How it works
How ISO certification works
From your first enquiry to a certificate in the public register, and the audits that keep it valid for three years.
- Typical time to certificate
- 2–4 months
- Certificate valid
- 3 years
- Surveillance
- Annual
A process set by the accreditation rules
Accredited certification bodies follow ISO/IEC 17021-1 and the IAF mandatory documents. That fixes how audits are planned, how long they take, who may decide on certification and how certificates are maintained, so the steps below are the same for every client.
What you control is readiness. Your management system needs to have run long enough to produce records, including at least one internal audit and one management review, before Stage 2.
The three-year certification cycle
Management system certification, for every ISO standard we certify.
01
Application and quote
Tell us your scope, sites and headcount. We calculate audit time under the accreditation rules and send a fixed quote and audit plan.
02
Stage 1 audit
We review your documented management system, scope and readiness, and agree the Stage 2 plan. Any gaps are reported so you can close them first.
03
Stage 2 audit
Auditors check that the system works in practice: interviews, records and observation across the scope. Nonconformities are raised in writing.
04
Certification decision
Once corrective actions are accepted, a reviewer who did not take part in the audit makes the decision. Your certificate is issued and listed in the public register.
05
Surveillance audits
Shorter audits in the first and second years after certification confirm the system is maintained and improving. The register shows your current status throughout.
06
Recertification
Before the three-year certificate expires, a recertification audit reviews the whole system and renews the certificate for another cycle.
Security audits
How a CERT-In audit runs
Web application, infrastructure and safe-to-host audits follow a test, fix and re-test cycle.
- 01
Scoping
We agree the applications, URLs, APIs, networks or assets in scope, the test environment and the rules of engagement.
- 02
Testing
Auditors test against CERT-In guidelines and recognised methods such as the OWASP Testing Guide, using automated tools and manual techniques.
- 03
Findings report
Each finding comes with its severity, evidence and the risk it poses. Your team fixes them in the audited environment.
- 04
Re-testing
We re-test until findings are closed or formally accepted, and record the version that was finally audited.
- 05
Certificate and report
The final report and certificate are issued, and the certificate is listed in the public register with a QR code for verification.
CMMI
How a CMMI appraisal runs
- 01
Planning
The lead appraiser agrees the model, maturity level, organisational unit and sampled projects with your appraisal sponsor.
- 02
Readiness review
A readiness review checks that evidence and participants are in place before the appraisal is scheduled.
- 03
Benchmark appraisal
The appraisal team examines evidence and interviews practitioners across the sampled work to rate practice areas.
- 04
Results
The maturity level rating is presented to the sponsor and submitted to the CMMI Institute, which publishes it on its results system.
Go deeper
5 min read
Preparing for stage 1 and stage 2 certification audits
Initial certification happens in two stages: a readiness review and a full assessment of how the system works. Here is what each stage covers and how to prepare without overbuilding.
5 min read
Surveillance and recertification: the three-year cycle
Certification is not a single event. This guide explains the three-year cycle, what each surveillance audit looks at, what puts a certificate at risk and how to plan recertification so it never lapses.
5 min read
Integrated management system audits
Organisations with more than one ISO certification can be audited against them together. This guide explains what an integrated audit shares, what still has to be assessed standard by standard, and how to prepare.
5 min read
Transferring your certification to a new certification body
You can move an accredited management system certification from one certification body to another without starting over. This guide explains who is eligible, what the pre-transfer review covers and what happens to your audit cycle.
Frequently asked questions
Start with a quote
Tell us your standards, sites and headcount. We reply with an audit plan and a fixed price for the full cycle.