ISO 27001 Certification and Accreditation Process
ISO 27001 Certification – Public Information
nabu B.V. provides independent management-system certification services for Information Security Management Systems (ISMS) against ISO/IEC 27001.
nabu B.V. is currently in the process of obtaining accreditation from the Dutch Accreditation Council (Raad voor Accreditatie – RvA) for ISO/IEC 27001 certification in accordance with ISO/IEC 17021-1 and ISO/IEC 27006-1.
Until accreditation has been formally granted, nabu B.V. does not represent its ISO/IEC 27001 certification as RvA-accredited. The accreditation status applicable to a specific certification engagement will always be communicated clearly to the client.
Certification and Audit Process
The nabu B.V. certification process is designed to provide an independent and objective assessment of an organization’s Information Security Management System.
Application and Review
The certification process begins with an application containing information about the organization, requested certification scope, locations, activities, personnel, relevant outsourced processes and other information necessary to plan the assessment.
nabu B.V. reviews the application to confirm that the requested certification can be performed competently, impartially and with appropriate resources.
Stage 1 Audit
The Stage 1 audit evaluates the organization’s readiness for the certification audit. This normally includes review of the ISMS scope, documented information, risk assessment and Statement of Applicability, internal audit and management-review arrangements and other relevant information.
The outcome of Stage 1 is communicated to the client, including any areas that could prevent successful completion of Stage 2.
Stage 2 Audit
The Stage 2 audit evaluates the implementation and effectiveness of the ISMS against the applicable ISO/IEC 27001 requirements.
The audit team gathers objective evidence through activities such as interviews, observation, sampling and review of records and documented information.
Audit findings and conclusions are communicated to the client.
Where nonconformities are identified, appropriate correction and corrective action must be completed in accordance with the applicable certification requirements.
Independent Certification Decision
The certification decision is made by authorized competent personnel who were not involved in conducting the audit.
Certification is granted only where sufficient objective evidence demonstrates that the applicable certification requirements have been fulfilled.
A certification decision may result in certification being granted, refused, maintained, renewed, suspended, restored, withdrawn, expanded or reduced in scope, as applicable.
Certification Cycle
ISO/IEC 27001 certification normally operates on a three-year certification cycle.
Following initial certification, surveillance audits are performed periodically to confirm continued conformity and effectiveness of the management system.
A recertification audit is performed before the end of the certification cycle where the organization wishes to renew its certification.
Additional or special audits may be required where circumstances affecting certification justify further assessment.
Management-System Certification Schemes
nabu B.V.’s current management-system certification activity covers:
ISO/IEC 27001 – Information Security Management Systems (ISMS)
Any additional management-system certification schemes introduced by nabu B.V. will be identified publicly as they become available.
Granting, Maintaining, Changing, Suspending and Withdrawing Certification
nabu B.V. maintains documented processes for certification decisions throughout the certification lifecycle.
Certification may be:
Granted following successful completion of the certification process and a positive independent certification decision.
Refused where the requirements for certification have not been demonstrated.
Maintained following satisfactory surveillance and continued conformity.
Renewed following successful recertification.
Expanded where additional activities, locations or scope have been successfully assessed.
Reduced where part of the certified scope no longer meets the applicable requirements or at the client’s request.
Suspended where certification requirements are temporarily not fulfilled, required surveillance cannot be completed, certification is misused, or other conditions requiring suspension exist.
Restored when the conditions that resulted in suspension have been satisfactorily resolved within the applicable period.
Withdrawn where serious or persistent failure to meet certification requirements occurs, suspension is not resolved, or the certified organization requests withdrawal.
Clients affected by an adverse certification decision are informed of the decision and of their right to appeal.
Use of the nabu B.V. Certification Name and Mark
Use of the nabu B.V. certification mark is permitted only after a valid certification decision has been made and a certificate has been issued.
The certification mark and references to certification must:
relate only to the certified organization and approved certification scope;
be accurate and not misleading;
not imply certification of a product, service or process;
not be used on products or product packaging in a way that implies product certification;
not be altered or used in a manner that could damage the reputation of nabu B.V. or the certification system.
Use of any accreditation mark is only permitted where the certification has been issued under the applicable accreditation and in accordance with the accreditation body’s rules.
Following suspension or withdrawal, the organization must discontinue claims and use of marks relating to the affected certification. Following a reduction in scope, certification references must be amended accordingly.
nabu B.V. monitors the appropriate use of certification statements and marks and may require corrective action where misuse is identified.
Requests for Certification Information
Information may be requested regarding:
the geographical areas in which nabu B.V. operates;
the status of a specific certification;
the name of a certified organization;
the applicable certification standard;
the certified scope; and
the city and country of the certified organization.
In exceptional circumstances, access to specific information may be restricted where justified, for example for security reasons.
Requests for certification information may be sent to:
Please include sufficient information to identify the certification or organization concerned.
Complaints
Any client, stakeholder or other interested party may submit a complaint regarding nabu B.V.’s certification activities, personnel, services or a certified organization.
Complaints may be submitted electronically or in writing to:
Please identify the communication as a Complaint and provide sufficient information for the matter to be understood and investigated.
nabu B.V.:
records and reviews each complaint;
acknowledges receipt;
investigates the matter impartially;
determines and implements any necessary corrective action; and
communicates the outcome to the complainant.
Receipt is normally acknowledged within 5 working days. Complaints are normally resolved within 30 working days, unless additional investigation is required.
Information relating to complaints is handled confidentially.
Appeals
A client may appeal an audit finding, certification decision, suspension, withdrawal or other certification outcome.
Appeals should be submitted to:
Please identify the communication as an Appeal, identify the decision being appealed and provide the reasons and supporting information.
Appeals are reviewed independently by personnel who were not involved in the audit or certification decision being appealed.
Where formal review is required, an independent Appeals Committee is appointed with appropriate competence and without conflicts of interest.
Submitting an appeal does not result in discriminatory action against the appellant.
The outcome of the appeal is documented and communicated in writing.
Impartiality
Impartiality is fundamental to the certification activities of nabu B.V.
nabu B.V. is committed to ensuring that certification decisions are based solely on objective evidence and are not influenced by commercial, financial or other interests or external pressures.
nabu B.V.:
identifies, evaluates and manages threats to impartiality;
requires personnel involved in certification activities to disclose actual or potential conflicts of interest;
separates audit activities from certification decisions;
does not permit auditors to audit organizations where relationships could compromise impartiality;
does not provide management-system consultancy or internal-audit services to organizations where this would compromise the independence of certification;
prohibits improper inducements or other influence over certification personnel; and
maintains independent oversight of impartiality through its established governance arrangements.
Potential threats to impartiality are reviewed and appropriate safeguards are implemented before certification activities are undertaken.
Questions or concerns relating to impartiality may be submitted to:
Further Information
For questions about the certification process, certification status, complaints, appeals, use of certification marks or other public certification information, please contact:
nabu B.V.Email: info@nabu.nu , Website: nabu.nu
