How to choose an ISO/IEC 27001 certification body in the US

This page is a buying guide for the certification body. It is for operations, quality, IT, and compliance leads at mid-market manufacturers and professional-services firms who already know the artifact this cycle is an ISO/IEC 27001 certificate, and who now have to pick the body that can issue it in the United States.

The useful question is narrow. Which legal entity is accredited for ISO/IEC 27001:2022, under a mark your customer will accept, with people who can sample the information you actually hold. A familiar logo, a quality relationship, and a slide that says "security" are three different facts.

If the room is still choosing the artifact, stop here and settle that first. Quality versus information security is ISO 9001 vs ISO 27001. A SOC 2 report versus the certificate is ISO 27001 vs SOC 2. A NIST Cybersecurity Framework profile versus the certificate is ISO 27001 vs NIST CSF. Privacy certification versus the information-security certificate is ISO 27001 vs ISO 27701. Business continuity versus information security is ISO 22301 vs ISO 27001. Information security versus an AI management system is ISO 27001 vs ISO 42001. This page starts after that sentence is written.

It does not publish prices, audit-day counts, durations, or a ranking. The comparison table below uses only what each profile in this directory already states about a cited accreditation scope. Confirm the live schedule in the quarter you would book.

1. What you are buying

ISO's certification page states that ISO develops standards and does not perform certification or issue certificates. Certification is an independent body giving written assurance that a system meets specified requirements. Accreditation is a further body recognizing that the certification body operates to international standards.

The standard your organization would be certified to is ISO/IEC 27001:2022. ISO's catalogue entry records edition 3, publication date 2022-10, and stage 60.60 (international standard published on 2022-10-25). The page describes requirements for establishing, implementing, maintaining, and continually improving an information security management system. The same page notes that the standard has one amendment. Ask the body whether the line you will claim includes that amendment. Do not add a second certificate for it.

The certificate records that a certification body examined that system for a defined scope: the information and activities in boundary, the risk treatment, and a Statement of Applicability you can defend. It does not promise that a breach cannot happen. It is not a penetration-test report, a privacy-law badge, a SOC 2 report, or a NIST CSF profile.

2. Why the accreditation mark is a 27001 question

Management-system certification bodies are assessed against ISO/IEC 17021-1. A body can be accredited for ISO 9001 and still have no accredited scope for ISO/IEC 27001. Copying the plant registrar onto an information-security request is how a 27001 pack goes to a body whose schedule you have not read.

The IAF MLA member list dated 1 August 2025 records three accreditation bodies US buyers meet on this buy as signatories for management-systems certification, Level 3 document ISO/IEC 17021-1, with ISO/IEC 27001 (information security management systems) as a Level 5 sub-scope:

• ANAB (ANSI National Accreditation Board), sub-scope dated 5 April 2018 on that list.
• UKAS (United Kingdom Accreditation Service), sub-scope dated 5 April 2018 on that list.
• IAS (International Accreditation Service), sub-scope dated 27 July 2018 on that list.

IAF's MLA status document, headed 23 December 2025, names ISO/IEC 27001:2022 as the Level 5 information-security standard under management-system certification. Peer evaluation is why an ANAB mark, a UKAS mark, and an IAS mark are the same class of accreditation on a questionnaire. Equivalence is not a guarantee that every portal accepts every mark. Some customers still write "ANAB only" or "UKAS only." Write that constraint before you invite anyone.

The MLA does not make every certification body interchangeable. The body's own schedule, the legal entity, the edition, and the people who will sample your information still decide the award. The lookup method is how to verify an ISO registrar's accreditation.

3. The 2013 edition and the 2022 edition

IAF MD 26 Issue 2 (15 January 2023) is the transition document for this change. It names ISO/IEC 27001:2022 as the normative document replacing ISO/IEC 27001:2013, and it sets a transition period of 3 years (36 months). The key timescale says certification-body transitions of certified clients are to be completed by 31 October 2025.

That date has passed. Name ISO/IEC 27001:2022 on the request. Several profiles in the table below still record a 2013 line on the accreditation scope beside the 2022 line. That is a fact about the body's schedule. It is not an invitation to buy a 2013 certificate. Ask the body which edition it will print, and read the live schedule before you treat a reply as comparable.

4. How to verify a certification body's 27001 scope

Use the verify guide and add the 27001 specifics. The steps are the same shape as any other standard. The failure mode is inference.

1. Ask, in writing, for the legal entity that will sign the certificate, the accreditation body, and the edition ISO/IEC 27001:2022.
2. Open that accreditation body's directory and read the current schedule for that legal name. ANAB's management-systems directory is the usual US start. UKAS find-an-organisation is the check when the proposal says UKAS. IAS is the check when the proposal says IAS. IAF CertSearch is where you trace accredited certificates and certification-body identities. Use both the accreditation-body directory and CertSearch. A brand search is not either one.
3. Read the 27001 line itself. Some schedules print an edition year and a date. Some print more than one edition. Match the edition to the certificate you will claim.
4. Refuse the shortcuts. A 9001 line does not include 27001. A group brochure, a press release, and a sister company's schedule do not include it. The US company and the UK company inside one brand can hold different scopes. Match the entity on the proposal to the entity on the schedule.
5. Re-check before Stage 1, in the quarter you would book. A schedule you saved at shortlist time can move.

The directory on this site is an editorial shortlist. A profile is a reading of public scopes at the time it was written. It is not the live schedule.

5. Profiles in this directory that record 27001 on a cited scope

The table includes a certification body only when its profile states that ISO/IEC 27001 is on a cited ANAB, IAS, or UKAS scope for the named legal entity. Cells repeat the profile. They do not add a later lookup, a price, or a ranking. Where the profile does not record an accreditation ID, the cell says so.

Certification body	Accreditor and scope ID, as the profile records it	27001 edition the profile records	Other scopes the same profile records (27701, 42001, 22301, 9001)	Best fit, from the profile
A-LIGN	ANAB public scope for A-LIGN Compliance and Security, Inc. dba A-LIGN. A UKAS schedule for the same entity. The profile does not record an accreditation ID.	ISO/IEC 27001, including the 2022 edition, on the ANAB scope. ISO/IEC 27001:2022 on the UKAS schedule.	ANAB lists ISO/IEC 42001:2023, ISO/IEC 27701, and ISO 22301. UKAS lists ISO/IEC 27701:2019 and does not list ISO/IEC 42001. ANAB records a voluntary withdrawal of ISO 9001 in November 2020. The current ANAB scope does not list ISO 9001.	Specialist for technology, healthcare, financial services, and defense or federal suppliers that need an information-security certificate, often beside a SOC 2 report. Not the factory registrar for ISO 9001, ISO 14001, or ISO 45001. A broader registrar can stay on the plant certificates.
Amtivo	ANAB scope Amtivo publishes for Amtivo (USA), Inc., Arvada, Colorado. Accreditation ID MS-3993. Issue date 21 November 2025. Accreditation expires 20 September 2027. UKAS lists British Assessment Bureau Limited trading as Amtivo, a different legal entity.	ISO/IEC 27001:2013 as of 14 June 2021, and ISO/IEC 27001:2022 as of 18 August 2023. ISO/IEC 27001 has no sector table.	ISO 9001:2015 is on the same issue. ISO/IEC 42001 is absent. The profile does not record ISO/IEC 27701 or ISO 22301 on this scope.	U.S. management-system registrar, formerly Orion, for plants that need ISO 9001 with ISO 14001 or ISO 45001, and for teams that also need ISO/IEC 27001. Do not treat the UKAS Amtivo listing as this company's mark.
Coalfire	ANAB scope for Coalfire Certification, Inc., Alpharetta, Georgia. Accreditation ID MS-4539. Issue date 13 August 2026. Expiry 17 December 2028. The profile did not match a UKAS schedule to this legal entity.	ISO/IEC 27001:2013 as of 17 December 2014, and ISO/IEC 27001:2022 as of 8 March 2023. Neither line has a sector table.	The same issue lists ISO/IEC 27701:2019 and ISO/IEC 27701:2025, ISO/IEC 42001:2023, and ISO 22301:2019. ISO 9001:2015 is economic sector 33, information technology, only. ISO 14001 and ISO 45001 are absent.	U.S. registrar for service organizations in cloud and technology, healthcare, and financial services. A plant quality code is not on this 9001 line. The proposal has to name Coalfire Certification, Inc., not Coalfire Systems, Inc.
Eagle	ANAB scope Eagle publishes for EAGLE Registrations Inc., Dayton, Ohio. Issue date 2 June 2026. Expiry 1 March 2031. The profile does not record an accreditation ID. A separate ANAB scope for EAGLE Food Registrations Inc. is a different issuer. The profile did not match a UKAS schedule to either entity.	ISO/IEC 27001:2022 as of 29 May 2026, without a sector table.	ISO 9001:2015 is on the June 2026 scope. ISO/IEC 42001 is absent. The profile does not record ISO/IEC 27701 or ISO 22301 on this scope.	Dayton plant registrar for ISO 9001, with ISO 14001 or ISO 45001 beside it, device makers that need ISO 13485, and teams that need ISO/IEC 27001. The food company at the same address is not this 27001 issuer.
Insight Assurance	IAS scope for Insight Assurance, Tampa, Florida, operating virtually. Accreditation ID MSCB-306. Effective date 9 October 2026. The IAS certificate page lists status Accredited and expiry 1 December 2026. The profile did not match an ANAB or UKAS schedule to this name.	ISO/IEC 27001:2022. The scope does not print ISO/IEC 27001:2013 as a current standard. Certification sectors are N/A.	The same scope lists ISO/IEC 27701:2019 and ISO/IEC 27701:2025, and ISO/IEC 42001:2023. ISO 9001 is absent. Public pages name ISO 22301. MSCB-306 does not list it.	U.S. registrar for cloud service providers, healthcare, financial institutions, and SaaS vendors that need information security, privacy, or AI management. Not a plant registrar for ISO 9001, ISO 14001, or ISO 45001. Read the 1 December 2026 expiry before you book.
NQA	UKAS schedule for NQA Certification Ltd, trading as NQA Certification and KIWA, Houghton Regis. ANAB scope for National Quality Assurance, USA, Acton, Massachusetts, dated 26 March 2026. The profile does not record an accreditation ID for either schedule.	ISO/IEC 27001:2022 on both published scopes.	ISO/IEC 27701 appears on both. ISO/IEC 42001:2023 is on the UKAS schedule, including the roles developer, producer, provider, and user. The ANAB scope does not list ISO/IEC 42001. ISO 22301:2019 appears on the ANAB scope and in the UKAS summary. ISO 9001:2015 is on both.	General management-system registrar for plants that need ISO 9001, with ISO 14001 or ISO 45001 beside it, and for teams that need ISO/IEC 27001. Ask which legal entity grants the certificate and which mark will be printed.
TÜV Rheinland of North America	ANAB scope for TUV Rheinland of North America, Inc., Boxborough, Massachusetts. Issued 9 February 2026. Expiry 1 November 2030. The profile does not record an accreditation ID. The profile did not match a UKAS schedule to that legal entity.	ISO/IEC 27001:2013 and ISO/IEC 27001:2022.	The same scope lists ISO/IEC 27701:2019, ISO/IEC 42001:2023, and ISO 9001:2015. It also lists ISO 14001:2015 and ISO 45001:2018. The profile does not record ISO 22301 on this issue.	General U.S. management-system registrar for plants that need ISO 9001, with ISO 14001 or ISO 45001 beside it, and for teams that need ISO/IEC 27001 or ISO/IEC 42001. Not TÜV SÜD, not TÜV Rheinland Cert GmbH, and not TUV UK Limited.

NQA is two issuers. Both published scopes list ISO/IEC 27001:2022. The UKAS schedule lists ISO/IEC 42001. The ANAB scope for the Acton company does not. NQA's U.S. regulations say the U.S. company issues ANAB certificates under its own scope and issues UKAS certificates on behalf of NQA Certification Limited. Ask which entity grants the certificate.

A-LIGN has the same shape on the AI line, and the reverse shape is not the 27001 line. Both the ANAB scope and the UKAS schedule list ISO/IEC 27001:2022. UKAS does not list ISO/IEC 42001. ANAB does not list current ISO 9001.

Coalfire's quality line is information technology. Sector 33 is not a plant code. A manufacturer that needs ISO 9001 for fabrication, and ISO/IEC 27001 for drawings or a connected line, should not treat that 9001 line as the factory certificate.

Eagle's food company is a different scope. ISO/IEC 27001:2022 is on the June 2026 scope for EAGLE Registrations Inc. It is not a reason to award EAGLE Food Registrations Inc.

Amtivo's UK listing is a different company. MS-3993 is Amtivo (USA), Inc. British Assessment Bureau Limited trading as Amtivo is not that accreditation.

Insight Assurance's mark is IAS, and the certificate page lists expiry 1 December 2026. MSCB-306, effective 9 October 2026, lists ISO/IEC 27001:2022. The profile did not match an ANAB schedule to this name. A portal that accepts only ANAB does not get that mark from this row. Do not confuse this firm with Insight Certification Limited, a different body.

TÜV Rheinland of North America is the general registrar in this table whose ANAB scope, as the profile states it, lists 9001, 14001, 45001, 27001, 27701, and 42001 for TUV Rheinland of North America, Inc. The profile did not match a UKAS schedule to that entity.

Confirm scope before you shortlist

The other profiles in this directory are not rows. Each one tells you to confirm a live schedule. None of them records ISO/IEC 27001 on a cited ANAB, IAS, or UKAS scope for a named legal entity.

• BSI. Publicly associated with ANAB, UKAS, and RvA. Confirm the current schedule for your standard and geography. The profile does not cite a schedule that lists ISO/IEC 27001 for a named company.
• Bureau Veritas. Certification entities are widely listed by IAF MLA accreditation bodies, including ANAB, for schemes such as ISO/IEC 27001. Confirm the specific legal entity and current scope. The profile does not cite a schedule.
• DEKRA. Certification companies are described as established accredited bodies. Confirm the legal entity and live scope. Group pages are not a certificate.
• DNV. Published service pages cover ISO/IEC 27001. Confirm the legal entity, the accreditation body, and the current scope. The profile does not cite a schedule.
• Intertek. Certification entities appear in IAF directories. Confirm which Intertek or SAI Global legal entity would issue the certificate and which mark applies. The profile does not cite a 27001 schedule. The JAS-ANZ note in that profile is about ISO/IEC 42001.
• LRQA. Described as a mainstream option for ISO/IEC 27001. A public announcement described UKAS accreditation for ISO/IEC 42001. Confirm the current schedule for the entity that would issue your certificate. The profile does not record 27001 on a cited schedule.
• NSF. Public pages cover ISO/IEC 27001, and NSF describes its management-system activity as ANAB-accredited. Confirm the certification legal entity and the live ANAB scope. The profile does not cite a schedule or an accreditation ID.
• Perry Johnson Registrars. Appears in ANAB and IAF listings for management-system certification. Public materials cover ISO/IEC 27001. The profile says that peer familiarity is not accreditation, and it tells you to confirm the current accredited standards. It does not cite a schedule.
• Schellman. Called a known ISO/IEC 27001 certification body, and told to confirm the current ANAB scope. The profile states a September 2024 public announcement of ANAB accreditation for ISO/IEC 42001. It does not cite a 27001 schedule or a certificate ID. It is not listed as a general ISO 9001 factory registrar.
• SGS. Operating companies appear in IAF and national accreditation directories. Confirm the entity named on the proposal. The profile does not cite a 27001 schedule for a named company.
• TÜV SÜD. Certification companies are described as listed by major accreditation bodies, and public pages describe ISO/IEC 27001 services. Ask for the company name and the accreditation IDs. The profile does not cite a schedule. This is a different business from TÜV Rheinland of North America.

An announcement, a service page, or a directory tag is a reason to open the profile. It is not a statement that a published scope lists the standard. Read that profile, then verify the legal entity.

6. How to choose among bodies that can actually sign

Accreditation is the gate. It is not the whole award. Four practical tests separate a body you can hire from a body that merely cleared the scope check.

Auditor competence for the information you hold. On a plant, the sample is often drawings, process data, a connected line, and the people who administer access. In a professional-services firm, the sample is client information, the systems that hold it, and the delivery process. A lead auditor who can sample a quality management system still has to show they can sample risk treatment and a Statement of Applicability. Ask for anonymized examples of similar ISMS audits: the kind of information, and the sector. A name on a 9001 certificate is not that example.

One programme or two bodies. One programme is an honest request when both systems already run, both owners can sit the audit, and the same legal entity's scope covers each standard you want on the certificate. You may still receive two certificates. A second certification body is a clean design when the scopes diverge. A specialist whose scope lists 27001, and whose profile does not list factory 9001, can hold the information-security certificate while the plant registrar keeps 9001. A plant registrar whose scope lists both can hold both when the quality sector on that scope matches the work. Write the design on purpose.

Scope definition. The certificate boundary is the information you will claim, the sites where it is processed, and the legal entity that owns the system. The plant site list is often the wrong map. Information work sits at headquarters, a development office, or a cloud estate the factory certificate never named. Name what is out as clearly as what is in. The outbound page for that description is the RFQ / scope pack.

The mark the customer named. If the portal says ANAB only, an IAS row does not fill it, and a UKAS-only line does not fill it. If the portal says UKAS only, read which legal entity holds that schedule. NQA and A-LIGN are the explicit splits in this table.

7. What moves the price, without a price list

This page does not publish fees, day rates, audit-day counts, or durations. Two quotes for "ISO 27001" diverge when they are not the same programme. Sites, headcount bands, the information boundary, whether ISO 9001 is on the same pack, travel, remote versus on-site, and the three-year cycle (Stage 1, Stage 2, surveillance, recertification) all change what the body is selling. Freeze those drivers on one pack and compare the replies. The chapter for that comparison is what drives ISO certification cost.

8. SOC 2 is a different permission

A SOC 2 report is an attestation by a licensed CPA firm. It is not a line on an ANAB, IAS, or UKAS schedule. One firm can sell both only when the proposal names two permissions you have checked separately. The buying comparison is ISO 27001 vs SOC 2.

In this directory, the A-LIGN profile says public pages describe both products and that coordination is not one permission. The Insight Assurance profile records an about note that calls the firm a licensed CPA firm and lists SOC examinations, and it tells you to confirm the CPA signer. MSCB-306 is not that check. Do not infer a CPA license from any other row.

9. Adding ISO/IEC 27701 or ISO/IEC 42001 later

Privacy certification and an AI management certificate are later buys, or a second line on this pack, only when that system exists and the same legal entity's schedule lists the standard.

ISO/IEC 27701 is not included in a 27001 line. The comparison is ISO 27001 vs ISO 27701. Profiles in the table that record a 27701 line are A-LIGN, Coalfire (2019 and 2025), Insight Assurance (2019 and 2025, with the transition dates printed on MSCB-306), NQA (both scopes), and TÜV Rheinland of North America (ISO/IEC 27701:2019). Amtivo and Eagle do not record it.

ISO/IEC 42001 is not included in a 27001 line. The directory comparison for that certificate is how to choose an ISO/IEC 42001 certification body in the US. On the profiles in the table above, 42001 is recorded for A-LIGN on ANAB and not on the UKAS schedule cited, for Coalfire on ANAB, for Insight Assurance on IAS, for NQA on UKAS and not on the ANAB scope, and for TÜV Rheinland of North America on ANAB. Amtivo and Eagle record that ISO/IEC 42001 is absent.

If either standard is twelve months out, write "later" and a recheck date. Do not ask five bodies to quote a line you cannot staff.

10. The implementer is not the certifier

Accredited certification is an independent audit. If one firm drafted the information security management system, that firm should not be the body that certifies it. Disclose the implementer on the pack. Do not let the implementer be the only source of registrar names. The buying split, and the red flags, are consultant vs certification body.

The Coalfire profile is the explicit case to read before you treat a group name as two permissions. It says optional readiness assessments, including a mock audit, are delivered by the certification body's own lead auditors, and that those pages do not bar a readiness auditor from the certification audit and do not describe a wall between Coalfire Certification, Inc. and work sold by Coalfire Systems, Inc. Ask the question in writing.

11. Questions to put on the RFQ

Put these on the pack, in writing, so every reply restates the same facts. Leave fees, day-rate guesses, and "how long it usually takes" off this page. Ask the body to show its own calculation against your scope. The checklist for the pack is the RFQ / scope pack.

1. What legal entity will sign, and which accreditation mark will be printed on the ISO/IEC 27001 certificate?
2. On what date did you last read that entity's live schedule, and does it list ISO/IEC 27001:2022 for our locations?
3. Who will audit, and what ISMS audits have they done that resemble our information (plant and operational technology, professional services, or a SaaS platform)?
4. Restate our scope: information in, information out, sites, central function, and headcount band per site. Flag anything you will not accept.
5. We already hold ISO 9001, or we want it on this programme. Can this legal entity cover every standard on this pack? What will be one programme, and what stays a separate certificate?
6. If SOC 2 is also in the request, which CPA firm will sign, and which Trust Services Criteria did the customer name? The accreditation schedule is not that check.
7. If ISO/IEC 27701 or ISO/IEC 42001 is a later add, what has to be true before you will quote it, and what recheck date should we put on the file?
8. Which offices will do the work, and is each office an accredited location on the schedule?
9. Did this body, or a related company, write the information security management system? If yes, say so.

Three to five bodies is enough when each one can actually be awarded. Build that set from the constraint (the mark, the sector, the standards on this cycle), then score replies. One famous name and four bodies that cannot sign 27001 is a one-horse shortlist.

12. Mistakes that waste the first round

Sending 27001 to the 9001 registrar without reading the schedule. The relationship is useful. The scope is a separate line.

Treating a UK company and a US company as one accreditation. NQA's profile is the explicit case for the mark. Amtivo's profile is the explicit case for a different legal entity under a similar brand.

Buying the group announcement. A press release that a group offers ISO/IEC 27001 is a prompt to look up the legal entity. It is not a row in the table above.

Asking for ISO/IEC 27001:2013 after 31 October 2025. IAF MD 26 set that as the end of the client transition. Name the 2022 edition.

Confusing a framework, a SOC 2 report, or a privacy add-on with the certificate. Each of those is a different artifact. The comparisons are linked above.

Putting 27001 on the pack before an ISMS exists. A scope, a risk assessment, a Statement of Applicability someone can defend, and a named owner are the system. A policy binder nobody runs is a project. Finish it, or hire implementation help that will not also certify you, then send the RFQ.

Using the plant site list as the ISMS site list. The information often lives somewhere the ISO 9001 certificate never named.

Scoring the logo before the legal entity. Put the familiar name and the specialist in the same columns: entity, mark, 27001 edition, 9001 sector, 27701 line, 42001 line, auditor examples, scope restatement. The brochure loses to the schedule.

13. Send one pack

When the standard is ISO/IEC 27001:2022, the system exists, and you know which mark the customer accepts, send one scope pack to every body you could award. The checklist is the RFQ / scope pack. Verify each legal entity with the accreditation walkthrough before you treat a reply as comparable.

Use Get quotes for that pack. Tick ISO/IEC 27001 only for this cycle. In Scope notes, name the mark (ANAB, UKAS, or IAS), the information in and out, the sites, and whether 9001, 27701, or 42001 shares the programme. Put any certificate you already hold in Existing certificates. Submit once. The body that cannot show ISO/IEC 27001:2022 on the live schedule should fall out before you compare anything else.