certdeadline

What does this ISO 27001 clause require?

One tender sentence can hold 5 requirements. Paste it to split them, with the questions to send before the clarification deadline.

Body Scope Version Equivalent Date One sentence, split in parts

From the tender or contract. The text stays in your browser.

See your result: Other evidence can count
Or start from an example

Pick 1. It replaces the text above.

Your clause

Other evidence can count

The buyer must consider evidence of the same measures. The buyer decides what is equivalent.

7 requirements found

This clause sets the date the certificate is checked. Plan the certification against that date

Get the clause brief for your bid team

  • A PDF with the clause and its 7 requirements.
  • The proof each one needs, and the questions to send.
  • An email if a procurement rule in it changes.

We store your email and the clause types found, and alert you when a rule for them changes. Privacy

What each part requires

Tenderers must hold a valid ISO/IEC 27001:2022 certificate issued by a UKAS-accredited certification body, or equivalent, covering the services in scope, at the time of tender submission.

  1. A valid certificateA certificate that is in force on the date the buyer checks it.
    Requires
    A certificate that is in force on the date the buyer checks it. A certificate exists only after the certification body takes its certification decision.
    Proof
    A copy of the certificate, plus the entry in the certification body's online register. Buyers check the certificate number, the scope and the expiry date.
    Timing
    The planner date that matters is the certification decision, not the end of the Stage 2 audit. The decision comes about 3-4 weeks after Stage 2 in the typical case, and can take 10 weeks.
    Watch
    A Stage 2 report with a recommendation is not a certificate. The decision can still be negative or delayed by open nonconformities.
  2. Issued by an accredited bodyThe certification body must hold an accreditation for ISO/IEC 27001 from a national accreditation body.
    Requires
    The certification body must hold an accreditation for ISO/IEC 27001 from a national accreditation body. The certificate then carries the accreditation body's mark.
    Proof
    The certificate shows the accreditation mark and number. The buyer can find the certification body in the accreditation body's public register.
    Timing
    No extra time if you choose an accredited body when you send the RFQ. A certificate from a non-accredited body fails the clause, and starting again costs the full cycle.
    Watch
    Ask each quoting body which accreditation body accredits it for ISO/IEC 27001, and check the register yourself. Some bodies hold accreditation only for other standards.
  3. A named accreditation bodyThe clause names one national accreditation body.
    Requires
    The clause names one national accreditation body. Read literally, it excludes certificates accredited elsewhere.
    Proof
    A certificate whose accreditation mark matches the named body, or a written answer from the buyer that accepts an equivalent.
    Timing
    If you hold or plan a certificate under another accreditation body, ask early. A refusal leaves you the full certification cycle with a different body.
    Watch
    EU public buyers must recognise equivalent certificates from bodies in other Member States. UK public buyers may not require particular qualifications without allowing equivalents. Private buyers have no such duty.
  4. "Or equivalent"The buyer must consider other evidence of the same security measures.
    Requires
    The buyer must consider other evidence of the same security measures. The buyer decides what is equivalent.
    Proof
    Buyers have asked for a certificate or an audit report that shows the standard is met. Other options are an independent audit report against ISO/IEC 27001, or a documented description of measures.
    Timing
    Equivalence can let you bid before the certificate exists. Ask during the clarification period, so the answer binds all bidders.
    Watch
    Do not assume. Get the answer in writing through the clarification process before the submission date.
  5. The scope must cover the contractThe scope statement printed on the certificate must name the services, systems or sites that deliver the contract.
    Requires
    The scope statement printed on the certificate must name the services, systems or sites that deliver the contract.
    Proof
    The buyer reads the scope line and any site annex on the certificate.
    Timing
    You set the scope when you apply. Changing it after certification needs a scope extension audit. Set it right in the RFQ.
    Watch
    A group certificate with a narrow scope, for example one office or one product, can fail this clause even when the company name matches.
  6. Version of the standardThe certificate must name the 2022 edition.
    Requires
    The certificate must name the 2022 edition. The transition for 2013 certificates ended on 2025-10-31.
    Proof
    The edition year printed on the certificate.
    Timing
    None for a new certificate: every audit now uses the 2022 edition. A 2013 certificate is no longer valid.
    Watch
    Old tender templates still say 2013. Ask, do not guess.
  7. When the certificate is neededThe clause sets the date the certificate is checked.
    Requires
    The clause sets the date the certificate is checked. Submission, award, contract start and a period after award are all common.
    Proof
    The certificate on that date. Before that date, a status letter from your certification body.
    Timing
    This date is the deadline to enter in the planner. Contract start is often 1-3 months after submission, which can change the verdict.
    Watch
    If the clause is silent, assume the buyer checks at submission. Ask before you plan around a later date.

Questions to send the buyer

  1. On which date must the certificate be valid: at submission, at contract award or at contract start?
  2. Do you accept accreditation from any national accreditation body that signs the EA multilateral agreement?
  3. Will you accept a certificate from a certification body accredited by another accreditation body that signs the EA or Global Accreditation Cooperation agreements, as equivalent?
  4. Which evidence do you accept as equivalent to an ISO/IEC 27001 certificate: an independent audit report, a Stage 2 audit report, or a description of measures with supporting documents?
  5. Which services, systems or sites must the certificate scope name?
  6. If the clause still names ISO/IEC 27001:2013, ask: do you mean the current edition, ISO/IEC 27001:2022?
  7. Can the certificate be provided by contract start, with a status letter from the certification body at submission?