling approach for our structure.
9. Describe your use of remote auditing under IAF MD 4:2025 (Global
   ACI-TECH-3-003) and the tools you use.
10. Describe how you would run an integrated audit with [other standards]
    under IAF MD 11:2023 (Global ACI-TECH-3-008), if requested.

**Competence and continuity**

11. Describe the proposed lead auditor's sector and technical experience.
12. Explain your auditor rotation policy across the three-year cycle.
13. State whether technical experts will join, and for which areas.
14. Confirm the audit languages available.

**Commercial**

15. Provide a full three-year cost breakdown (section 9 format).
16. List fees not included in the day rate.
17. State cancellation, rescheduling and extra-day terms.
18. State payment terms and price review rules over the cycle.

**Process and service**

19. Describe how you grade nonconformities and the deadlines you set for
    corrections and corrective actions.
20. State the typical time from Stage 2 closing meeting to certification
    decision and certificate issue.
21. Describe your complaints and appeals process.
22. Describe your rules for use of the certification mark and the
    accreditation mark (link `isms/certification-mark-usage`).
23. State how you protect the confidentiality of our evidence and how long
    you retain it.
24. Provide your transfer-in process if we come from another CB.

## 12. Scoring matrix

<!-- Guidance: Score only bidders that passed both gates; the excluded bidder below is shown for illustration. Agree the weights before opening the quotes, so the panel cannot tune weights to a favourite. Score 1 (poor) to 5 (excellent). Weighted score = weight x score / 5, so the maximum is 100. Pitfall: a panel of one person; use at least two scorers and average. -->

Weights *(Example)*, agreed by the panel on YYYY-MM-DD before the quotes
were opened:

| Criterion | Weight | Bidder A score | Bidder A weighted | Bidder B score | Bidder B weighted | Bidder C score | Bidder C weighted |
|---|---|---|---|---|---|---|---|
| Accreditation and recognition | 15 | 5 | 15.0 | 5 | 15.0 | 2 | 6.0 |
| Scope coverage and sector competence | 15 | 4 | 12.0 | 5 | 15.0 | 4 | 12.0 |
| Auditor competence and continuity | 15 | 4 | 12.0 | 5 | 15.0 | 3 | 9.0 |
| Audit time transparency | 10 | 5 | 10.0 | 4 | 8.0 | 2 | 4.0 |
| Multi-site and remote approach | 10 | 4 | 8.0 | 4 | 8.0 | 3 | 6.0 |
| Three-year cost | 15 | 3 | 9.0 | 4 | 12.0 | 5 | 15.0 |
| Scheduling and language | 10 | 4 | 8.0 | 4 | 8.0 | 5 | 10.0 |
| Transfer and exit terms | 5 | 4 | 4.0 | 4 | 4.0 | 3 | 3.0 |
| Reporting and service quality | 5 | 4 | 4.0 | 5 | 5.0 | 3 | 3.0 |
| **Total** | **100** | | **82.0** | | **90.0** | | **68.0 (excluded at gate 1)** |

Result *(Example)*: Bidder B ranks first with 90.0. Bidder C has the lowest
cost but fails gate 1 (section 4.2), so its score has no effect on the
decision.

## 13. Decision record

<!-- Guidance: Record the decision so it can be explained at the next tender and to top management. Questions to answer: who decided, on what evidence, which risks remain, and what conditions go into the contract? -->

| Field | Value |
|---|---|
| Decision ID | CBS-DEC-001 *(Example)* |
| Selected CB | [CB legal name] *(Example: Bidder B)* |
| Accreditation | [Accreditation body, certificate number, checked on YYYY-MM-DD] |
| Reason | *Example:* highest weighted score (90.0), sector experience with SaaS processors, same lead auditor for Stage 1 and Stage 2, three-year cost 13,800 USD |
| Excluded bidders and reason | *Example:* Bidder C, accreditation scope does not cover ISO/IEC 27001 |
| Contract conditions | [Fixed day rate for the cycle, remote evidence rules from section 8, report ownership from section 10] |
| Residual concerns | [e.g. limited auditor availability in Q4] |
| Budget reference | DOC-ISMS-031 (budget and resource plan) |
| Agreed Stage 1 dates | YYYY-MM-DD to YYYY-MM-DD |
| Decided by | [@ceo], YYYY-MM-DD |

Selecting a CB does not guarantee certification. The certification
decision belongs to the CB after its audits.

## 14. Size tiers

<!-- Guidance: Scale the effort. A small organisation needs a short RFQ to two or three bidders; a multi-site group needs a formal tender, multi-site questions and integrated audit capability. These are the library's working tiers, not official definitions. -->

| Aspect | Small: Quillmere Analytics Ltd *(Example)* | Medium: Quillmere Health Systems *(Example)* | Large: Quillmere Group *(Example)* |
|---|---|---|---|
| Profile | 46 persons (38 employees, 8 contractors), one office, remote staff, one cloud provider in two regions | 320 staff, two offices, one colocation suite | 2,400 staff, 6 sites in 4 countries, OT and IT |
| Bidders | 3, simple RFQ by e-mail | 3 to 4, RFQ with clarification calls | Formal tender through procurement, 4 to 6 bidders |
| Key differentiator | Cost, SaaS experience, remote audit | Health sector competence, readiness for an ISO/IEC 27701:2025 extension next year | Multi-site sampling, OT competence, integrated audit with existing ISO 9001 and ISO 22301 certificates, languages in 4 countries |
| Panel | ISMS manager (0.5 FTE) and CEO | ISMS manager, security lead, CFO | CISO, procurement, site representatives, IMS lead |
| Special questions | None beyond the RFQ | 27701 capability, colocation visit approach | Phased scope by site, transfer of existing certificates to one CB, auditor travel across countries |
| Timeline | Decide 5 months before target certificate date | Decide 6 to 8 months before | Decide 10 to 12 months before, before phase 1 sites go live |

## 15. Records and evidence

<!-- Guidance: List the records that prove the selection was made properly and keep them for the full cycle plus one. Link the control evidence matrix so the CB contract appears as evidence for supplier controls where relevant. -->

| Record | Owner | Location | Retention |
|---|---|---|---|
| Requirements profile as sent | [@isms-manager] | [ISMS document store] | Certification cycle + 3 years *(Example)* |
| Accreditation check screenshots or exports | [@isms-manager] | [ISMS document store] | Certification cycle + 3 years |
| Quotes and audit time calculations | [@procurement-lead] | [Procurement system] | Per procurement policy |
| Clarification call notes | [@isms-manager] | [ISMS document store] | Certification cycle + 3 years |
| Scoring sheets per scorer | Evaluation panel | [ISMS document store] | Certification cycle + 3 years |
| Signed decision (section 13) and contract | [@ceo], [@procurement-lead] | [Contract repository] | Contract term + [n] years |

Register these records in DOC-ISMS-028 (documented information register)
and map the CB contract in `isms/control-evidence-matrix` where it serves
as evidence.

## 16. References

<!-- Guidance: Cite editions exactly and check the IAF and Global ACI documents on the day you use this template, because they change. -->

| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022, ISMS requirements (https://www.iso.org/standard/82875.html) | 2022 | Standard being certified |
| ISO/IEC 27001:2022/Amd 1:2024 (https://www.iso.org/standard/88435.html) | 2024-02-23 | Climate change in 4.1 and 4.2 |
| ISO/IEC 17021-1:2015 (https://www.iso.org/standard/61651.html) | 2015 | General requirements for management system CBs |
| ISO/IEC 27006-1:2024 (https://www.iso.org/standard/82908.html) | 2024 | ISMS CB requirements: audit time, multi-site, competence |
| IAF MD 1:2023, multi-site audit and certification, re-issued as Global ACI-TECH-3-001 | Issue 3, 18 Oct 2023; Global ACI v1.0 issued 10 Jul 2026, in force 28 Aug 2026 | Section 7 |
| IAF MD 2:2023, transfer of accredited certification, re-issued as Global ACI-TECH-3-002 | Issue 2, 14 Jun 2023; Global ACI v1.0 (check the current issue) | Section 10 |
| IAF MD 4:2025, ICT for conformity assessment, re-issued as Global ACI-TECH-3-003 | Issue 3, 30 Jan 2025, application 30 Jan 2026; Global ACI v1.0 issued 10 Jul 2026, in force 28 Aug 2026 | Section 8 |
| IAF MD 11:2023, integrated management system audits, re-issued as Global ACI-TECH-3-008 | Issue 3, 12 Sep 2023; Global ACI v1.0 (check the current issue) | Sections 5 and 11 |
| IAF MD 29:2024, transition to ISO/IEC 27006-1:2024 | Issue 1, 21 May 2024; transition ended 31 Mar 2026 | Section 4 |
| Global Accreditation Cooperation Incorporated (Global ACI), MRA (formerly IAF MLA) and re-issued mandatory documents | Operational from 1 Jan 2026 | Section 4 (https://global-aci.org) |
| IAF CertSearch | Online database (still operating; check) | Certificate verification (https://www.iafcertsearch.org) |

Related templates: `compliance/ms-scope`, `compliance/iso-27001-gap-assessment`,
`isms/stage-1-readiness-pack`, `isms/stage-2-audit-evidence-index`,
`isms/certification-cycle-plan`, `isms/scope-extension-multisite-plan`,
`isms/isms-budget-resource-plan`, `isms/certification-mark-usage`,
`isms/certification-audit-explained`, `isms/control-evidence-matrix`.

## Standard and licence note

Structure aligned with the certification requirements in ISO/IEC
17021-1:2015 and ISO/IEC 27006-1:2024 for ISO/IEC 27001:2022 + Amd 1:2024,
and with the IAF mandatory documents MD 1, MD 2, MD 4, MD 11 and MD 29,
of which MD 1, MD 2, MD 4 and MD 11 have been re-issued by Global ACI
(Global ACI-TECH-3-001, -002, -003 and -008). The
text, questions, scoring method and examples are original; no ISO/IEC or
IAF text is reproduced, and audit-day and cost figures are illustrative.
ISO and IEC standards are copyrighted: obtain the official standards from
ISO (https://www.iso.org/standard/82875.html) or your national standards
body. Check the current editions, the Global ACI documents and your
certification body's rules before use. No certification body is named or
recommended. This is a documentation format, not legal or procurement
advice. Template licence: MIT.