Organization A has a service that is ISO 27001 certified. It is acquired by Organization B which does not have any certification.

What are the formal impacts of the acquisition on the ISO 27001 certification?

I am interested in two cases:

  1. Right after the acquisition when nothing changed yet in Organization A.
    → My understanding is that the certification is intact as

    1. The scope has not changed; and
    2. The means to handle the requirements (patch management for instance) has not changed either.
  2. Organization B integrates Organization A and the means to handle the requirements have changed. To take the patch management example above, it is now ad-hoc, uncontrolled, in one word not suitable for ISO 27001 requirements.
    → Does the ISO certification still hold?

Another way of looking at it is whether the certification is a snapshot checked every year (with the hope that things are correct over the year), or whether any negative change over that year automatically invalidates it.

If the latter, how does this invalidation happen?

  • @ConorMancone ISO27001 is neither legal nor regulatory.
    – schroeder
    Aug 28, 2019 at 12:41

1 Answer 1


You are right with answer 1. The certification is always only for a specific scope. I know many companies which only certify some branches and still put the certificate on their website.

There is no automatic invalidation. The certification can be revoked after the yearly check but usually only if major flaws are detected. Most of the time you will get several months to fix the issue, and during this time you still hold the certification. If you, however, fail to improve during that time you will have to re-certify.

Changes in processes are completely normal and have to be treated as described in ISO 27001.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .