Skip to main content

How-to

How to Check an ISO 9001 Certificate Is Real

A step-by-step way to verify an ISO 9001 certificate against a certification body's public register, and why it is not a security framework.

Solomon AmosPublished 14 Oct 20269 min read

A vendor security questionnaire often arrives with a PDF labelled ISO 9001 attached, as if that settles the question of security maturity. It does not settle anything of the sort, and checking whether the certificate is genuine is a separate job from checking whether it is even relevant. This guide walks through confirming an ISO 9001 claim against a certification body's public register, reading the certificate itself for scope and expiry, and explaining why a quality management standard belongs nowhere near the top of a security specific vendor review.

What an ISO 9001 certificate actually says

ISO 9001 is the international standard for quality management systems, published by the International Organization for Standardization. It sets requirements for how an organisation plans, controls, documents and improves the processes it uses to deliver a consistent product or service. It does not test password policies, encryption, access control or incident response. Certification is third party: an accredited certification body audits the organisation against the standard's clauses and, if the audit passes, issues a certificate that is typically valid for three years, with annual surveillance audits in between. You can see which vendors in the index carry this certification on the ISO 9001 framework page.

Why vendors list ISO 9001 in a security review

ISO 9001 is one of the oldest and most widely held management system certifications in the world, common in manufacturing, logistics and professional services long before cloud software existed. Some software vendors carry it as a holdover from a parent company's industrial roots, others pick it up because it is relatively cheap and fast to obtain compared with a security specific audit. Either way, it tends to get listed on a compliance page alongside genuinely security relevant evidence, and a buyer skimming the page can easily assume the two are equivalent.

  • It signals process discipline, not control testing: a well run quality system says nothing about patch cadence or encryption at rest.
  • It is often the first certification a smaller vendor obtains, sometimes before any security specific audit has even started.
  • It appears on trust pages next to SOC 2 and ISO 27001 badges, which can blur the distinction for a reviewer working through a stack of logos quickly.
  • It is frequently inherited from a parent company's manufacturing or services division rather than scoped to the software product being sold.

The three layers behind every claim: certificate, certifier, accreditor

ISO itself does not issue certificates. A vendor is audited and certified by an independent certification body, such as BSI, DNV, SGS, Bureau Veritas or TÜV, and that certification body is in turn accredited by a national accreditation body, such as UKAS in the United Kingdom or ANAB in the United States. The International Accreditation Forum, IAF, maintains a global database called IAF CertSearch that lets anyone look up whether a given certificate was issued by an accredited body. Checking a claim properly means confirming all three layers line up: a real certificate, issued by a real accredited certifier, that itself sits under a recognised accreditation body. A full list of the certification bodies and auditors that issue the frameworks tracked in the index is on the auditors page.

Step by step: checking the register entry

  1. 1

    Ask for the certificate number and issuing body

    Request the exact certificate number, the name of the certification body that issued it, and the legal entity named on the certificate. A vendor that cannot supply these within a day is a weak signal on its own.

  2. 2

    Confirm the certification body is accredited

    Search the certification body's name in IAF CertSearch or the relevant national accreditation body's register. If the certifier does not show up as accredited for ISO 9001, the certificate carries no external assurance at all.

  3. 3

    Search the certifier's own public register

    Most large certification bodies publish a free lookup tool on their own site where you can enter a certificate number or company name and see the current status directly from the source.

  4. 4

    Check the IAF CertSearch record for the certificate itself

    Where available, IAF CertSearch lists the certificate record directly, including issue date, expiry date and scope, independent of what the vendor has typed on its own trust page.

  5. 5

    Match the legal entity and scope to what you are buying

    Confirm the certified entity is the one actually delivering the product or service to you, not a sibling company or a division that does not touch your data.

  6. 6

    Note the expiry date and surveillance schedule

    Record the expiry date and flag it for review before it lapses. A certificate that is valid today but expires next month is not evidence you can rely on for a long term contract.

Reading the certificate itself

Once you have the certificate in hand, three fields matter more than the logo at the top. The scope statement describes exactly what activity was audited, for example design and delivery of customer support services, which may or may not cover the part of the business you are relying on. The site or address list shows which locations the certification covers, relevant if the vendor operates from several offices or has acquired another company since the last audit. The expiry date and last surveillance audit date tell you whether the certification body has actually looked at the organisation recently, since a certificate issued three years ago with no visible surveillance history is worth less than one with an annual audit trail attached.

StandardWhat it certifiesTypical issuerRelevance to a security review
ISO 9001Quality management system: process consistency, documentation, continuous improvementAccredited certification body (BSI, DNV, SGS, TÜV and others)Background context only, not a substitute for a security specific audit
ISO 27001Information security management system: risk assessment, Annex A controlsAccredited certification bodyDirectly relevant, the standard most comparable to SOC 2 for security posture
SOC 2Report against the AICPA Trust Services Criteria, not a certificateLicensed CPA firmDirectly relevant, read the report rather than trust a badge, see how to read a SOC 2 report

How ISO 9001 compares with the two security specific standards it is most often confused with on a vendor compliance page.

Flow diagram showing a vendor claim checked against a certification body register and then an accreditation body register
Verifying an ISO 9001 claim means checking two registers, not one logo.

Why ISO 9001 is not a security framework

Quality management and information security management share some structural DNA, both use the same Annex SL high level structure that ISO applies across its management system standards, which is why the clause numbering can look similar on paper. But the content underneath is different in kind. ISO 9001 asks whether an organisation has a documented, monitored process for delivering its product consistently. ISO 27001 asks a security specific question: has the organisation identified its information security risks and implemented a defined set of controls to manage them, audited against Annex A. Read the ISO 27001 framework page or SOC 2 vs ISO 27001: what to ask vendors for before accepting an ISO 9001 certificate as proof of anything security related.

ISO 9001:2015 sets out the criteria for a quality management system and is the only standard in the family that can be certified to, although this is not a requirement. It is used by organisations of all sizes and across all sectors.
Lower overlap
ISO 9001 listings versus ISO 27001 listings
in the CertReports index on 2026-10-14, vendors far more often publish ISO 27001 than ISO 9001 on their trust pages
Three years
typical certificate validity before re-certification
standard across most accredited certification bodies for ISO management system standards
Annual
surveillance audit cadence between re-certifications
a missing surveillance history is a common gap found during vendor evidence checks

What this looks like in a vendor's published evidence

The contrast is easiest to see on a trust centre that lists several ISO certifications side by side. Look at which entries carry a security specific scope, such as ISO 27001 or its extensions for privacy and cloud services, and which address something else entirely, such as quality management. Check whether each entry links back to a certification body or an accreditation register rather than resting on a badge image alone, and whether the stated scope matches the product you would actually be buying.

Docebo logo

Docebo · Trust report

Education · Public evidence as of 19 Oct 2026

Visit trust centreFull evidence

Framework overview

CertReports state for each framework with public evidence: 2 verified, 9 vendor-stated.

2 more frameworks on the evidence page

5Documents and agreements

Legal and review documents Docebo publishes or offers, as of 30 Sep 2026.

2Security practices

Public statements from Docebo, shown as statements, not attestations, as of 30 Sep 2026.

  • Penetration testing · annual
  • Data residency · Australia, Canada, EU, India, US

1Subprocessors

Named on Docebo's public subprocessor list, last seen 30 Sep 2026.

A trust centre listing several ISO certifications side by side makes the scope differences easy to miss unless each one is checked separately. Every line is a dated public record from the FedRAMP Marketplace, the Data Privacy Framework list and Docebo's trust centre. A framework not shown means no public evidence was found, not that Docebo lacks it.CertReports

Red flags that mean the claim does not hold up

  • No certificate number is provided, only a badge image on the marketing site, with no way to trace it back to an issuing body.
  • The named certification body does not appear in IAF CertSearch or the relevant national accreditation register at all.
  • The certificate's scope statement excludes the product or team you are actually contracting with.
  • The expiry date has already passed, but the vendor's compliance page still presents the certification as current.
  • The certified legal entity is a parent company or a different subsidiary from the one signing your contract.
Checklist graphic listing certificate number, certifying body, accreditation status, scope and expiry date as the five fields to verify
Five fields to confirm before accepting any ISO certificate as current evidence.

Putting it in context with the rest of a vendor review

ISO 9001 verification is a small, mechanical task that should take a few minutes once you have the certificate number, and it is worth doing precisely because it is quick. The bigger task is deciding how much weight the certificate deserves once verified, which for a software vendor is usually not much, since quality management says nothing about how the vendor handles your data. A proper review should spend most of its time on security specific evidence instead, following something closer to a 30-minute vendor security review using public evidence, checking SOC 2 reports, ISO 27001 scope statements and any regulation specific evidence such as a signed BAA before an ISO 9001 badge gets any credit at all.

People also ask

What is iso 9001 certification?

ISO 9001 certification is independent confirmation that an organisation's quality management system meets the requirements of the ISO 9001 standard, published by the International Organization for Standardization. An accredited certification body audits the organisation's processes for consistency, documentation and continuous improvement, then issues a certificate, usually valid for three years with annual surveillance audits. It covers process management generally, not information security.

What is iso 9001 compliance?

ISO 9001 compliance means an organisation's processes satisfy the standard's clauses, such as having documented procedures, measurable quality objectives and a process for corrective action. Compliance can exist without formal certification, since a company can run its operations in line with ISO 9001 internally. Certification is the independently audited version, verified through a registered certification body rather than claimed by the organisation itself.

How to get iso 9001 certification?

An organisation first builds a quality management system that meets the ISO 9001 clauses, often with internal audits to check readiness. It then selects an accredited certification body, which runs a two stage external audit: a documentation review followed by an on-site assessment of whether the system actually operates as described. If the audit passes, the certification body issues a certificate, with surveillance audits each year to keep it valid.

How to check iso 9001 certification?

Ask the vendor for the certificate number, the certifying body's name and the exact legal entity covered. Search that certification body in IAF CertSearch or its national accreditation register to confirm it is accredited, then check the certifier's own public lookup tool for the certificate's current status, scope and expiry date. Confirm the scope actually covers the product or service you are buying before relying on it.

ISO 9001certification verificationvendor security reviewquality managementauditors
S

Solomon Amos · Founder, CertReports

Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.

Read next on CertReports

You might also like