ISO 27001 Logo: Can You Use It, and How?

There is no ISO 27001 logo that certified organisations can use. ISO, the International Organization for Standardization, writes the standard but does not certify anyone, and it does not allow its own logo to be used in connection with certification. What a certified organisation can use is its certification body’s mark, if the certification body provides one, under that body’s rules and only while the certificate is valid.

This guide explains the ISO 27001 logo rules, the wording that keeps your claims accurate and where a certification mark can and cannot appear. If you are not yet certified, our ISO 27001 consultancy explains how to get there.

Can you use the ISO logo or an ISO 27001 logo?

No. The ISO logo is a registered trademark that belongs to ISO, and ISO’s own guidance on its name and logo restricts its use to ISO, its member bodies and its committees. ISO’s certification guidance is explicit that ISO does not carry out certification or issue certificates, and does not allow its logo to be used in connection with certification.

That rules out the usual shortcuts:

In the UK, displaying a trust or quality mark without the necessary authorisation is listed as a practice that is always unfair in consumer marketing under the Digital Markets, Competition and Consumers Act 2024, and misleading claims to business customers are unlawful too. An invented ISO badge is a risk as well as a breach of ISO’s rules.

Whose mark do certified organisations use?

The certification body’s mark. Under ISO/IEC 17021-1, the standard certification bodies work to, a certification body has to have rules for how its clients use its marks and refer to their certification, and it must act on misuse. Those rules come with your certification agreement, so ask for them when your certificate is issued.

Typical rules cover the mark’s colours and size, that it must be shown with the certification body’s details or certificate number, that it may not be altered, and that it may only be used while the certificate is valid.

When can an accreditation body’s mark appear?

Only in limited cases. Accreditation bodies assess certification bodies, not you, so their marks appear on certificates issued under accreditation. Whether a certified organisation may show an accreditation body’s mark at all is set by that accreditation body’s rules and your certification body’s rules: where it is allowed, it is usually only alongside the certification body’s mark and never on its own. If you want to show one, ask your certification body first and follow its written answer.

For the difference between certification and accreditation, see our ISO certification guide.

What wording should you use?

Use wording that names the standard, the edition and, where it matters, the scope. Avoid wording that suggests ISO certified you, or that you hold an accreditation.

Keep the claim in step with your certificate: if the certificate covers one service or site, say so wherever the scope could matter to a customer. Our guide to what ISO 27001 is explains how scope works.

Where can the mark appear, and where not?

A management system certification mark tells people that your management system is certified. It must never suggest that a product, a test result or something outside the scope is certified.

Some certification bodies allow a short statement on packaging or accompanying information that the management system is certified, provided it identifies the organisation, the standard and the certification body and cannot be read as product certification. Check your certification body’s rules before using one.

What happens after suspension or withdrawal?

You must stop using the mark and any claim of certification straight away. A certificate can be suspended, for example after a missed surveillance audit or an unresolved major nonconformity, and while it is suspended your certification is temporarily invalid. If it is withdrawn, or expires without recertification, the certification ends.

The surest way to avoid this is to keep the surveillance and recertification audits on track; our guide to the ISO 27001 audit explains the three-year cycle.

How do you get certified?

You build and run an information security management system that meets the ISO 27001 requirements in clauses 4 to 10 of ISO/IEC 27001:2022, complete an internal audit and a management review, then pass a Stage 1 and Stage 2 audit by an independent certification body. Most small and mid-sized organisations take three to nine months. Our ISO 27001 consultancy takes you from gap analysis to certificate, with certification audits carried out by our partner certification body, MQA International.

The same principle applies to other schemes: our page on the Cyber Essentials logo explains how IASME issues the Cyber Essentials badge to certified organisations.

Why Sovereign Secure

• ISO 27001 certified ourselves, so we follow the same rules on describing our own certificate.
• Preparation and certification kept separate. We prepare you; our partner certification body, MQA International, audits you and makes its own certification decision.
• An IASME-licensed certification body for Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, so we work with certification mark rules every day.
• UK company since 2012, headquartered in Accrington, Lancashire (Companies House 08334453).

Next step

If you want the certificate before you worry about the mark, an ISO 27001 gap analysis shows how far you are from certification and what it will take. Use the form below, which is already set to ISO 27001, or call +44 161 523 5276.