Certification body
A certification body is an independent organisation that audits you against a standard or scheme and, if you meet it, issues a certificate. ISO itself certifies no one. In the UK, certificates from a body accredited by UKAS are the ones customers and tenders usually expect.
Where the term appears
The ISO standards set requirements and say nothing about who certifies against them. Certification is a separate service with its own rules: bodies that certify management systems are accredited against ISO/IEC 17021-1, which governs how they plan audits, set audit time, report findings and stay impartial. UKAS is the UK’s national accreditation body. Cyber Essentials works differently: IASME, the NCSC’s delivery partner, licenses the certification bodies whose assessors mark self-assessments and carry out the Cyber Essentials Plus audit. The ISO 27001 hub explains how certification and enforcement work for that standard.
Accredited, and independent
Unaccredited certificates exist and are cheaper; many buyers reject them. Before you book, check that the body is accredited for your standard and your sector. A certification body may not also act as your consultant on the system it certifies, because it would then be auditing its own advice.
How Sted uses it
- Audit readiness is the share of done items per adopted standard: approved documents, adopted requirements, records and training.
- Audit readiness is visible to administrators only for now.
Sted does not certify you or choose your certification body. A certification body audits and decides; Sted holds the evidence it asks for.
Related terms
- Certification audit: what a certification body carries out, in two stages.
- Internal audit: your own audit, which the certification body checks you held.
- Nonconformity: the certification body grades its findings as major or minor.
- Evidence: what its auditors sample.
- Audit readiness: being ready before the certification body arrives.