Accredited ISO 27001 Certification Bodies in the Philippines: How to Choose and How to Verify
The accreditation chain explained, a four-step certificate verification you can run in ten minutes, the rules ISO/IEC 17021-1 and ISO/IEC 27006-1:2024 impose on your auditor, and nine signs you are looking at a certification mill.
Short answer
No certification body is “ISO approved”. ISO writes standards; it certifies nobody and accredits nobody. A defensible ISO 27001 certificate has a three-link chain behind it: an accreditation body that is a signatory to the international multilateral recognition arrangement, a certification body accredited by that accreditation body specifically for ISO/IEC 27001, and an audit conducted under ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024. Break any link and the certificate is a printed document with a logo on it.
The Philippine national accreditation body is the Philippine Accreditation Bureau (PAB) under the Department of Trade and Industry. Certificates issued by bodies accredited abroad — UKAS, ANAB, JAS-ANZ, DAkkS and others — are equally valid here, provided the accreditation covers ISO/IEC 27001.
Accredits in PH
PAB
Philippine Accreditation Bureau, Department of Trade and Industry.
CB rulebook
17021-1:2015
Requirements for bodies certifying management systems.
ISMS-specific
27006-1:2024
Sets competence and audit-duration requirements for ISO 27001.
Cycle
3 years
Stage 1 and 2, then annual surveillance, then recertification.
This page is the certification-body companion to our full guide on ISO 27001 certification in the Philippines. For what the audit itself costs, see our published cost ranges.
Three roles people confuse: accreditor, certifier, consultant
Almost every bad ISO 27001 purchase in this market starts with these three being blurred together, usually deliberately by whoever is selling. They are separate roles, and under ISO/IEC 17021-1 two of them are not permitted to be the same organisation for the same client.
| Role | What they do | What they cannot do | Examples |
|---|---|---|---|
| Accreditation body | Assesses and accredits certification bodies against ISO/IEC 17021-1 and ISO/IEC 27006-1. Signs the international multilateral recognition arrangement so its accreditations are recognised abroad. | Cannot certify your company. Cannot consult. | PAB (Philippines), UKAS (UK), ANAB (US), JAS-ANZ (Australia/New Zealand), DAkkS (Germany) |
| Certification body | Audits your ISMS at Stage 1 and Stage 2, makes an independent certification decision, issues the certificate, and runs annual surveillance. | Cannot provide management system consultancy to an organisation it certifies. Cannot let the audit team make the certification decision. | The international registrars listed further down this page |
| Consultant | Builds the ISMS with you: gap analysis, risk assessment, documentation, control implementation, internal audit, training, audit support. | Cannot issue a certificate. Cannot accredit anyone. Cannot guarantee a certification outcome — and anyone who does is telling you something about their relationship with the auditor. | Sterling International Consulting |
How to verify any ISO 27001 certificate in four steps
This is the procedure we run on every supplier certificate our clients send us for review, and you can run it yourself in about ten minutes. It applies equally to checking your own prospective certification body and to checking a vendor who has just emailed you a PDF.
| Step | What to check | What a genuine certificate shows |
|---|---|---|
| 1. Read the certificate itself | Standard and edition, certificate number, issue and expiry dates, the certified scope statement, the site addresses covered, and the accreditation mark. | ISO/IEC 27001:2022, a scope written in plain business language naming what is actually covered, and a visible accreditation symbol belonging to a named accreditation body — not just the certification body’s own logo. |
| 2. Check the scope, not the logo | Whether the scope on the certificate covers the service, site and data you care about. | A scope that names the operations you are buying. A group certificate covering a head office in another country does not cover the Manila delivery centre doing your work. |
| 3. Verify with the certification body | The certification body’s own public certificate directory, searched by certificate number or company name. | A live entry matching the PDF exactly. Certification bodies are required to maintain publicly accessible information on the certifications they have issued, suspended and withdrawn. |
| 4. Verify the accreditation | The accreditation body’s directory: is this certification body accredited, and is ISO/IEC 27001 within the accredited scope? Then check that the accreditation body is a signatory to the international multilateral recognition arrangement for management systems. | The certification body appears on the accreditation body’s list with ISMS in scope. The global certificate-search database maintained under the international arrangement is a useful cross-check, though not every accredited certificate is published in it. |
The Philippine Accreditation Bureau
The Philippine Accreditation Bureau, an agency of the Department of Trade and Industry, is the national accreditation body of the Philippines. It accredits certification bodies, inspection bodies and testing and calibration laboratories operating in the country, assessing management system certification bodies against ISO/IEC 17021-1 and, for information security management systems, the scheme-specific requirements of ISO/IEC 27006-1.
Two practical points for a Philippine buyer:
- PAB accreditation is not compulsory for your certificate to be valid. There is no Philippine legal requirement to use a PAB-accredited certification body for ISO 27001. Accreditation from any signatory to the international multilateral arrangement carries the same recognition, which is the entire purpose of the arrangement.
- Check the scheme, not just the name. An accreditation body accredits certification bodies scheme by scheme. A certification body accredited for ISO 9001 is not thereby accredited for ISO/IEC 27001. Confirm ISMS appears in the accredited scope on the accreditation body’s own current directory rather than taking it from a brochure — scopes change, and so do signatory statuses.
Is a foreign-accredited certificate valid in the Philippines?
Yes — and this is worth stating plainly because it is asked at almost every kick-off meeting we run. A Philippine company certified by a certification body accredited by UKAS, ANAB, JAS-ANZ, DAkkS or any other signatory to the international multilateral recognition arrangement holds a certificate that is recognised in the Philippines and internationally. That mutual recognition is the reason the arrangement exists: one audit, accepted everywhere.
What actually matters when choosing between a locally accredited and a foreign-accredited certification body:
| Consideration | What to weigh |
|---|---|
| Where your customers are | If your contracts are with US, UK, Australian, Japanese or European clients, a certification body whose accreditation mark those clients recognise on sight removes a conversation from every procurement review. This is a commercial argument, not a technical one — but it is a real cost saving. |
| Auditor availability in-country | A Philippine-resident audit team means no international travel on your invoice and easier scheduling for surveillance. Auditor travel and subsistence are billed to you and are not trivial for multi-site scopes. |
| Sector competence for ISMS | ISO/IEC 27006-1 sets competence requirements for ISMS audit teams. An auditor who has audited BPO delivery floors, or BSP-regulated fintech, or a colocation facility, asks better questions and wastes less of your time than one working from a generic checklist. |
| Multi-standard plans | If ISO 9001 or ISO 22301 is on your roadmap, a certification body accredited for all of them lets you run combined audits later. Integrated audits typically reduce total audit duration materially compared with separate audits of the same scopes. |
| Suspension and withdrawal history | Accreditation bodies publish suspensions and withdrawals. A certification body whose accreditation has been suspended can leave its clients holding certificates of uncertain standing. This takes two minutes to check and almost nobody checks it. |
Certification bodies commonly operating in the Philippines
The international registrars below all maintain a presence or an active audit capability in the Philippine market and are the bodies our clients most often shortlist for ISO/IEC 27001. We list them alphabetically and deliberately without ranking, pricing or endorsement: BSI, Bureau Veritas, DNV, DQS, Intertek, LRQA, SGS, TÜV NORD, TÜV Rheinland and TÜV SÜD, alongside regional and locally accredited bodies.
Sterling takes no referral fee, commission or revenue share from any certification body. We are not a reseller of anyone else’s certificate and we do not have a preferred registrar. When we help a client shortlist, the criteria are the ones in the table above — customer recognition, in-country auditor availability, sector competence, multi-standard coverage and accreditation history — and the client contracts the certification body directly. Any consultant who insists you use one particular certification body has a reason, and it is worth asking what it is.
The rules your certification body must follow
ISO/IEC 17021-1:2015 governs all management system certification bodies; ISO/IEC 27006-1:2024 adds the requirements specific to information security management systems. You are entitled to hold your certification body to both. The five that matter most to you commercially:
| Requirement | What it means for you |
|---|---|
| Impartiality | The certification body must identify, analyse and manage threats to its impartiality, and must not let commercial pressure compromise it. A body that negotiates findings down to keep an account is in breach, and reporting it to its accreditation body is a legitimate remedy available to you. |
| No consultancy to its own clients | A certification body may not provide management system consultancy to an organisation it certifies. This is why your implementation partner and your auditor must be different organisations. An offer of “implementation and certification, one package, one invoice” is the single clearest sign that something is wrong. |
| Independent certification decision | The decision to grant certification must be made by a person or persons who did not conduct the audit. Your lead auditor cannot hand you a certificate at the closing meeting. |
| Competence of the audit team | ISO/IEC 27006-1 sets ISMS-specific competence requirements. You may ask for the audit team’s ISMS competence and sector experience before the audit, and you may object to a proposed auditor with a reason. |
| Published certification status | Certification bodies must maintain publicly accessible information about the certifications they have issued, and about suspensions and withdrawals. If a body has no public directory, that is a finding in itself. |
How ISO/IEC 27006-1:2024 sets your audit duration
Audit duration is not a negotiation and it is not a market price. ISO/IEC 27006-1:2024 derives it from the effective number of personnel within the ISMS scope, then adjusts for factors including the number of sites, the complexity of the information systems and processes, the regulatory context, and the extent of outsourcing. Because the audit fee is duration multiplied by a day rate, the duration calculation is the whole fee conversation.
Three consequences worth understanding before you ask for a discount:
- A certification body that undercuts the calculated duration is in breach of its accreditation. If one quote is dramatically below the others for the same scope and headcount, the question is not why they are cheap — it is how many audit days they have removed and whether their accreditation survives the next assessment.
- Scope is the lever you legitimately control. Effective personnel means personnel within the ISMS scope. A scope honestly drawn around the operations that hold the information at risk costs less to audit than an all-company scope, and is usually the better ISMS. Drawing the scope to exclude operations your customers care about is a different thing entirely, and it fails the moment a client reads the certificate.
- Surveillance and recertification follow the same basis. Annual surveillance is a fraction of the initial duration and recertification is a larger fraction, so year one is not the whole cost. Our ISO 27001 cost page sets out the published three-year corridor.
Nine signs you are looking at a certification mill
Certification mills sell paper. They are legal in most jurisdictions, they are cheap, and they are the reason serious buyers now verify accreditation rather than accepting a PDF. Any one of these on its own warrants a question; two together should end the conversation.
- No audit, or an audit shorter than a day. A genuine Stage 1 plus Stage 2 for even a very small ISMS scope cannot be compressed into a few hours.
- A guaranteed outcome. No accredited certification body can guarantee certification before auditing you. The guarantee is itself evidence the audit is not real.
- Implementation and certification from the same organisation. Prohibited under ISO/IEC 17021-1. Presented as convenience; it is a breach.
- An accreditation logo you cannot trace to a national accreditation body. Search the accreditor’s name. If its only presence is its own website and it accredits bodies in dozens of countries with no government relationship anywhere, you have your answer.
- A price far below the market with no scope questions asked. A body that quotes without asking your headcount, site count and scope has not calculated a duration, which means it does not intend to work to one.
- Certification in days. The constraint is not paperwork — it is that clause 9.2.2 and clause 9.3.3 require a completed internal audit and management review before Stage 2, and those require an ISMS that has actually been operating.
- No public certificate directory. Accredited bodies publish their certifications, suspensions and withdrawals.
- Certificates with no accreditation mark at all. These are sometimes sold honestly as “unaccredited” certification. That is a legitimate product and a worthless one: it carries no international recognition and sophisticated clients reject it.
- The certificate cites ISO/IEC 27001:2013. The transition period for the 2013 edition ended on 31 October 2025. A 2013 certificate issued or still presented as current today is either expired or was never accredited.
Eight questions to ask before you sign with a certification body
- Which accreditation body accredits you for ISO/IEC 27001, and what is your accreditation number? Then verify it yourself on that accreditation body’s directory.
- How many audit days have you calculated for our scope, and on what effective personnel number? The answer should reference ISO/IEC 27006-1 and should not change when you push on price.
- Is that quotation Stage 1 and Stage 2 only, or does it include surveillance years one and two and recertification? Compare quotations over the full three-year cycle or you are comparing nothing.
- Are travel, subsistence and any per-site charges included, and where will the audit team travel from? For multi-site Philippine scopes this can move the total materially.
- What ISMS and sector experience does the proposed audit team have? You are entitled to ask, and to object with reason.
- How do you handle a major nonconformity — what is the correction window and is a follow-up visit chargeable? Get this in writing before you need it.
- Can we run combined audits if we add ISO 9001 or ISO 22301 later? Only possible if the same body is accredited for those schemes.
- Has your accreditation ever been suspended, and is it currently in good standing? Verifiable independently, which is the point of asking.
Where a consultant fits — and where we do not
Sterling International Consulting is a consultancy. We are not a certification body, we cannot issue you a certificate, and under ISO/IEC 17021-1 no organisation can lawfully do both for you. Being explicit about that boundary is not modesty; it is the thing that makes our work defensible when your certification body audits it.
| We do | We do not |
|---|---|
| Gap assessment against ISO/IEC 27001:2022 including Amendment 1:2024 | Issue certificates |
| Scope definition — the sentence that goes on your certificate and drives your audit duration | Accredit anyone, or claim to be accredited ourselves |
| Risk assessment, risk treatment and a Statement of Applicability built from your risks | Guarantee a certification outcome |
| Documentation, control implementation and staff awareness | Take referral fees or commission from certification bodies |
| Internal audit and management review preparation — the two records that most often delay a Stage 2 date | Audit you for certification purposes after implementing your ISMS. That is prohibited, and for good reason |
| Certification-body shortlisting on your criteria, and support through Stage 1, Stage 2 and closing of findings | Sell you documents nobody in your organisation will follow |
Sterling Academy · e-learning for your people
Training that stands up in your ISO 27001 audit
Sterling consulting clients benefit from preferential course access and special pricing on Sterling Academy through their Sterling consultant, including complimentary ISO 27001 awareness training for your people as part of your engagement. Your consultant sets up your client administrator, you add your people, and every learner who completes a course and its final exam receives a numbered Certificate of Completion, verifiable online.
Completion records and certificates are your evidence for ISO/IEC 27001:2022 clauses 7.2 (competence) and 7.3 (awareness) and for Annex A control 6.3, information security awareness, education and training — the items a certification auditor tests by interviewing your staff.
Courses for an information security management system
End to end with Sterling: your ISO 27001 engagement includes
- Implementation consulting through Design™ (guided) or Drive™ (fully managed), up to the certification audit
- Sterling Academy e-learning for your people: preferential course access and special pricing, with complimentary ISO 27001 awareness training
- Live internal auditor training for your audit team
- Effivity ISMS software subscription
- Vulnerability assessment by Cyber Vantage 360
- Sustain™ post-certification support: internal audits, management reviews and surveillance preparation
List price from US$19 per learner per course (51–200 learners) · 12 months’ access · final exam included
Contact usSee the course on Sterling AcademyWatch the sample video →
Certificate of Completion issued after the final exam, numbered and verifiable online · Sterling consultant, client administrator and learner roles as on Sterling Academy
ISO 27001 certification bodies: frequently asked questions
1. Who accredits ISO 27001 certification bodies in the Philippines?
The Philippine Accreditation Bureau, an agency of the Department of Trade and Industry, is the national accreditation body. It assesses management system certification bodies against ISO/IEC 17021-1 and, for information security, the scheme requirements of ISO/IEC 27006-1. Certification bodies accredited by foreign national accreditation bodies that are signatories to the international multilateral recognition arrangement are equally valid in the Philippines.
2. Is a certificate from a foreign-accredited body valid in the Philippines?
Yes. There is no Philippine legal requirement to use a locally accredited certification body for ISO 27001. Mutual recognition under the international multilateral arrangement is precisely what makes one audit acceptable in every signatory economy. What matters is that the accreditation covers ISO/IEC 27001 and that the accreditation body is a current signatory.
3. How do I check whether an ISO 27001 certificate is real?
Four steps: read the certificate for standard edition, number, dates, scope and accreditation mark; check the scope actually covers the site and service you care about; find the certificate in the certification body’s public directory; then confirm on the accreditation body’s own directory that the certification body is accredited for ISO/IEC 27001. Step four is the one that catches mill certificates.
4. Can the company that implements our ISMS also certify it?
No. ISO/IEC 17021-1:2015 prohibits a certification body from providing management system consultancy to an organisation it certifies. Any offer of implementation and certification as a single package from a single organisation is a breach of the certification body’s own accreditation requirements, and the resulting certificate is at risk.
5. Which certification body is the cheapest for ISO 27001 in the Philippines?
It is the wrong question. Audit duration is derived under ISO/IEC 27006-1:2024 from the effective number of personnel in scope, adjusted for sites, complexity, regulatory context and outsourcing — so accredited quotations for the same scope should be broadly comparable. A quotation dramatically below the others usually means fewer audit days than the calculation supports, which is an accreditation problem waiting to surface.
6. Does Sterling recommend a particular certification body?
We do not have a preferred registrar and we take no referral fee, commission or revenue share from any certification body. We help clients shortlist on five criteria — recognition by their customers, in-country auditor availability, ISMS and sector competence, coverage of any other standards on the roadmap, and accreditation standing — and the client contracts the certification body directly.
7. What happens if our certification body loses its accreditation?
Accreditation bodies publish suspensions and withdrawals, and a suspended certification body can leave clients holding certificates of uncertain standing. In practice you may need to transfer certification to another accredited body, which normally involves a review of your current certification status and audit history rather than starting again. Checking a body’s standing before you sign takes two minutes.
8. Is an ISO 27001:2013 certificate still valid?
No. The transition period for ISO/IEC 27001:2013 ended on 31 October 2025. Any certificate still citing the 2013 edition as current is either expired or was never issued under accreditation. If a supplier sends you one today, that is the end of the due-diligence question, not the start of it.
9. Can we change certification bodies mid-cycle?
Yes. Transfer of accredited certification between accredited certification bodies is a normal, defined process, and the receiving body reviews your current certification, audit reports and open findings before accepting the transfer. It is easier to do at recertification than mid-cycle, but it is not a trap you are locked into.
10. Do we need PAB accreditation specifically to sell to Philippine government agencies?
Requirements vary by agency and by procurement, and any bid document should be read on its own terms rather than assumed. What is generally true is that an accredited certificate from any signatory to the international multilateral arrangement is recognised. Where a specific bid names an accreditation, that bid’s wording governs — check it before you contract a certification body, not after.
Get an independent view before you sign with a certification body
We will review the quotations you have, check the accreditation behind each one, and tell you whether the audit days quoted match the scope you described. We take nothing from the certification body either way.
Talk to a Sterling ISO 27001 consultant
11. Is training included with Sterling’s ISO 27001 consulting?
Every Sterling engagement includes live internal auditor training for your audit team and preferential access to Sterling Academy, with complimentary ISO 27001 awareness training for your people as part of the engagement. Special pricing applies to the wider catalogue — Information Security Essentials, 93 Annex A Controls (ISO/IEC 27002:2022) and Risk Management — through your Sterling consultant. Learners who complete a course and its final exam receive a numbered Certificate of Completion, verifiable online, and the completion records serve as evidence for clauses 7.2 and 7.3 and Annex A control 6.3.
Where to go next
- ISO 27001 certification in the Philippines — the complete guide: clauses, controls, process and timeline.
- ISO 27001 certification cost — consulting and certification-body ranges, and the three-year cost of ownership.
- The 15 mandatory documents — what your auditor will actually open.
- All 93 Annex A controls — and the evidence expected against each.
- The certification process and realistic timeline — Stage 1, Stage 2 and what delays them.
- ISO 27001 vs ISO 27002 — requirements against guidance, and why only one of them certifies.
- ISO 27001 for fintech in the Philippines — BSP, NPC and SEC supervision, cloud scoping and the diligence pack banks ask for.
Written and maintained by the ISO 27001 practice at Sterling International Consulting, Philippines. All clause and control references are to ISO/IEC 27001:2022 including Amendment 1:2024. Last updated: 1 August 2026.