What is ISO 27001?

ISO/IEC 27001 certification involves two separate organisations, not one. An accreditation body accredits certification bodies, meaning it audits and approves the certification bodies themselves and confirms they are competent to run ISO 27001 audits correctly. In Australia and New Zealand, that accreditation body is JAS-ANZ, part of the same International Accreditation Forum network recognised worldwide. The certification body is the separate organisation that actually audits a business and issues its certificate. A genuine certificate names both organisations, the certification body that ran the audit and the accreditation body standing behind that certification body's own competence. A certificate issued by a certification body with no accreditation behind it is a printout, not evidence of an independent audit against the standard. Among the ISO 27001 certificates held by providers in this register, the accreditation body is recorded on 111 of 113. 109 are accredited through JAS-ANZ, one through ANAB and one through IAS, both other members of the same international accreditation network used outside Australia.

Annex A of ISO/IEC 27001 lists a wide set of security controls covering technical, organisational and physical measures a business might apply. Not every control applies to every business, so the standard does not require adopting all of them. What it requires instead is a Statement of Applicability, a document naming which Annex A controls the business has selected, which it has excluded, and the reasoning behind each choice. The Statement of Applicability is what an auditor actually checks a business against, alongside the risk assessment that justified those choices in the first place. This is also why two certified businesses do not necessarily run the same controls, even against the identical standard. Nearly every scope statement in this register cites a Statement of Applicability by its own version number, real evidence that it is a live document updated over time rather than a form filled in once for the initial audit and never revisited.

A scope statement names the specific part of a business a certificate actually covers, and two providers holding the identical standard can be certified for very different things. One real scope statement in this register reads "delivering solutions across IT and network support, network and cybersecurity, managed cloud computing and business phones," covering a broad managed IT relationship end to end. Another reads "cloud-based hosting services in datacentres across Australia," covering one narrow service line and nothing else the provider might sell. A business buying help desk support from the second provider would be relying on a certificate that has nothing to do with the service in the contract, even though the certificate itself is genuine and current. Reading the scope statement for the words that actually name the service being bought is the step that catches this, not the standard's name on its own. Certified providers lists which providers hold a current certificate and what each one's scope statement actually says.

ISO/IEC 27001:2022 replaced the 2013 edition of the standard. The main change affected Annex A. The 2013 edition organised 114 controls across fourteen categories. The 2022 edition consolidated these into 93 controls across four themes, covering organisational, people, physical and technological measures. A business certified under the 2013 edition was not immediately decertified when the 2022 edition arrived. Certification bodies set a transition period during which an existing 2013 certificate remained valid while the business moved its Statement of Applicability and its controls across to the new structure, with that transition period closing in October 2025. This register's own data reflects the result. 111 of the 113 ISO 27001 certificates recorded here explicitly state the 2022 revision, and the remaining two are recorded without a stated year. A certificate still showing 2013 today, if one exists, is the detail worth asking about directly.

In Australia, ISO/IEC 27001 most often comes up in security questionnaires from enterprise or government clients, cyber insurance applications, and as a prerequisite in tenders that involve handling sensitive data. A managed IT provider that holds it has had its own internal security practices audited, separately from any security work it does for clients. A small business buying everyday IT support, with no enterprise client, government contract or cyber insurance application driving the requirement, is unlikely to need their provider to hold it specifically, though a provider that holds it has still had more of its own practices independently checked than one that has not.

A certificate is scoped to specific services, and sometimes specific offices, not automatically the whole business. It also proves that a process exists and was followed at audit time, not that a breach can never happen. See how to verify an ISO certificate for what to actually check before relying on one.