ISO 27001 Multi-Site Certification: Complete 2026 Guide

ISO 27001 multi-site certification lets an organization with several offices, data centers or delivery hubs hold one certificate covering every location, with the auditor visiting only a sample of them. Done properly it cuts audit days substantially. Done carelessly it produces a certificate your largest customer rejects, or a finding at one branch that takes down the whole group.

The rules of ISO 27001 multi-site certification are not a matter of certification body preference — they sit in a mandatory accreditation document, and the 2026 edition is new. Here is what it requires, what the sampling math gives you, and where this route breaks.

What ISO 27001 Multi-Site Certification Actually Covers

The governing rule is Global ACI-TECH-3-001 (M), the Mandatory Document for the Audit and Certification of a Management System Operated by a Multi-Site Organisation, issued 10 July 2026 with an implementation date of 28 August 2026. It is the reformatted successor to IAF MD 1:2023, carried over after the International Accreditation Forum ceased operations and its role passed to Global Accreditation Cooperation Incorporated. The document says it was reformatted “without any substantive change to the text,” so the rules applied in 2025 still stand — only the reference changed.

Its definition of a multi-site organization: one covered by a single management system comprising an identified central function — explicitly “not necessarily the headquarters” — at which certain processes are planned and controlled, plus a number of sites where those processes are carried out. Three consequences of that definition shape every ISO 27001 multi-site certification:

• The sites need not be one legal entity. They must have a legal or contractual link with the central function and run a single management system that the central function lays down and keeps under surveillance.
• A virtual site counts as a site. A fully remote engineering team working in a cloud environment is a site in its own right, treated as a single site when audit time is calculated.
• Temporary sites can be included. Client premises or a project office may appear on the certificate, audited on a sample basis and flagged as temporary on the document itself.

The Six Eligibility Tests Your Group Must Pass

Before any sampling discussion, Section 5 sets six conditions for ISO 27001 multi-site certification. Fail one and your group cannot be treated as a multi-site organization at all:

1. There is a single management system, not a federation of local ISMSs.
2. The central function is identified, is part of the organization, and is not subcontracted to an external provider.
3. It has organizational authority to define, establish and maintain that system.
4. The management system is subject to a centralized management review.
5. Every site sits inside the organization’s internal audit program.
6. The central function collects and analyzes data from all sites and can demonstrate authority to initiate change — over documentation, management review, complaints, evaluation of corrective actions, internal audit planning, and statutory and regulatory requirements.

Test 2 is where outsourced compliance fails: if a consultancy runs your ISMS, the central function has been subcontracted. Test 6 is where federated groups fail — a holding company receiving quarterly reports from autonomous subsidiaries cannot demonstrate authority to initiate corrective action at a site, which is the specific power the document asks you to prove. Our guide to defining the ISO 27001 scope covers drawing that boundary first.

How Many Sites Get Audited: The Square-Root Rule

Where sites each perform very similar processes, ISO 27001 multi-site certification lets the certification body sample. The minimum sample sizes are fixed arithmetic, not negotiation:

• Initial audit: the square root of the total number of sites, rounded up to the next whole number.
• Surveillance audit: the square root with a 0.6 coefficient, rounded up, calculated per year.
• Recertification audit: the same as initial, though it may fall to 0.8 × the square root where the management system has proved effective across the cycle.

Total sites	Initial audit sample	Annual surveillance sample	Recertification sample
4	2	2	2
9	3	2	3
16	4	3	4
25	5	3	4–5
50	8	5	6–8
100	10	6	8–10

Four details change how that plays out. The central function is additional to the sample — audited at initial certification, at every recertification and at least once each calendar year during surveillance; it is never sampled out. At least 25% of the sample must be random, the rest weighted toward prior findings, complaints, size variation, shift patterns, recent changes and regulatory differences. The sample need not be named up front — the certification body may pick it after auditing your central function, on short notice, so “we will prepare the three sites they visit” is not a plan. And the sample size increases where the certification body’s risk analysis flags complexity, multinational operations or a weak internal audit record.

For a hierarchical group the formula applies at every level. The document’s own example: one head office audited every cycle, 4 national offices giving a sample of 2, 27 regional offices giving 6, and 1,700 local branches giving 42 — with the regional sample covering at least one office under each national office, which can push the real sample above the arithmetic minimum.

Audit days are capped too. The reduction in audit time per sampled site cannot exceed 50%, and for an ISMS the underlying calculation comes from ISO/IEC 27006-1:2024, Annex C, driven mainly by the effective number of people in scope. Since 31 March 2026 every ANAB-accredited certification body has had to use that edition for all clients.

When Sampling Is Not Allowed, and What Replaces It

Most buyers discover this late. The document is explicit that not all organizations meeting the multi-site definition are eligible for sampling, and sampling is permitted only where sites perform very similar processes. Certification bodies must hold documented procedures restricting it by sector, site size, variation in local implementation and use of temporary sites.

If your sites differ materially — a London software team, a Dubai sales office under different regulatory obligations, a Manila operations center on its own shift pattern — expect the non-sampling form of ISO 27001 multi-site certification:

• Initial audit: every site audited.
• Recertification: every site audited again, plus the central function.
• Surveillance: 30% of sites per calendar year, rounded up, plus the central function — and year two should not repeat year one’s sites.

Mixed groups get a combination of the two. Adding a site later differs by route: under sampling the certification body decides whether the new site needs an audit before joining the certificate; under the non-sampling route it shall be audited first.

ISO 27001 Multi-Site Certification vs Separate Certificates

The alternative is certifying each entity separately. The trade-off is rarely as one-sided as a certification body quote suggests.

Factor	Multi-site, one certificate	Separate certificates per site
Audit days	Lower — only the sample plus the central function is visited	Highest — full audit time at every entity
Documentation effort	One ISMS, one risk assessment process, one Statement of Applicability	Duplicated per site and maintained separately
Local autonomy	Low — the central function must be able to force corrective action	High — each site owns its own system
Risk concentration	A major finding at one site blocks or withdraws the whole certificate	Contained to the affected entity
Customer evidence	One certificate naming every site in scope	Easier for a single-country buyer to read
Best fit	Branch networks, shared-service groups, one operating model	Acquisitions still on their own systems

Choosing ISO 27001 multi-site certification is therefore a governance decision before it is a cost decision. You are trading audit days for a single point of failure, and the exchange rate is set by how much real authority your central function holds.

What the Certificate Says, and What One Bad Site Does to It

The certificate must carry the name and address of all the sites and make clear the certified activities are performed by the sites on that list. Where a site covers only part of the scope, its sub-scope must be stated.

Site-level copies are tightly constrained. One may be issued, but it must state that it is the whole organization’s management system that is certified, carry traceability to the main certificate, and include the statement that “the validity of this certificate depends on the validity of the main certificate.” It cannot be issued in the site’s own name or imply the site itself is certified — the rule to point at when a procurement team asks for a certificate in a subsidiary’s name.

Then the consequences, which are the real cost of ISO 27001 multi-site certification:

• A finding at one site triggers investigation of the others. You must review whether it indicates a system-wide deficiency; if it does, corrective action is performed and verified at the central function and every affected site. If not, you must justify limiting the follow-up.
• Sampling gets heavier. The certification body must increase sampling frequency or sample size until it is satisfied control is re-established.
• One major nonconformity blocks everyone. At the decision point, a major finding at any site means certification is denied to the whole multi-site organization pending satisfactory corrective action — and under ISO/IEC 17021-1 clause 9.5.3.2, if the certification body cannot verify that correction within 6 months of the last day of stage 2, another stage 2 audit is required.
• You cannot drop the problem site. Excluding the troublesome location from scope to clear a finding is expressly inadmissible.
• Withdrawal is total. The certification documentation is withdrawn in its entirety if any site fails to meet the provisions for maintaining certification.

Our guides to the major and minor nonconformity rules and the annual surveillance cycle cover how those findings are raised and closed.

How to Prepare for ISO 27001 Multi-Site Certification

Preparing for ISO 27001 multi-site certification is mostly about evidencing that the central function is real. Six moves that hold up at audit:

1. Write the legal or contractual link down. A one-page agreement between the central function and each site, granting the right to require corrective action, answers tests 2, 3 and 6 on paper.
2. Run one management review, not several. Minutes should show site-level data consolidated and decisions taken centrally.
3. Cover every site in the internal audit program — including the ones that will never be sampled. That is a requirement, not a sampling exercise, and the auditor will ask which sites you audited yourself.
4. Keep one risk assessment and one Statement of Applicability. ISO 27001:2022 has 93 Annex A controls across four themes, and clause 6.1.3 makes the Statement of Applicability mandatory. Site variation belongs in implementation notes, not parallel documents.
5. Prepare every site to the same standard. With 25% of the sample random and short notice permitted, readiness has to be uniform.
6. Audit your weakest site first. A major there costs you the group certificate, so it deserves the first internal audit, not the last.

Our ISO 27001 Toolkit provides 165 templates mapped to ISO/IEC 27001:2022, including the Statement of Applicability, risk assessment and treatment documents, internal audit program and management review records a central function needs to evidence control across every site. It is $99, in Microsoft Office format, ready to tailor. If you are still choosing an assessor, our certification body selection guide covers the accreditation checks worth making first, and the step-by-step certification guide sets out the full route.

Frequently Asked Questions

Does ISO 27001 multi-site certification cover remote workers?

Home-based staff attached to an office are normally audited within that office’s scope. A fully remote team with no physical base is a virtual site in its own right and counts as a single site in the audit-time calculation. Check how your certification body has listed them — it changes the square root.

Can a certification body refuse to sample our sites?

Yes, and it does not need your agreement. Sampling applies only where sites perform very similar processes, and certification bodies must hold documented procedures restricting it. Where it is ruled out, the alternative is full coverage at initial and recertification plus 30% of sites each surveillance year.

How much does ISO 27001 multi-site certification cost?

Sampling cuts audit days, not day rates. For context, a single-site stage 1 plus stage 2 typically runs $5,000–$12,000 in US certification body fees at 2026 auditor day rates of roughly $1,400–$2,500 — see our ISO 27001 certification cost breakdown. The per-sampled-site reduction is capped at 50%, travel is added on top, and the central function is always charged.

Can we add a new office mid-cycle?

Yes. Under the sampling route the certification body decides what is needed before the site joins the certificate, which may or may not include auditing it. Under the non-sampling route it must be audited first. Either way the sample size for later audits is recalculated.

Is a single-site certificate ever better than ISO 27001 multi-site certification?

For a recent acquisition still running its own security program, yes. Forcing it into a group ISMS before the central function genuinely controls it puts the whole certificate at risk, and the eligibility tests are checked at audit, not at application.

The Short Version

ISO 27001 multi-site certification is open to any group with one genuine information security management system and a central function that can prove authority over every location. Where the sites are comparable, the auditor visits the square root of them at initial certification, 0.6 × the square root each surveillance year, and the central function every time. Where they are not, expect full coverage plus 30% per year. The savings are real; so is the fact that one major finding anywhere takes the whole certificate with it. The full requirements are published by ISO.