Methodology

This page explains what goes on a profile, how we label prices, and what paying firms can and can't get.

Who gets listed

Any firm with a real ISO 27001 service gets a free profile. That means consultancies that help companies set up an ISMS, and certification bodies that audit and certify against ISO/IEC 27001. If a firm's own website doesn't mention an ISO 27001 service, we leave it out.

What we verify

  • Accreditation (certification bodies): checked on IAF CertSearch and the national accreditation register (for example UKAS or ANAB). We save the register entry and the date we checked it. If we can't confirm the accreditation, the profile says so.
  • Identity: legal entity, headquarters and offices, from company registers and the firm's own pages.
  • Team credentials (consultants): we only list qualifications the firm publishes, such as ISO 27001 Lead Implementer or Lead Auditor. We don't guess.
  • Independence: if the same group both consults and certifies, the profile says so. A certification body can't certify a system it helped build.

We recheck every record at least once a quarter, and again whenever someone sends a correction with a source.

How we label prices

Every price on the site carries one of these labels, and we never mix them:

  • Published by firm: the firm lists the price publicly, and we link to it.
  • Confirmed by firm: the firm confirmed the range to us in writing.
  • Our estimate: a planning range we worked out ourselves. Use it as a starting point, then get real quotes against a written scope.

Firms can pay to claim and expand their profile, or to appear higher on directory and country pages. These rules apply:

  • We label every paid placement "Featured" or "Sponsored".
  • A firm must qualify for a page before it can pay for a position on it.
  • Paying won't get a firm into our editorial picks, and it won't change the facts on its profile, including any weaknesses we've documented.
  • We research and check free profiles exactly as carefully as paid ones.

Corrections

Send the correction and a primary source (a register entry, a company filing, a published page) to the address on our corrections page. Once we've verified a correction, we update the profile within five business days and change its "updated" date.