Certification applies to the defined scope of an organization’s information security management system. An accredited certification body can assess conformity and issue a certificate, but certification is not proof that every risk is eliminated and does not guarantee that a security incident will never occur.
Who Performs Certification
An independent certification body performs the external assessment and makes the certification decision. ISO publishes the standard but does not issue certificates. Accreditation can provide additional confidence that a certification body operates competently and impartially.
