ISO 27001 Self-Certification: The Complete 2026 Guide

ISO 27001 self-certification is the one route to an ISO 27001 badge that does not exist. You can assess your own information security management system, you can declare conformity with the standard in writing, and you can hand that declaration to a customer. What you cannot do is issue yourself a certificate, and ISO says so in plain language on its own site. The gap between what you may legitimately claim and what buyers actually accept is where most teams lose three to six months.

This guide covers what ISO 27001 self-certification means in conformity assessment terms, what a self-declaration can and cannot do for you commercially, how to write one that survives a procurement review, and the specific wording that gets companies into trouble.

Does ISO 27001 Self-Certification Exist?

No. ISO defines certification as the provision by an independent body of written assurance (a certificate) that the thing in question meets specified requirements. The operative words are independent body. An organization assessing itself is not independent of itself, so the activity cannot produce a certificate no matter how rigorous it is.

ISO is equally direct about its own role. It does not perform certification, it does not issue certificates, and it does not permit its logo to be used in connection with certification. Certification is carried out by external certification bodies, which means no company is ever certified by ISO itself. If you have seen a supplier claim to be “ISO certified,” you have seen a claim that cannot be true as written.

The conformity assessment vocabulary, ISO/IEC 17000:2020, splits assessment activity into three positions:

• First party — the assessment is performed by the organization that is the object of the assessment. This is self-assessment and self-declaration.
• Second party — the assessment is performed by someone with a user interest in the object. Your customer’s security questionnaire, a right-to-audit clause, a vendor review.
• Third party — the assessment is performed by a body independent of both. Certification is third-party attestation, and only this position produces a certificate.

ISO 27001 self-certification tries to occupy the first and third positions at the same time. The vocabulary does not allow it, and neither does any certification body.

ISO 27001 Self-Certification vs Third-Party Certification

The two things are not competing products. One is an internal management decision; the other is a market signal. Here is the honest comparison.

Dimension	Self-declaration (first party)	Certification (third party)
Who attests	You, in your own name	A certification body, accredited or not
Output	A signed statement of conformity	A certificate naming the standard, scope and expiry
Governing standard	ISO/IEC 17050-1, supplier’s declaration of conformity	ISO/IEC 17021-1 plus ISO/IEC 27006-1 for ISMS
Independence	None, by definition	Mandatory
External cost	None beyond internal effort	Audit fees across a three-year cycle
Earliest availability	As soon as the ISMS is genuinely operating	After a stage 1 and stage 2 audit and a certification decision
Independently verifiable	Only by reading your evidence	Via IAF CertSearch or the issuing body
Accepted in enterprise procurement	Sometimes, below a risk threshold	Routinely
Marks you may display	None	The body’s certification mark, plus an accreditation mark if accredited
ISO logo	Never	Never — it is a registered trademark reserved to ISO

Note the last row. Neither route entitles you to the ISO logo. That is one of the most common branding mistakes on security pages, and it is made by certified companies as often as by uncertified ones.

What ISO 27001 Self-Certification Actually Gets You

It gets you the work, and the work is most of the value. ISO/IEC 27001:2022 is edition 3, published in October 2022, and it runs to nineteen pages of requirements. Those requirements sit in clauses 4 to 10 and none of them mention certificates:

• Clause 4 — the scope and boundary of the ISMS, and the interested parties it has to satisfy.
• Clause 6.1.3 d) — the Statement of Applicability, which is mandatory and must address all 93 Annex A controls: 37 organizational, 8 people, 14 physical and 34 technological.
• Clause 9.2 — internal audit at planned intervals, by auditors who are objective about the area they audit.
• Clause 9.3 — management review, with the specific inputs the clause lists.
• Clause 10 — nonconformity, corrective action and continual improvement.

Amendment 1:2024 adds the climate action changes to clauses 4.1 and 4.2, and ISO publishes it at no charge, so there is no excuse for a 2026 ISMS that has not absorbed it. The 2013 edition is withdrawn and its transition window closed on 31 October 2025.

An organization that has done all of that and runs a structured self-assessment against the 93 controls is in a defensible position. An organization that has a policy folder and a good story is not, and no amount of careful wording in a declaration will change that.

How to Write a Self-Declaration That Survives Procurement

First-party declarations have their own standard. ISO/IEC 17050-1 sets general requirements for a supplier’s declaration of conformity, and it explicitly contemplates a management system as the object being declared. It is also clear that a declaration has to rest on actual conformity assessment activity — testing, inspection, audit or measurement — rather than on assertion.

A declaration that gets waved through a vendor review usually contains all of this:

• The legal entity making the declaration, and the name and role of the executive signing it.
• The object: your ISMS, with the same scope statement your ISMS documentation uses, including locations and excluded functions.
• The standard and edition, written out in full — ISO/IEC 27001:2022, including Amendment 1:2024.
• The basis for the declaration: the date of your last internal audit, the date of the last management review, and the version of the Statement of Applicability in force.
• An explicit statement that this is a first-party declaration and that no certification body has assessed the ISMS.
• A date and a review interval, so a reader can tell whether it is current.

ISO 27001 self-certification fails in procurement for one reason above all others: it asserts a conclusion without exposing the evidence behind it. Attach a Statement of Applicability summary and the internal audit report headings, and a reviewer has something to evaluate. Send a one-paragraph claim and you have given them nothing but a sentence to escalate.

Where Self-Assessment Is Accepted — and Where It Is Not

Self-assessment is not disreputable, and ISO 27001 self-certification is not a stupid question to ask. Several real schemes are built on self-assessment. ISO 27001 simply is not one of them, and knowing which is which prevents a lot of wasted argument with a buyer.

Scheme	Who performs the assessment	What you end up holding
ISO/IEC 27001	An independent certification body only	A certificate on a three-year cycle
Cyber Essentials (UK)	You complete the questionnaire; an IASME-licensed certification body marks it	A certificate based on verified self-assessment
Cyber Essentials Plus	An assessor independently tests a sample of devices, gateways and internet-facing servers	A certificate backed by technical audit
NIST SP 800-171	The contractor scores its own implementation and submits the score	A score, not a certificate
SOC 2	A licensed CPA firm	An attestation report — never a certification

Cyber Essentials is the instructive case. It is a self-assessment, but a licensed body marks the submission and can send it back for correction, and a senior person has to attest that the answers are accurate. That human check is what turns a questionnaire into a certificate. Nothing equivalent exists for ISO 27001 outside the full audit route.

The ISO 27001 Self-Certification Claims That Get Companies in Trouble

These are the four wordings that generate complaints, failed security reviews and, occasionally, contract disputes.

• “ISO 27001 certified” with no certificate behind it. This is a false certification claim, not a rounding error. ISO takes complaints about false claims against its management system standards seriously, and the first step for a complainant is to ask you which body certified you — a question with no good answer. ISO undertakes to respond to complaints within 14 days.
• “ISO certified” in any form. No organization is certified by ISO.
• Displaying the ISO logo. It is a registered trademark and is not available for this purpose to anyone, certified or not.
• “Self-certified to ISO 27001.” It sounds candid but it uses the word that implies a third party, and a sharp reviewer will treat it as a hedge and dig.

Claims of accredited certification are policed separately. Accreditation is the formal recognition that a certification body itself operates to international standards, and the Global Accreditation Cooperation Incorporated has now assumed the roles formerly held by the International Accreditation Forum and the International Laboratory Accreditation Cooperation. False accredited-certification claims, including misuse of its logo, go to the Global ACI Secretariat. Our guide to accredited ISO 27001 certification covers what accreditation does and does not guarantee — including ISO’s own point that accreditation is not compulsory.

The safe formulation is dull and effective: our information security management system is implemented in conformity with ISO/IEC 27001:2022; conformity is self-declared and has not been assessed by a certification body. Nobody has ever escalated that sentence.

When ISO 27001 Self-Certification Stops Being Enough

Four triggers reliably end the self-declaration phase: a contract clause that names ISO 27001 certification by name, an enterprise security review that scores vendors on third-party assurance, a public tender, and a cyber insurer’s questionnaire. An acquisition process is a fifth, and the least forgiving.

Context helps calibrate. ISO’s own Survey of Certifications recorded 96,709 valid ISO/IEC 27001 certificates covering 179,877 sites for 2024. Treat that as a measure of how normal certification has become rather than as a growth figure — the 2024 edition was the first compiled from the IAF CertSearch database rather than voluntary reporting by certification bodies, so much of the jump over 2023 reflects better data coverage. The practical point stands: among security-mature suppliers, the absence of a certificate is noticed.

The decision rule is simple. If none of your top ten customer contracts names a certificate, self-declaration buys you time at low cost. The moment one does, you need a certification body, and you need to start early — a body cannot certify an ISMS with no audit history, so you are looking at months, not weeks, from decision to certificate. Our walkthrough of how to get ISO 27001 certified sets out the sequence, and the certification cost breakdown explains what drives the quote you will receive.

Frequently Asked Questions About ISO 27001 Self-Certification

Can you self-certify ISO 27001?

No. Certification requires an independent body under ISO’s own definition, so there is no first-party route to a certificate. You can self-declare conformity, which is a different and legitimate thing.

Is ISO 27001 self-certification legal?

Declaring conformity in your own name is perfectly lawful and is covered by ISO/IEC 17050-1. Claiming to be certified when no body has certified you is a false statement about your business, which is where the legal and contractual exposure begins.

Will enterprise customers accept ISO 27001 self-certification?

Some will, particularly below a spend or data-sensitivity threshold, and particularly if you supply the underlying evidence rather than a bare claim. Regulated buyers, public sector tenders and most enterprise security teams will not.

Can we say “ISO 27001 compliant” instead of certified?

You can, and it is more defensible than “certified,” but it is a weaker word than most people realize. ISO’s framing is that conformity with the standard means you have put a working risk management system in place. If you say compliant, be ready to show the mandatory documents that prove it.

Does an internal audit count as ISO 27001 self-certification?

No. Internal audit under clause 9.2 is a requirement of the standard, not an alternative to being certified against it. Every certified organization also runs internal audits; the two sit on top of each other rather than side by side.

Getting the Evidence in Place First

Whichever route you take, the documentation is the same. A self-declaration and a stage 2 audit both ask for the same Statement of Applicability, the same risk assessment, the same policy set and the same audit and review records. Build those once, and the decision about certification becomes a commercial question rather than a project.

Our ISO 27001 Toolkit provides 165 templates mapped to ISO/IEC 27001:2022 — the Statement of Applicability, risk assessment and treatment plan, the full policy set across all 93 Annex A controls, and the internal audit and management review records that a declaration has to rest on. It is $99 and it works for either destination. You can also read the requirements summary on ISO’s own page for ISO/IEC 27001:2022 before you commit to a route.