We take pride in maintaining trusted accredited status for our ISO/IEC 27001 Information Security Management System (ISMS) certification service. Compliance for the following practices is ensured through maintenance of our rigorous internal controls and external audits by our accreditation bodies.
We review your company’s information security policies and meet with your leadership team to define the scope of the Stage 2 Audit.
We conduct a detailed inspection of your controls to determine whether sufficient evidence exists to provide recommendation for certification.
Our ISO Certification Body provides the certification decision for your ISMS.
You will receive a full report and, when appropriate, your ISMS certification seals.
Together we establish a reinspection plan for 2 years of surveillance audits and a recertification audit on the 3rd year to inspect your ISMS for continuous improvement towards ISO/IEC 27001 excellence.
As an ISO certification body, Decrypt Compliance allows clients use of our certification marks and logos subject to the following rules:
Achieve ISO 27001 certification with our comprehensive process, safeguarding information assets and demonstrating commitment to security.
Our certification decision authority conducts a comprehensive review of the entire audit record, including any corrective action plans, to verify conformance with ISO standards. Only upon satisfying all requirements is certification granted.
If the review finds audit issues or unresolved non-conformities, certification is refused until the client organization demonstrates full conformance. Exceeding remediation timeframes requires re-auditing.
Continued certification over the 3-year cycle requires successfully undergoing annual surveillance audits in years 2 and 3, plus recertification audits before expiration. Failure to meet these audit obligations or resolve identified non-conformities can prompt suspension.
Grounds for suspension include failure to resolve major non-conformities within allotted timelines, breaching agreements with Decrypt Compliance, or refusal to conduct required audits.
Suspended certifications are restored if an independent review verifies resolution of all outstanding issues, with confirmation by off-site or on-site assessment.
Decrypt Compliance can withdraw certification due to factors like failure to conduct audits, misrepresentation by the client, unresolved corrective actions, failed appeals of major non-conformities, or client request. Clients may request withdrawal of certification for any reason.
Additional certification scope requires formally submitting supporting documentation of eligibility to Decrypt Compliance. Our subsequent on-site audit determines if compliance covers the expanded scope. Additional contract terms may be applicable.
We may dictate scope reduction if an organization’s certification scope is no longer completely valid or applicable. However, reducing scope solely to preclude non-conformities is unacceptable.
Share your needs and timeline, and we’ll reach out shortly.
