Independent certification body · ISO/IEC 27001:2022
RiskZero is an independent certification body. We audit your information security management system against ISO/IEC 27001:2022 and issue a certificate that holds up in enterprise procurement, in tenders, and in front of your board.
Built for the organisations that get asked for a certificate: the ones holding other people’s data, systems, or money.
How the pieces fit
Most of the ISMS packages we certify are built and attested by SRG and reach us through riskzero.us. We work with both, and we say so. The safeguard is that the people who prepare a package are never the people who audit it or sign the certificate.
Helps you scope and build the ISMS, implement and harden the controls, run the penetration test, and write the policies. When the package is complete, SRG attests that it is ready.
Consultancy and attestation
The platform where the package is assembled, attested, and submitted, and where our auditors examine it. It is how two separate teams work on one package without sharing people.
Platform
A separate company with its own auditors, reviewers, and signatories performs Stage 1, Stage 2, and the certification decision on the package. Nobody who prepared it takes part.
Certifier · this site
SRG’s attestation is an input to Stage 1, never a substitute for it: our auditors form their own view of every package, and the findings do not depend on who prepared it. Read ourimpartiality statement for the rules we apply.
Services
Whether you are certifying for the first time, keeping a certificate current, or moving from another body, the audit is planned around your calendar and priced up front.
Initial certification of your ISMS against ISO/IEC 27001:2022: Stage 1, Stage 2, and an independent certification decision.
Learn moreAnnual audits in years one and two of the cycle that confirm the ISMS is maintained and your certificate stays valid.
Learn moreA full audit before your certificate expires that starts a new three-year cycle with no gap in certification.
Learn moreMove a valid ISO 27001 certificate from another accredited body to RiskZero without repeating initial certification.
Learn moreOne audit programme covering ISO 27001 alongside ISO/IEC 27701 privacy or ISO 22301 business continuity.
Learn moreThe three-year cycle
ISO 27001 certification is not a single audit. It is a three-year cycle with defined points where we check the ISMS is still working. Here is the whole thing on one line, starting with the package SRG prepares before it reaches us.
Before
SRG helps you build the ISMS and attests that the package is ready. It is submitted through riskzero.us. RiskZero takes no part in this step.
Month 0
We review the package: scope, risk assessment, Statement of Applicability, and evidence of internal audit and management review, and confirm you are ready for Stage 2.
Month 1 to 2
On-site or remote audit of how the ISMS actually operates: interviews, records, sampled controls, and evidence.
Month 2 to 3
An independent reviewer checks the audit file. Once any nonconformities are closed, your certificate is issued and can be verified with us directly.
Month 12
A shorter audit confirming the ISMS is maintained, internal audits and management reviews have happened, and corrective actions are working.
Month 24
Second annual check, usually covering the parts of the ISMS not sampled in year one.
Month 36
A full audit before the certificate expires. Pass it and a new three-year cycle begins with no gap in certification.
Why RiskZero
A certificate is only as credible as the body that issued it. These are the things we do differently, and why they matter to the people who read your certificate.
We do not consult or implement. Packages reach us through riskzero.us, most prepared and attested by SRG, and nobody who prepared a package audits it, reviews it, or signs the decision. Our only product is an audit opinion on someone else’s work.
Our auditors come from security and engineering roles. They read infrastructure as code, understand shared responsibility, and know what a real incident log looks like.
One proposal covers Stage 1, Stage 2, both surveillance audits, and the decision. Rates are fixed for three years and the working is shown.
Every finding names the clause or control, the evidence examined, and why it matters. Reports are written for your board as well as your auditor.
Any customer, auditor, or tender evaluator can ask us to confirm the scope, status, and expiry of a certificate we issued. We answer within one business day.
Stage 1 dates are usually available within four weeks. We plan backwards from your customer deadline, not forwards from our calendar.
Questions
Straight answers on timing, cost, who does what, and what we will and will not do.
Guides and articles
A stage-by-stage timeline for ISO 27001 certification, from first decision to certificate, with the factors that speed it up or slow it down, from a certification body that runs the audits.
The difference between the Stage 1 readiness review and the Stage 2 certification audit, what is examined at each, and how to prepare, explained by the people who conduct them.
How accredited certification bodies calculate ISO 27001 audit fees, what IAF MD 5 audit time means for your quote, the hidden costs to watch for, and how to compare quotes fairly.
Tell us about your organisation, your ISMS scope, and your target date. We reply with a fixed-fee quote and available audit dates within two business days.