Independent certification body · ISO/IEC 27001:2022
RiskZero is an independent certification body. We audit your information security management system against ISO/IEC 27001:2022 and issue a certificate that holds up in enterprise procurement, in tenders, and in front of your board.
Built for the organizations that get asked for a certificate: the ones holding other people’s data, systems, or money.
Services
Whether you are certifying for the first time or keeping a certificate current, the audit is planned around your calendar and priced up front.
Initial certification of your ISMS against ISO/IEC 27001:2022: Stage 1, Stage 2, and an independent certification decision.
Learn moreAnnual audits in years one and two of the cycle that confirm the ISMS is maintained and your certificate stays valid.
Learn moreA full audit before your certificate expires that starts a new three-year cycle with no gap in certification.
Learn moreOne audit program covering ISO 27001 alongside ISO/IEC 27701 privacy or ISO 22301 business continuity.
Learn moreThe three-year cycle
ISO 27001 certification is not a single audit. It is a three-year cycle with defined points where we check the ISMS is still working. Here is the whole thing on one line, starting with the package your consultancy prepares before it reaches us.
Before
Your consultancy helps you build the ISMS and attests that the package is ready. It is submitted through riskzero.us.
Month 0
We review the package: scope, risk assessment, Statement of Applicability, and evidence of internal audit and management review, and confirm you are ready for Stage 2.
Month 1 to 2
On-site or remote audit of how the ISMS actually operates: interviews, records, sampled controls, and evidence.
Month 2 to 3
An independent reviewer checks the audit file. Once any nonconformities are closed, your certificate is issued and can be verified with us directly.
Month 12
A shorter audit confirming the ISMS is maintained, internal audits and management reviews have happened, and corrective actions are working.
Month 24
Second annual check, usually covering the parts of the ISMS not sampled in year one.
Month 36
A full audit before the certificate expires. Pass it and a new three-year cycle begins with no gap in certification.
Why RiskZero
A certificate is only as credible as the body that issued it. These are the things we do differently, and why they matter to the people who read your certificate.
We do not build management systems, write policies, or run internal audits. Our only product is an audit opinion, and the certificate that follows it.
Our auditors come from security and engineering roles. They read infrastructure as code, understand shared responsibility, and know what a real incident log looks like.
One proposal covers Stage 1, Stage 2, both surveillance audits, and the decision. Rates are fixed for three years and the working is shown.
Every finding names the clause or control, the evidence examined, and why it matters. Reports are written for your board as well as your auditor.
Any customer, auditor, or tender evaluator can ask us to confirm the scope, status, and expiry of a certificate we issued. We answer within one business day.
Stage 1 dates are usually available within four weeks. We plan backwards from your customer deadline, not forwards from our calendar.
Questions
Straight answers on timing, cost, who does what, and what we will and will not do.
Guides and articles
A stage-by-stage ISO 27001 certification timeline, from first decision to certificate, with the factors that speed it up or slow it down, from auditors who run them.
The difference between the Stage 1 readiness review and the Stage 2 certification audit, what is examined at each, and how to prepare, explained by the auditors.
How accredited certification bodies calculate ISO 27001 audit fees, what IAF MD 5 audit time means for your quote, hidden costs to watch for, and how to compare quotes.
Tell us about your organization, your ISMS scope, and your target date. We reply with a fixed-fee quote and available audit dates within two business days.