The week after they obtained their ISO 27001 certification, a client emailed me, delighted, with a screenshot of their new website.

Top right of the homepage: the red and white ISO logo, clearly visible, nicely centered.

The problem: that logo should never have been there.

It was not bad intent. It was a very common misunderstanding of what certification actually allows you to display. And that misunderstanding can earn you a warning from your certification body, or even a suspension.

ISO does not certify, it standardizes

ISO (the International Organization for Standardization) develops standards. It does not issue certifications. So it is not ISO’s logo that you are allowed to display.

Certification is issued by an accredited certification body. In Quebec and Canada, you will often see SGS, NQA, ABS-QE, Bureau Veritas, BSI, or QMI. That body audited you, issued your certificate, and authorizes you to use its certification mark, not ISO’s.

I have already spelled out who does what in this article on the role of certification and accreditation bodies. In short: ISO does not conduct certifications. As a result, its name and logo have particular protection against misuse.

Certified organizations cannot use the ISO logo in promotional materials. They must instead use the logo provided by the certification body that conducted the certification.

What you are allowed to display

Here is what is permitted, according to the standard rules of accredited certification bodies:

  • Your certification body’s logo (SGS, NQA, ABS-QE, Bureau Veritas, and so on), as provided by that body, without modification
  • A textual mention of your certification, for example: “ISO 27001:2022 certified by [body name]”
  • The certificate number and the scope of certification, so that verification is possible
  • The accreditation body’s logo, but only in combination with the certification body’s logo, never alone. In Canada, that is the SCC (Standards Council of Canada, CCN in French). In the United Kingdom, it is UKAS. In the United States, it is ANAB. In France, it is COFRAC.

On which materials can you display them?

  • Website, in a section dedicated to certifications
  • Stationery, business cards, email signatures
  • Tenders, client presentations
  • Brochures and commercial documents

What is prohibited

The ISO logo is a registered trademark. It cannot be modified, copied, or used without written permission from ISO.

Beyond the ISO logo itself, here are a few mistakes I see:

  • Displaying the logo on a product or its packaging. ISO certification covers your management system, not your products. Avoid claims such as “ISO certified products” if only the management system is certified.
  • Using an expired or suspended logo. As soon as your certification cycle ends or is suspended, the right of use stops. Use only currently valid certification marks and remove expired ones to avoid any confusion.
  • Modifying the certification body’s logo. Colours, proportions, added visual effects: all of that is prohibited.
  • Implying that ISO approved your products or services. Certification attests to a management system, not the quality or safety of a specific product.
  • Saying you are “ISO accredited”. Accreditation applies to certification bodies, not to certified organizations. You are certified, not accredited.

The certification scope trap

This is a trap that regularly catches organizations with several divisions or several sites.

Your certification covers a precise scope, defined on your certificate. If your ISO 27001 certification covers only your cloud services, you cannot display the certification logo for the whole company without that precision.

The reference should include the identity of the certified client, the type of management system and the applicable standard, and the certification body that issued the certification.

In practice, the wording on your website should look like this:

“[Company name] is certified ISO/IEC 27001:2022 by [certification body] for [scope as stated on the certificate].”

What your certification body checks

During annual surveillance audits, your auditor will check how you use logos and certification claims. This is not a symbolic check.

The certified organization must, upon suspension or withdrawal of its certification, immediately stop using any advertising material that refers to ISO certification and the logo.

Non-compliant use can lead to:

  • A documented nonconformity notice
  • A requirement to correct before the next audit
  • In serious cases, suspension of certification

The simple rule to remember

You certify your system. The certification body validates. ISO develops the standard. Each has its role, and only the certification body authorizes you to use its logo.

Before putting anything on your website, stationery, or service offerings, consult the logo use guide your certification body gave you when your certificate was issued. If you can no longer find it, call them. It is free, and it will spare you a bad surprise at your next audit.

You have just received your certificate and want to check what you are displaying? Let’s talk.