Accredited ISO 27001 Certification Audits

Our application and pre-certification processes are streamlined and efficient. Interested ISO applicants enter their company details in the form on this page. Applicants are then contacted and given an application that gathers additional scope information, which we use to determine technology expertise, staffing requirements, level of effort (including auditor hours) and other scoping details.

The applicant returns the completed application to isocompliance@linfordco.com or to their primary contact at Linford & Company. We perform client acceptance activities along with impartiality considerations. As appropriate based on the results of client acceptance, the applicant then enters into an executed certification agreement with Linford & Company.

Linford & Company requests artifacts and confirms with the client that the initial audit is ready to begin. Before the initial audit, the audit plan is communicated to the client and the audit dates are agreed upon in advance. The audit program for initial certification includes a two-stage initial audit.

Stage 1 evaluates the design of the ISMS. We audit the ISMS documentation that supports that design. Inquiries are made, and documents supporting the ISMS scope, including personnel, services and products, and sites within scope, are reviewed and evaluated.

While evaluating the ISMS scope, we request and verify that the organization has completed an internal audit, performs regular management reviews, and has performed an acceptable risk assessment that includes risk treatment. With this information, we determine the organization's understanding of the standard and whether its scope and resources appear appropriate. At the end of Stage 1, we determine whether the client is prepared to move to Stage 2.

Stage 2 assesses the implementation and operational effectiveness of the client's management system. Linford & Company requires that Stage 2 be conducted either at the client's site(s) or through virtual meetings that provide evidence of the client's desktop and cloud environments. At the end of Stage 2, we determine whether to issue certification based on the results of the Stage 1 and Stage 2 procedures.

When all certification steps are complete, Linford & Company grants certification to the client in the form of a certificate. The initial three-year certification cycle starts on, or reasonably soon after, the date of the certification decision.

If we determine that the client does not meet the standards necessary for certification, we communicate a certification refusal to the client with sufficient detail on the rationale for the decision.

To continue to hold the certification, continuing certification activity takes place through surveillance audits. Linford & Company conducts surveillance audits at least once a year, except during recertification years. The first surveillance audit after initial certification must occur within 12 months of the certification decision date.

Along with surveillance audits, the client is expected to continue operating its controls and processes in the manner understood during the initial audit. Clients retain certification by demonstrating ongoing compliance with the management system standard requirements.