Certification Mark Usage Rules Template (ISO/IEC 27001)

Certification Mark Usage Rules: [Organization name]

Internal rules for how [Organization name] refers to its ISO/IEC 27001:2022 + Amd 1:2024 certification and uses the certification body's (CB) mark, the certificate and any accreditation-related mark. Certification bodies must have rules on reference to certification and use of marks under ISO/IEC 17021-1:2015, and the certification agreement binds you to them; this document turns those rules into internal wording, channels, prohibited uses and an approval workflow. It also supports clause 7.4 (communication) of ISO/IEC 27001. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. Whose rules apply
3. Marks and materials you may use
4. What you may claim
5. Prohibited uses
6. Channels and placement
7. Correct and incorrect wording
8. Approval workflow
9. Changes in certificate status
10. Monitoring and handling misuse
11. Size tiers
12. Records and evidence
13. References

1. Purpose and scope

These rules make sure every reference to the ISO/IEC 27001 certification of [Organization name] is accurate, limited to the certified scope, and allowed by the CB's rules. They apply to:

• all employees and contractors who write external content: marketing, sales, bid and proposal teams, customer success, recruitment, investor relations;
• agencies that produce material on the organization's behalf;
• partners, resellers and group companies that mention the certification;
• internal material that may be shared outside (sales decks, templates, e-mail signatures).

Misuse has consequences. A CB can require corrective action, suspend or withdraw a certificate when its marks or the certification are used in a misleading way, and misleading claims can also raise consumer protection or contract issues in many jurisdictions. Clear rules prevent all three.

2. Whose rules apply

Notes:

• ISO/IEC 17021-1:2015 requires CBs to control the ownership and use of their certification marks and references to certification, and to act on misuse. The detail is in each CB's own rules.
• The International Accreditation Forum (IAF) and ILAC ceased operations on 1 January 2026; their work passed to Global Accreditation Cooperation Incorporated (Global ACI), and the IAF MLA was replaced by the Global ACI Multilateral Recognition Arrangement (MRA), so an accredited CB is now one accredited by a signatory of the Global ACI MRA (formerly the IAF MLA). The legacy IAF MLA mark is being replaced by a Global ACI MRA mark; some accreditation bodies have indicated that legacy mark use may continue until around 2029 (check your accreditation body's notices and the current Global ACI rules). These international recognition marks are licensed to accreditation bodies and accredited CBs, not to certified organizations: under the IAF MLA mark licences that accreditation bodies issued, CBs had to stop their certified clients using the mark. Do not use it unless your CB confirms in writing that the current rules allow it.
• Accreditation body symbols: most accreditation bodies do not let certified organizations use their symbol on its own; some allow it only as part of a combined mark supplied by the CB (MRK-002). Follow the CB and accreditation body rules exactly.
• When in doubt, ask the CB in writing and keep the answer.

3. Marks and materials you may use

Not licensed to [Organization name] and never to be used: the ISO logo, the IEC logo, the international recognition mark (legacy IAF MLA mark or Global ACI MRA mark, unless the CB confirms otherwise in writing), any CB mark for a standard or scope you are not certified for, and marks of other organizations in the group unless their certificate covers you.

4. What you may claim

A correct claim has five elements:

1. Who: the legal entity on the certificate (not the brand, the group or a parent company, unless they are on the certificate).
2. What: the information security management system, not a product, service output, person or test result.
3. Which standard: ISO/IEC 27001:2022 (the edition on the certificate). Do not claim certification to ISO/IEC 27002, which is guidance and not certifiable, or to any standard you hold no certificate for.
4. Scope: the scope as printed, or a faithful short form approved in section 7. If the scope covers only some services or sites, say so.
5. By whom: the CB name, and the certificate number where useful so readers can verify it.

Claims about related work must be clearly separate: "aligned with", "based on" or "following the guidance of" ISO/IEC 27002 or ISO/IEC 27017 is acceptable only when true and when it is not placed so as to suggest certification. Statements about SOC 2 reports, other frameworks or customer audits must not be merged into the ISO/IEC 27001 claim.

Readers may want to verify a certificate. Point them to the CB's certificate directory and, where available, the accreditation system's certificate search database (IAF CertSearch, the database of accredited certifications set up under IAF; check whether it now operates under Global ACI and whether your CB uploads to it).

5. Prohibited uses

6. Channels and placement

7. Correct and incorrect wording

Example certificate: Quillmere Analytics Ltd, certified to ISO/IEC 27001:2022 by [CB name], certificate [number], scope "The information security management system supporting the development, operation and support of the Quillmere analytics SaaS platform".

Approved statements (Example):

• Long form: "Quillmere Analytics Ltd operates an information security management system certified to ISO/IEC 27001:2022 by [CB name] (certificate [number]) for the development, operation and support of the Quillmere analytics SaaS platform."
• Short form: "Our information security management system for the Quillmere analytics platform is certified to ISO/IEC 27001:2022."
• Questionnaire answer: "Yes. Quillmere Analytics Ltd holds ISO/IEC 27001:2022 certification issued by [CB name], certificate [number], valid until [date]. The scope covers the development, operation and support of the Quillmere analytics SaaS platform. A copy of the certificate is attached."

8. Approval workflow

Example service level: decision within 5 working days, or 10 working days when the CB must be asked.

Approval log:

9. Changes in certificate status

Keep a claims inventory: every page, template, deck and partner listing that shows the certification, with owner. The approval log in section 8 is the starting point.

10. Monitoring and handling misuse

• Review the claims inventory every quarter and before each CB audit (isms/surveillance-readiness-health-check, area G).
• Search the public web and partner sites for the organization's name together with "ISO 27001" at least twice a year.
• Brief new marketing, sales and bid staff on these rules during onboarding; include them in the communication plan (DOC-ISMS-027).
• Ask partners and resellers to follow these rules in their agreements.

When misuse is found:

1. Record it as a nonconformity under clause 10.2 when it comes from inside the organization or from someone acting for it.
2. Correct or remove the material and record the date.
3. Find the root cause (missing approval step, unclear wording, outdated template) and fix it.
4. If a third party misuses the certification, ask them in writing to correct it, and tell the CB if they refuse or if the misuse is significant.
5. Tell the CB about significant misuse by the organization before the next audit rather than waiting for the auditor to find it.

11. Size tiers

12. Records and evidence

Map these records in isms/control-evidence-matrix (DOC-ISMS-033) under clause 7.4 (communication) and clause 10.2.

13. References

Related templates: isms/certification-cycle-plan (DOC-ISMS-094), isms/surveillance-readiness-health-check (DOC-ISMS-096), isms/security-whitepaper-trust-center (DOC-ISMS-116), isms/security-questionnaire-answer-library (DOC-ISMS-115), isms/customer-security-addendum (DOC-ISMS-117), isms/isms-communication-plan (DOC-ISMS-027), compliance/ms-scope (DOC-ISMS-002).

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clause 7.4 and with the certification body obligations on marks and references to certification in ISO/IEC 17021-1:2015. The rules, wording examples and guidance are original and summarize common certification body practice; no ISO or IEC text is reproduced. Your certification body's rules and agreement are binding and prevail over this template: obtain them, together with the official standards (purchase or licensed access from ISO, IEC or your national standards body). Check the current edition of each standard and the current accreditation system rules before use. This is a documentation format, not legal advice. Template licence: MIT.