ISO 27000 ISO 27701 Certification Services

Accedere is an IAS Accredited Certification Body for ISO 27000 / ISO 27701 Certifications.

Our ISO 27000, ISO 27701, ISO 27701 Certifications, Data Security & Privacy certification services cover Security and Privacy that enable our customers to have SOC 2 and ISO 27001 :2013 or ISO 27701 :2019 (PIMS) or other 27xxx audits under one roof, thus saving considerable costs and efforts.

As the SOC 2 broadly covers many of the ISO 27001 certification requirements, it makes sense for organizations to combine the audits by us under one brand. The Aicpa SOC 2 Type 2 engagements require continuous monitoring for evaluating the operative effectiveness of the controls, in parallel we are also able to evaluate most of the ISO 27000 controls pertaining to our customers' environment.

Thus, this is a win-win situation for our customers as they can get the ISO 27000 and ISO 27701 certifications along with the SOC 2 Type 2 Compliance reports under one roof (brand) and perhaps conducted together to save considerable time and effort. The new ISO 27002 :2022 has recently been announced and will define the upcoming ISO 27001 standard.

ISO 27001, ISO 27011, ISO 27017, ISO 27018, ISO 27019- Information Security Management System (ISMS)

Increasing data breaches are a concern for most organizations. Technologies are constantly changing and thus we need to keep pace with the environment and adapt a process of change to enable the use of these new technologies in a safe manner. Implementing an ISMS for certification under ISO 27001 :2013 is one way to ensure that your organization follow a process for its information systems to provide an assurance to its vendors and third-parties that the systems and data are appropriately protected.

The ISO/IEC 27xxx certificate provides evidence of an audit of Confidentiality, Integrity, and Availability (CIA) of an organization that follows an internationally recognized process to manage their customer's information or data. The ISO 27017 demonstrates Cloud Service Providers (CSP’s) controls overs its cloud services. The ISO/IEC 27018 is used for Personal Data (PII) data in the cloud. ISO 27001 combined with Cloud CSA CCM4 can enable an organization to achieve the CSA STAR Level 2 Compliance.

Why ISO / IEC 27xxx

1. Assures your customers about your organization's standards in managing the information or data.
2. The organization follows an established ISO / IEC process that could reduce the likelihood of a potential security breach.
3. Third-Parties or Vendors accept ISO 27001, ISO 20000, ISO 22301 and other Certificates for vendor due diligence.
4. The ISO/IEC 27001 extentions like ISO 27017 or ISO 27018 provides assurance for CSP’s and the ISO 27701 provides for Privacy Assurance.
5. The CSA CCM4 with ISO 27001 provides assurance for CSP’s and achieve the CSA STAR Level 2 Certifcation.

You may check and download the ISO 27001 checklist, ISO 27001 PDF Standard, costs for ISO 27001 Audits, ISO 27000, 27001, 27002, 27010, 27011, 27017, 27018, 27019 Audit Certification Process, ISO 27000 vs SOC, ISO 27001 Cloud Security challenges and Cloud STAR Certification, C5 Cloud certification in our resources section

ISO 27701 : 2019-Privacy Information Management System (PIMS)

In August 2019, the ISO announced a new certification ISO 27701 :2019 also known as the Privacy Information Management System or PIMS. Earlier the ISO 27701 was known as ISO 27552.

It is an extention certification on top of the ISO 27001.

Why PIMS

1. Assures that the data subjects of customers are managed responsibly.
2. Integrates with ISO 27001 based on your Information Security Management System (ISMS).
3. Provide clear visibility of data management approaches with partners.
4. It can help to identify, prioritize, and manage risks throughout the data lifecycle.
5. Helps achieve compliance with data protection regulations such as GDPR, CCPA and others.
6. Indicates assurance that PII can be managed without infringing data subjects’ privacy.

Our ISO 27000 and ISO 27701 Audit Related Policies

Audit Questions and Scoping:

The ISO 27000 and ISO 27701 audit journey begins with the audit questionnaire, which helps Accedere in understanding the audit scope. It provides us basic information about the client’s organization, its management system, size & types of operation. Audit questionnaire also helps the auditor & auditee in setting the assessment objectives regarding the scope, standards & specifications.

Agreement:

Based on the scope & objectives of clients Accedere quotes an offer & enters into a detailed contract specifying the terms, assessment criteria, all relevant deliverables, etc. each agreement is customized to individual client needs.

Stage 1 Audit:

Stage 1 Audit is a part of the registration process and not an optional activity. During Stage 1, it is established whether the requirements of the standard(s) are being met by the auditee organization. This can be done by review of the available evidence. The goal of the Stage 1 audit is to determine if the client's ISMS is developed sufficiently to be certified.

Stage 2 Audit:

The auditor team applies the defined standard & evaluates the effectiveness of the Information Security Management System & processes. Changes to the auditee organization’s documentation since the previous visit are reviewed and outstanding non-conformance(s) are followed up. The auditee organization’s ISMS is assessed according to the schedule and audit trails. Documents reviewed, personnel interviewed and other pertinent data are recorded. Non-conformances are raised after the proper investigation against activities found non-compliant. The Observations are issued identifying areas of improvement only.

Certifcation Decision:

After all the audit processes are completed and all major non-conformities of Stage 2 are closed, the Certification Body evaluates all the processes & its results to take the certification decision. The decision of the Certification Body is independent & not influenced by any auditor or audit team member involved in the audit of the particular client. The audit results will be provided to the client in the form of an audit report. The certificate is issued to the client only when all requirements are fulfilled.

Surveillance Audit:

A surveillance audit shall be conducted at least once per year. SA is intended to verify the continued effective maintenance of the auditee organization’s quality management system, satisfy the needs of the auditee organization and maintain the integrity of the registration process as a whole.

Re-Audit:

At the end of each 3 years cycle, a recertification audit is carried out. The purpose of the recertification audit is to confirm the continued and effective management system as a whole is followed and the continued relevance and applicability of the scope of certification, commitment to enhance and maintain overall effectiveness and improvement of the management system, and whether the operations of a certified client contributes to the achievement of the client's policy and objective. If all requirements are fulfilled a new certificate is issued.

Extensions/Reduction/Change to Scope :

Audits for the change or extension in scope will be carried out in the same way as the initial audit. An Audit Report will be completed in the normal way and submitted to the Certification Committee for approval. If successful, a new certificate will be issued by Accedere. A special visit may be carried out at the request of the client for additional accreditation.

Our ISO/IEC Audit Related Policies

Audit Questions and Scoping:

The ISO/IEC audit journey begins with the audit questionnaire, which helps Accedere in understanding the audit scope. It provides us basic information about the client’s organization, its management system, size & types of operation. Audit questionnaire also helps the auditor & auditee in setting the assessment objectives regarding the scope, standards & specifications.

Agreement:

Based on the scope & objectives of clients Accedere quotes an offer & enters into a detailed contract specifying the terms, assessment criteria, all relevant deliverables, etc. each agreement is customized to individual client needs.

Stage 1 Audit:

Stage 1 Audit is a part of the registration process and not an optional activity. During Stage 1, it is established whether the requirements of the standard(s) are being met by the auditee organization. This can be done by review of the available evidence. The goal of the Stage 1 audit is to determine if the client's ISMS is developed sufficiently to be certified.

Stage 2 Audit:

The auditor team applies the defined standard & evaluates the effectiveness of the Information Security Management System & processes. Changes to the auditee organization’s documentation since the previous visit are reviewed and outstanding non-conformance(s) are followed up. The auditee organization’s ISMS is assessed according to the schedule and audit trails. Documents reviewed, personnel interviewed and other pertinent data are recorded. Non-conformances are raised after the proper investigation against activities found non-compliant. The Observations are issued identifying areas of improvement only.

Certifcation Decision:

After all the audit processes are completed and all major non-conformities of Stage 2 are closed, the Certification Body evaluates all the processes & its results to take the certification decision. The decision of the Certification Body is independent & not influenced by any auditor or audit team member involved in the audit of the particular client. The audit results will be provided to the client in the form of an audit report. The certificate is issued to the client only when all requirements are fulfilled.

Surveillance Audit:

A surveillance audit shall be conducted at least once per year. SA is intended to verify the continued effective maintenance of the auditee organization’s quality management system, satisfy the needs of the auditee organization and maintain the integrity of the registration process as a whole.

Re-Audit:

At the end of each 3 years cycle, a recertification audit is carried out. The purpose of the recertification audit is to confirm the continued and effective management system as a whole is followed and the continued relevance and applicability of the scope of certification, commitment to enhance and maintain overall effectiveness and improvement of the management system, and whether the operations of a certified client contributes to the achievement of the client's policy and objective. If all requirements are fulfilled a new certificate is issued.

Extensions/Reduction/Change to Scope :

Audits for the change or extension in scope will be carried out in the same way as the initial audit. An Audit Report will be completed in the normal way and submitted to the Certification Committee for approval. If successful, a new certificate will be issued by Accedere. A special visit may be carried out at the request of the client for additional accreditation.

Our ISO/IEC Audit Related Policies

Withdrawal/Suspension:

Accedere shall initiate withdrawal/suspension procedures, if the auditee organization fails to effectively respond to a corrective action request or if the corrective action is not satisfactory. The following reasons are considered grounds for suspension or cancellation:

1. Major non-conformance(s) or effective corrective action not implemented within a specified time.
2. Improper use of the certificate, symbol, or logo not remedied to the satisfaction of Accedere.
3. The client ceases to supply products or services of the certified quality system for an extended period.
4. The client’s certified management system has persistently failed to meet any of the requirements for certification including requirements for the effectiveness of the management system.
5. Client fails to meet financial obligations to Accedere.
6. The client makes a formal request to withdraw certification.
7. Infringement by the client of any contractual conditions between the client and Accedere.
8. Existence of a serious complaint, or a large number of second- or third-party complaints, which indicates that the quality management system is not being maintained.
9. The client is unable or unwilling to ensure conformance to revisions of standards.
10. The client does not allow routine surveillance to be conducted at the required frequency.

Certification (Accedere Shield) and Certification Mark/Logo:

Accedere issues mark corresponding to the relevant standard for which approval has been given, by way of a current Certificate of Registration. The certification mark (Accedere Shield) used must correspond to the standard against which the company has been audited and achieved registration (i.e. ISO 27001). NOTE: Any misuse of marks may result in the withdrawal of certificates

To ensure that the correct markings are used the following rules shall be observed by all companies who receive certification through Accedere:

1. The marks shall be displayed only in the appropriate form, size, and color detailed in this section.
2. The organization’s certificate number is printed under the mark.
3. When the mark is printed on an unfolded portion of A4 size stationery, it shall be displayed in a size no larger than 30 mm high. On larger portions of unfolded stationery, the size may be proportionately increased.
4. Certification marks shall normally have a minimum height (excluding the certificate number) of 20 mm. Any enlargement or reduction shall retain the same proportions as those of the masters. The Certification Mark and the certificate number shall be considered as a single entity for purposes of enlargement or reduction.
5. In exceptional circumstances, which are usually dictated because of space limitation or cost, the marks may be reproduced at a reduced height, provided that irrespective of the height of reproduction, the mark must be legible, with no infilling.
6. Embossed, relief, or die-stamped versions may be used. The marks may be reproduced as watermarks.
7. Electronic reproduction of the marks is permitted (including Internet websites) provided that the requirements are met and • the organization’s certificate number is printed under the mark • the mark is reproduced so that infilling does not occur • degradation and/or distortion of the mark graphic is avoided • computer files of the marks shall be prepared from mark masters.Redrawn approximations may not be used.
8. Certification Marks/logos shall not be used in any way that might mislead the reader about the status of a certified organization, activities outside the scope and imply that product, process, or service is certified. Holders of Certificate shall not make, use or permit any misleading statement and certification document.
9. Holders of certificates issued by Accedere may use the appropriate mark in the manner prescribed, on stationery and publicity material or other items relevant to their certificate. The Certification Mark shall always be used in conjunction with the Accedere Shield. Holders of certificates may use the Accedere Shield without Certification Marks if they wish.
10. Holders of certificates should not use their certification in such a manner that would bring the certification body and/or system into disrepute and lose public trust.
11. The term ‘publicity material’ shall not include notices, labels, documents, or written announcements affixed to or otherwise appearing on goods or products, unless the goods or products have been manufactured under any product conformity scheme. This restriction shall also apply to primary (e.g. blister packs) packaging, promotional products, and test certificates/certificates of analysis.
12. Upon suspension or withdrawal of its certification, the use of mark or logo shall be discontinued from all advertising matter, stationery, etc that contains a reference to certification. The use of the logo on all stationery/advertising material shall be amended if the scope of certification is reduced.
13. Upon reduction in scope, advertising matter shall be amended.

Other Restrictions on the Use of the Marks:

1. The certification marks shall not be displayed on vehicles, except in publicity material containing a certification mark as part of a larger advertisement, provided the mark is used in the publicity material following the conditions detailed elsewhere in this information sheet.
2. The certification marks shall not be displayed on buildings and flags.
3. Certification marks may be displayed on internal walls and doors, and on exhibition stands.
4. Certification marks shall not be used in such a way as to suggest that Accedere has certified, or approved, any product or any service supplied by a licensee of a mark, or in any other misleading manner.
5. Certification marks shall not be used in such a way as to imply that Accedere accepts responsibility for activities carried out under the scope of certification.
6. All quotations for relevant audit may contain a certification mark for which Accedere holds Intellectual Property.
7. Use of Accedere’s Certification Marks for Testing and Calibration is not allowed.
8. Any use of a certification mark that might contravene the conditions laid down in this publication shall be referred to the relevant body.
9. Certification Bodies shall ensure that they audit the use of national Certification Marks by their certificate holders. Conditions for the use of the marks by such certificate holders are given in these rules.
10. Reproduction of the marks shall be based on master versions supplied at the time of certification, to which certificate holders must add their certificate number.
11. Do not use its certification in such a manner that would bring the certification into disrepute and lose public trust.
12. Accedere’s logo shall not be used on visiting cards.

Accedere will take action and deal with incorrect references to certification status or misleading use of certification documents, marks, or audit reports. The action may include requests for correction and corrective action, suspension, withdrawal of certification, publication of the transgression, and if necessary legal action.

Handling of Client Complaint and Observations

In case of a complaint/observation against Accedere., the Quality manager analyses the issue to determine if there is a system error or personal error. The root cause and correction, corrective actions are determined. The correction is effected immediately to satisfy the complainant. This may include training/counseling the person involved. In case of a complaint/observation against a certified client, the Quality Manager studies the complaint and discusses it with the auditor (last audit). If the complaint is found genuine and valid i.e., indicates a system failure, the complaint is sent to the client for a response. No confidential reports or information will be sent to complainants without written permission from the client. Adequate time is given to the client for a response. The quality manager shall communicate with the complainant at the end of the process detailing the findings and formally close the complaint. A copy of the correspondence is kept in the client file for records and the same is passed to the auditor during the next audit.

Handling of Appeals

Any company or organization that fails to satisfy an audit or surveillance may appeal against the decision. Where an appeal is received the following procedure will be followed. The MD will appoint the members of the appeals committee under the leadership of the MD who will hear the appeal and determine the outcome. In case, MD is part of the audit/certification team, MD shall decide the investigating officer for the appeals process. In such a scenario MD shall approach Impartiality Committee and/or Accedere team to provide a decision on the appeal. The decision on the appeal shall be taken based on the decision by the Accedere committee and the Impartiality Committee. Results of the appeal will be reported to the board of directors. In case of an appeal made by a client against a decision made by an auditor, Lead auditor, or certification committee, the appeal shall be recorded by Quality Manager and forwarded to Appeal Subcommittee. The appeal subcommittee shall review the appeal, investigate. The appeal subcommittee may also direct any other lead auditor to visit the site and determine the validity of the appeal. The decision taken by the Appeal subcommittee shall be communicated to the client and Quality Manager for necessary action. The case is also discussed during the next MRM and Impartiality Committee meeting. In special cases, the case may be discussed with Impartiality Committee members on a one-to-one basis.

Policy on Impartiality:

Accedere’s certification practices focus on providing clients with Cyber Security, Cloud Data Security, Privacy, and Security audits. Accedere wants to be the premier Certification Body (CB) for Process and People providing measurable competitive advantage delivering services with skill and integrity. Accedere is the CB with access to the knowledge and expertise of Accedere’s worldwide network. Our professionals have years of experience in a wide variety of industries. Through this, they have developed an in-depth knowledge of the best practices within your industry and the business processes to be assessed. Accedere has formulated an Impartiality committee for ensuring strict adherence to impartiality norms and for reviewing the norms on a time-to-time basis. Accedere shall strive for complying with its Impartiality norms.Impartiality Reviews shall be carried out once every 12 months. Agenda shall at least cover a review of the norms for impartiality, adherence to policy norms by Accedere, market feedback, and all incident reviews, trends, and disciplinary actions. Review actions shall be absorbed and informed to the concerned.

Accedere Impartiality Norms:

1. No outsourcing of Audits to Consultancy Organization.
2. No Referral Fees to be paid to Consultancy Organization.
3. Facts-based communication to Clients/ Consultancy organizations.
4. Adherence to all Accreditation and other Accedere Policies.
5. Accedere shall not carry out any other conflicting services other than its core business of Audits/Certification.
6. Accedere shall not employ any professional conflicting with its ethical policies.
7. Accedere shall not allow any of its auditors to market the services and conduct the audits for the same client.
8. Accedere shall not allow any of its auditors to carry out financial transactions with clients/Contractors.
9. Accedere shall not carry out business with any Contractor inducing pressures to compromise impartiality.
10. All employees of Accedere shall disclose any situation impairing the business ethics.
11. Accedere shall not allow any of the auditors to carry out audits for the client at least for 2 years from the date of relinquishment from their services.
12. Accedere shall not allow any auditor to compromise on the audit timing as required as per the accreditation/ Accedere norms.
13. Accedere shall not allow any auditor to conduct the audit for the client for which it has not been approved.
14. Accedere shall maintain transparency about all information.
15. No auditor shall divulge any confidential information of the client to any third party without written consent from the client.
16. No auditor shall carry any client information with them after the usage period. All client information shall be returned after usage.
17. Utmost care to be carried out for granting the right scope of certification.
18. Any unethical practice observed should be notified to the management at the earliest.
19. Accedere shall not allow any of its auditors to accept any gifts from clients/Contractors of value greater than INR 500.
20. Accedere shall not allow any auditor to conduct an audit for the organization where any of its family members / close relatives are involved in the decision-making position.
21. Disciplinary actions for non-adhering to impartiality policies shall be taken by the impartiality committee.

You may check and download, the ISO 27701 checklist PDF, ISO 27701 certification, ISO 27701 certification cost for ISO 27701 Compliance, ISO 27701 Audit Certification Process, ISO 27701 vs SOC 2 for Privacy, Cloud Security & Privacy challenges, GDPR vs ISO 27701, SOC 2 vs ISO 27001, SOC 2 vs ISO 27017, SOC 2 vs ISO 27701 in our resources section.

In August 2019, the Iso announced a new certification Iso 27701 :2019 also known as the Privacy Information Management System or Pims. Earlier the Iso 27701 was known as Iso 27552. It is an extention certification on top of the Iso 27001.