ISO 27001 certification bodies in Canada
The Standards Council of Canada accredits certification bodies. The certification body certifies you. A consultant can do neither. Getting those three roles straight is what stops you buying a certificate that a customer will not accept.
An ISO 27001 certificate is only worth what its accreditation is worth. Canada's national accreditation body is the Standards Council of Canada, a federal Crown corporation. It accredits certification bodies against ISO/IEC 17021-1 and the ISO/IEC 27006 series, and it does not certify companies. Certificates from bodies accredited by SCC's international peers, such as ANAB in the United States or UKAS in the United Kingdom, are accepted in Canada too: those accreditation bodies are signatories to the International Accreditation Forum multilateral recognition arrangement.
$15,000 to $40,000 Stage 1 and stage 2 combined, CAD, under 250 staff
2 to 4 months Lead time to a stage 2 slot
2 years Cool-off before a body may certify a client it advised
Three roles that cannot be combined
The separation below is set by ISO/IEC 17021-1 and it is the fact most often got wrong, in both directions. If you are deciding which of these businesses to run, consultancy against accredited certification body takes the rule apart from the firm's side.
| Role | What it does | What it cannot do |
|---|---|---|
| Accreditation body, such as SCC | Assesses and accredits certification bodies, publishes which standards each is accredited for, and can suspend or withdraw that accreditation. | Cannot certify your company, and does not sell you anything. |
| Certification body, sometimes called a registrar | Audits your management system at stage 1 and stage 2, issues the certificate, and runs surveillance and recertification across the three-year cycle. | Cannot build your management system, advise on how to close gaps, or write your documents. |
| Consultant | Builds the management system with you, runs the risk assessment, prepares you for audit. | Cannot issue a certificate, and cannot make you certified no matter what the proposal implies. |
ISO/IEC 17021-1 prohibits a body from providing management system consultancy and from certifying a management system on which it, or a related body, provided consultancy, with a cool-off period of two years after that advice ends. If one organization offers to both prepare you and certify you, either it is not accredited, or the certificate it issues will not be an accredited one, or the arrangement is not being described to you accurately. Any of the three is a reason to walk.
How to verify a body in five minutes
We do not publish a list of accredited bodies here. Scopes change, suspensions happen, and a stale list is what makes someone buy the wrong certificate. Check the authoritative source instead.
- Ask the body which accreditation body granted its accreditation, and for which standard. The answer should be one named organization and one named standard. Vagueness here is the signal, and every step below checks that answer.
- Search the Standards Council of Canada's directory of accredited bodies at scc.ca. Confirm the body is listed, and confirm the entry covers management system certification for ISO/IEC 27001 specifically. A body accredited for ISO 9001 quality management is not thereby accredited for information security.
- If the body is accredited elsewhere, check that accreditation body directly. ANAB, UKAS, JAS-ANZ and the other national bodies each publish searchable directories, and the IAF maintains the list of which accreditation bodies are signatories. This is the step that matters when a European customer asks a Canadian supplier for a certificate: the buyer will check the same register you did.
- Read the scope of accreditation, not just the listing. Accreditation is granted for specific standards and often for specific industry sectors. Ask for the body's certificate of accreditation and check that your sector is inside it.
- Check IAF CertSearch, the global database of accredited certifications, both when choosing a body and later when a customer or a supplier hands you a certificate you want to verify.
- Look for the accreditation mark on a sample certificate. An accredited certificate carries the accreditation body's mark alongside the certification body's. A certificate with only the certification body's own logo is an unaccredited certificate, whatever the covering letter says.
The cheap certificate problem
Unaccredited ISO 27001 certificates are sold, they are legal, and they cost a fraction of the real thing because nobody audits the auditor. They fail the moment a customer checks, which is the only moment that matters. If a quote sits well below the $15,000 to $40,000 CAD band for stage 1 and stage 2, the difference is accreditation, not efficiency.
Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.
The kinds of body operating in Canada
There are not many, and none are Canadian-only. Certification bodies are national or global businesses that send auditors to you, so there is no city-by-city market here.
| Kind | What it is good at | Where it costs you | Pick it when |
|---|---|---|---|
| Global testing and certification group | Brand recognition on the certificate, deep bench, accredited for many standards at once | Process rigidity, longer scheduling, and an assigned auditor who may know manufacturing better than cloud software | Your buyer is a large enterprise or a European procurement function that recognises names |
| Specialist information security body | Auditors who have worked in technology, faster responses, more flexible scheduling | Thinner bench when demand surges, and accreditation scope worth checking line by line | You are a software company and want an auditor who does not need cloud explained |
| Firm holding both a CPA practice and a certification arm | One relationship covering SOC 2 and ISO 27001, with the two kept separate for independence | You have to confirm in writing how the separation works, and you lose the ability to play two suppliers off each other | You need both frameworks and want one evidence conversation, which is the case the reuse estimator prices |
What to ask before signing
Ask all of these in one email and compare the answers side by side. Bodies vary more on these points than on price.
| Ask | A good answer | A bad answer |
|---|---|---|
| Days per visit across the full three-year cycle | A number for stage 1, stage 2, each surveillance and recertification, with the audit time table it came from named | A single dollar total. Days are comparable between bodies and totals are not, which is the reasoning on the itemised cost page |
| Who audits us, and what is their background | A named lead auditor with sector experience you can check before signing | Assigned later. An auditor who has never assessed a cloud environment will spend your stage 2 on data centre door locks |
| Remote or on site, and who pays for travel | A split per visit and travel treated as a pass-through with a cap | Silence on travel. For a distributed Canadian company this moves the invoice by thousands of dollars a visit |
| Lead time to a stage 2 slot | A date, held provisionally. Two months is common and four happens | An assurance that they can fit you in. Book the slot before you finish implementation if a customer deadline is driving this |
| Can you audit ISO 42001 at the same time | Yes, with a combined day count showing the saving, and their ISO 42001 accreditation scope attached | Yes, without evidence of accreditation for that standard. The pool accredited for ISO 42001 is much smaller and the integrated audit is where the saving is |
| What happens on a major nonconformity | A named closure route, whether it needs a return visit, and what that costs | It rarely happens. It happens often enough that the closure process is worth understanding in advance |
| Transfer terms | Confirmation that an accredited certificate can transfer to another accredited body, and what notice applies | A three-year lock with no transfer language. Certificates are transferable and a body implying otherwise is protecting an annuity |
When shopping bodies is a waste of your time
Three situations where running a competitive process costs more than it saves. Pick one and move.
- Your customer named the body
- It happens, particularly in supply chains with an existing group arrangement. If the requirement names a body, the comparison exercise is theatre. Verify the accreditation anyway, since that takes five minutes, and then get the slot booked.
- You are under 25 people with one cloud product and one office
- The audit day count is small enough that the spread between competitive quotes is a few thousand Canadian dollars, and you will spend more than that in your own time running the process. Get two quotes, check both accreditations, take the earlier stage 2 slot. Availability is worth more than the price difference at this size.
- You are not going to be ready in this quarter anyway
- Quotes go stale, scopes change, and a body that quoted you in March will requote in September against whatever the scope has become. If the gap assessment says you are more than two quarters out, do the work first and shop later. The exception is the stage 2 slot itself, which is worth reserving early because it is the constrained resource rather than the price.
The Canadian pieces around the certificate
Two things do not come up in material written for a United States audience. SCC is also Canada's member body at ISO, which is where you buy the standards in Canada. And a certificate says nothing about your privacy obligations: PIPEDA, or the provincial statute that displaces it in Quebec, British Columbia and Alberta, applies to personal information whether or not you hold any certification. If personal information is inside your scope, the privacy work runs alongside the certification, not inside it.
Getting ready before you approach a body is a different purchase from a different supplier, covered on the consultant guide and the readiness page.
Get quotes from accredited bodies
Tell us your scope, headcount and target date and we will put it in front of certification bodies that audit Canadian companies.
Get matchedCommon questions
Does the Standards Council of Canada issue ISO 27001 certificates?
No. SCC accredits certification bodies and publishes which standards each one is accredited to certify against. The certificate itself comes from the certification body. If somebody tells you they are getting you "SCC certified", they have the relationship backwards, which is worth noticing before you give them money.
Do we need a Canadian certification body for a Canadian company?
No. A certificate from a body accredited by any IAF multilateral recognition arrangement signatory is accepted in Canada and internationally. What matters is that the accreditation is real and covers ISO/IEC 27001. Choosing a body with Canadian auditors mainly affects travel cost and scheduling convenience rather than the standing of the certificate.
How do I check whether an ISO 27001 certificate is genuine?
Look for the accreditation body's mark on the certificate, then search IAF CertSearch or the issuing accreditation body's directory for the certified organization. Check the scope wording as well as the existence of the certificate, because a valid certificate covering one subsidiary or one product line does not cover the service you are buying.
Can our consultant also certify us?
No. ISO/IEC 17021-1 prevents an accredited certification body from certifying a management system it advised on, and requires a two-year gap after any such advice ends. A firm offering both is either not accredited or is describing two separate legal entities, and in the second case you should ask how independence is demonstrated to their accreditation body.
How much does the certification body cost in Canada?
$15,000 to $40,000 CAD for stage 1 and stage 2 for most companies under 250 staff, then $5,000 to $16,000 CAD a year for surveillance, with recertification in year three. Fees are derived from audit days rather than set commercially, which is why the day count is the number to compare between quotes.