The questions we are asked before certification.

Can we certify one product, team or location to ISO 27001?

Yes. A certification scope can cover a defined part of an organisation, provided the boundary reflects how that part works, the information it handles and the people, systems and services it depends on.

Do you need ISO/IEC 42001 if you already hold ISO/IEC 27001?

ISO/IEC 27001 shows that information security is managed. It does not show that AI risks, impacts and accountability are governed. ISO/IEC 42001 covers that, and much of the existing management-system machinery can be reused.

We use AI tools but do not build models. Is ISO 42001 relevant?

Yes. ISO/IEC 42001 applies to organisations that develop, provide or use AI systems. You do not need to build a model for AI governance to matter.

ISO 27701 vs ISO 27001: do you need both?

ISO/IEC 27001:2022 covers an information security management system. ISO/IEC 27701:2025 covers a privacy information management system for controllers and processors of personal information. Which one you need depends on what you handle and who is asking.

Can ISO 9001 and ISO 27001 be audited together?

They can, where the management systems, proposed scopes and audit arrangements support it. An integrated audit assesses more than one standard in the same audit while still covering the requirements of each.

How do multiple sites and remote teams affect a certification quote?

A quote reflects where work happens and how it is managed. The number of addresses is only part of the picture: activities, people, risks and management-system control also matter.

Have a question that is not answered here?

Send us your proposed scope, locations and approximate headcount and we will reply within one business day.