# Certification body

An independent organisation that audits you against a standard or scheme and issues the certificate if you meet it.

Source: https://sted.digital/docs/glossary/certification-body · Last reviewed 17 October 2026 · Strand Glossary

A certification body is an independent organisation that audits you against a standard or scheme and, if you meet it, issues a certificate. ISO itself certifies no one. In the UK, certificates from a body accredited by UKAS are the ones customers and tenders usually expect.

## Where the term appears

The ISO standards set requirements and say nothing about who certifies against them. Certification is a separate service with its own rules: bodies that certify management systems are accredited against ISO/IEC 17021-1, which governs how they plan audits, set audit time, report findings and stay impartial. UKAS is the UK's national accreditation body. Cyber Essentials works differently: IASME, the NCSC's delivery partner, licenses the certification bodies whose assessors mark self-assessments and carry out the [Cyber Essentials Plus audit](/docs/standards/cyber-essentials/self-assessment-vs-plus). The [ISO 27001 hub](/docs/standards/iso-27001) explains how certification and enforcement work for that standard.

### Accredited, and independent

Unaccredited certificates exist and are cheaper; many buyers reject them. Before you book, check that the body is accredited for your standard and your sector. A certification body may not also act as your consultant on the system it certifies, because it would then be auditing its own advice.

## How Sted uses it

Audit readiness is the share of done items per adopted standard: approved documents, adopted requirements, records and training.
Audit readiness is visible to administrators only for now.

Sted does not certify you or choose your certification body. A certification body audits and decides; Sted holds the evidence it asks for.

## Related terms

- [Certification audit](/docs/glossary/certification-audit): what a certification body carries out, in two stages.
- [Internal audit](/docs/glossary/internal-audit): your own audit, which the certification body checks you held.
- [Nonconformity](/docs/glossary/nonconformity): the certification body grades its findings as major or minor.
- [Evidence](/docs/glossary/evidence): what its auditors sample.
- [Audit readiness](/docs/glossary/audit-readiness): being ready before the certification body arrives.