Our methodology

Exactly how we choose certification bodies, what we verify, how we label prices — and what we refuse to do.

Which CBs get listed

A certification body appears in our directory only if, as of our last check, it meets all three:

• It operates an active public website offering ISO 27001 certification — verified by a direct load check, not a database scrape.
• It is an accredited certification body (or publicly identifies its accreditation for ISO 27001).
• Its ISO 27001 service is real and current — service pages, not just a keyword on a services list.

What we verify — and what we don't claim

For each CB we record headquarters, firm type, and the frameworks its own public materials say it supports. Directory facts were last verified in September 2026; we aim to re-check quarterly.

How we label every price

Certification fees are scoped per engagement, so most CBs publish no prices at all. Where we show a planning range, it always carries one of three labels:

None of these are quotes. Your fee depends on in-scope headcount, sites, complexity, and readiness. Audit days are set by ISO/IEC 27006 tables — treat every band as a planning figure and get scope and fee in writing.

Timelines

Where shown, the "certification window" is the kickoff-to-certificate planning window, not a promise. Vendor marketing timelines don't count.

What we will never do

• No star ratings or review scores. We have not hired these CBs' clients and won't compress fit into a number.
• No testimonials. Every quote-like line on this site would be fabricated — so there are none.
• No pay-for-rank. Ever. CBs cannot pay to be listed, ranked higher, recommended, or have a profile softened. Some directories sell "featured" placement; we don't sell placement at all.
• No invented statistics. Every number on this site has a clickable source.

How we make money

When you request quotes, matched certification bodies may pay us a lead or referral fee. That payment cannot change which CBs we list, what our guides say, or which CBs we recommend — the firewall is absolute, and CBs can't buy their way around it.

Corrections

Wrong price, stale fact, CB missing? Tell us. We check corrections against the CB's own public materials and note material fixes on the affected page with a date.

Row-level verification log

Every CB's website was load-checked individually on the date shown. Three major CBs block automated checks with bot protection (403) — those were confirmed live via public web search of their official pages instead, and are recorded honestly below.