Accredited ISO 27001 certification
Complade provides Standards Council of Canada (SCC)-accredited ISO/IEC 27001 certification in Canada and remote certification audits worldwide. Apply online to receive your quotation, review the agreement and NDA (non-disclosure agreement), and plan your audit. No payment is required to apply. SCC listingIAF CertSearch listing
Canadian foundation. International reach.
Remote ISO 27001 audits for organizations worldwide.
Complade delivers ISO/IEC 27001 certification audits for organizations in Canada and internationally. Our portal brings applications, agreements, evidence and results together. Remote delivery is confirmed according to scope, locations and access to evidence.
Canadian accreditation within an international recognition framework
SCC (Standards Council of Canada) accreditation attests to Complade’s competence and impartiality within its accredited scope. Multilateral arrangements support recognition of accredited certification across borders. Recognition depends on the standard and recognized scopes, rather than simply the country where a certificate is issued. SCC listingIAF CertSearch listing
The recognition framework formerly administered through the IAF (International Accreditation Forum) MLA (multilateral recognition arrangement) now falls under Global ACI. Recognition supports international acceptance; specific legal, regulatory and customer procurement requirements still apply. SCC listingIAF CertSearch listing
How multilateral recognition works · Recognized accreditation bodies · Complade’s accredited scope SCC listingIAF CertSearch listing
Discuss your scope and locationsBased on headquarters: Canadian dollars (CAD) in Canada, euros (EUR) in the European Union, British pounds (GBP) in the United Kingdom and US dollars (USD) elsewhere. Fixed planning conversion: 1 USD = 0.89 EUR or 0.76 GBP. After any language adjustment, each euro or pound amount is rounded down to the nearest 100.
- 01
Step 1: Complete the initial application in the Complade certification portal and receive an estimate. A meeting with the Complade team is optional.
- 02
Step 2: Complete the certification application. The information is used to determine the certification scope, audit plan, and contract details.
- 03
Step 3: The Complade Certification Team shares the initial audit plan draft, mutual NDA (non-disclosure agreement), certification terms and conditions, invoice, and certification process.
After scope confirmation and signature of the agreement, meet your audit team and choose an evidence sharing method. Payment is due once the required evidence is available to the auditor, before the Stage 1 review begins.
- 04
Step 4: The audit team requests copies of the applicable policies and procedures, risk assessment, internal audit, management review results, and Statement of Applicability. See the full list.
- 05
Step 5: The audit team will share the Stage 1 report and meet with you to discuss readiness for Stage 2.
- 06
Step 6: Stage 2 audit planning: the audit team works with you to confirm the audit dates and schedule.
- 07
Step 7: Stage 2 audit: conducted virtually or in person to confirm the effectiveness of the Information Security Management System.
- 08
Step 8: The audit team shares the Stage 2 audit report.
- 09
Step 9: If any gaps are identified, you will be asked to provide a corrective action plan.
- 10
Step 10: The Complade Certification Team will review all reports and make the certification decision.
- 11
Step 11: If all requirements are met, Complade issues the certificate with its defined validity period and publishes the applicable record on IAF CertSearch.
Certification Policies
Get an ISO/IEC 27001 estimate before applying.
Start onlineIf you would like help before applying, email certification.info@complade.com, call (289) 804-1616, or book a meeting.
How long does it take to get certified?
About six weeks on average from application to certification.
Across Complade customers, ISO/IEC 27001 certification takes about six weeks on average from application to certification. Some small organizations that are ready finish in less than two weeks; others take months and may still be implementing their ISMS. Timing depends on readiness, scope, team availability and resolution of findings. Certification follows an independent review and a positive decision.
- 1
You submit the application form (1 business day).
- 2
The certification team reviews the form and confirms the details with you, ensuring your organization is ready for an audit. You then sign the contract (approximately 2 business days).
- 3
The certification team assigns an auditor to you, shares the audit plan, and lists the required documents (1 business day).
- 4
Assuming you have everything prepared and you submit the required information (1 business day).
- 5
Stage 1 begins immediately after the certification agreement is signed. Once all required documents are submitted, we carry out the Stage 1 review within one business day and provide the first draft report within two business days of the complete submission. Payment is due before the review, unless otherwise agreed. Stage 1 assesses readiness for Stage 2; clarifications or further evidence may be needed before it is complete.
- 6
Stage 2 can start as soon as Stage 1 is deemed adequate and the lead auditor confirms readiness. Dates depend on the availability of the client and audit teams, usually within one to two weeks. There is no fixed waiting period.
- 7
Conducting the audit (3-15 business days based on complexity).
- 8
Assuming there are no major nonconformities, and only a few minor ones for which you need to submit a corrective action plan (1 business day).
- 9
A second auditor reviews all the documentation (5 business days).
- 10
Complade issues the certificate after an independent review and a positive certification decision.
If you have any questions, please contact us. We can discuss timing for your scope and readiness.
How much does ISO 27001 certification cost?
Based on headquarters: Canadian dollars (CAD) in Canada, euros (EUR) in the European Union, British pounds (GBP) in the United Kingdom and US dollars (USD) elsewhere. Fixed planning conversion: 1 USD = 0.89 EUR or 0.76 GBP. After any language adjustment, each euro or pound amount is rounded down to the nearest 100.
Published pricing starts at $1,900 for organizations with 1–10 people in scope.
The estimate assumes the infrastructure shown in the calculator. Review those assumptions and select your audit language and delivery method. Non-profit organizations receive a 15% discount.
Pricing is a planning estimate. Complade provides the firm quotation after reviewing the application, certification scope, and required audit time.
Use the pricing calculatorI am not ready, how do I prepare?
You can implement the ISMS (information security management system) with your own team or an independent consultant. Complade does not provide implementation consulting.
You are responsible for implementing and maintaining your information security management system (ISMS). To protect impartiality, Complade does not write your policies, supply tailored templates, implement controls or conduct your internal audit. You may work with an independent consultant or your technology provider; we do not endorse a particular implementer.
What documents are required for Stage 1?
Initial documents required for the Stage 1 review:
- 01
Scope of the ISMS (Clause ISO 27001:2022 4.3)
- 02
Information Security Policy (or policies) (Clause ISO 27001:2022 5.2)
- 03
Information Security Risk Assessment (Clause ISO 27001:2022 6.1.2)
- 04
Information Security Risk Treatment & Statement of Applicability (Clause ISO 27001:2022 6.1.3)
- 05
Information Security Objectives & Planning to Achieve Them (Clause ISO 27001:2022 6.2)
- 06
Competence Records (Training, Skills, and Qualifications) (Clause ISO 27001:2022 7.2)
- 07
Additional ISMS (information security management system) Supporting Documents (if applicable) (Clause ISO 27001:2022 7.5.1)
- 08
Information Security Risk Assessment Results (Clause ISO 27001:2022 8.2)
- 09
Information Security Risk Treatment Results (Clause ISO 27001:2022 8.3)
- 10
Monitoring, Measurement, Analysis & Evaluation Records (Clause ISO 27001:2022 9.1)
- 11
Internal Audit Program & Latest Internal Audit Report (Clause ISO 27001:2022 9.2.2)
- 12
Management Review Results (Including Management Review Meeting Report) (Clause ISO 27001:2022 9.3.3)
ISO 27001 certification in Canada: common questions
Direct answers from Complade's certification team about scope, cost, timing, audits and accreditation. SCC listingIAF CertSearch listing
What is ISO/IEC 27001 certification?
ISO/IEC 27001 certification is an independent assessment of an organization's information security management system against ISO/IEC 27001:2022. It certifies the management system within the stated scope, not an individual or product.
Is Complade an accredited ISO 27001 certification body in Canada?
Yes. Complade Inc. is accredited by the Standards Council of Canada (SCC) to provide ISO/IEC 27001 management system certification. Complade's current accreditation status can be verified in the SCC (Standards Council of Canada) directory and IAF CertSearch. SCC listingIAF CertSearch listing
How much does ISO 27001 certification cost in Canada?
Complade's published starting estimate is $1,900 (CAD in Canada; USD base price converted to EUR in the European Union and GBP in the United Kingdom) for an organization with 1–10 people in scope under the listed assumptions. If your ISMS (information security management system) is ready or implementation is underway, apply with your scope and progress. Complade reviews the application and required audit time before confirming the quotation and agreements. The initial application is free and non-binding; you can review the quotation and agreement before deciding whether to sign.
How long does ISO 27001 certification take?
Across Complade customers, ISO/IEC 27001 certification takes about six weeks on average from application to certification. Some small organizations that are ready finish in less than two weeks; others take months and may still be implementing their ISMS. Timing depends on readiness, scope, team availability and resolution of findings. Certification follows an independent review and a positive decision.
What is the difference between Stage 1 and Stage 2?
Stage 1 reviews the ISMS (information security management system) scope, required documented information, risk assessment, Statement of Applicability, internal audit and management review. Stage 2 evaluates whether the management system and controls are implemented and effective in practice.
How long is the ISO 27001 certification cycle?
The certification cycle is three years, subject to annual surveillance audits in Years 1 and 2 and a recertification audit before the next cycle.
Can the ISO 27001 audit be performed remotely?
Yes. Complade offers remote and in-person certification audits. The suitable delivery method is confirmed during audit planning and depends on the certification scope.
Can Complade implement ISO 27001 for my organization?
No. Complade is an independent certification body and does not provide consulting, implementation, templates tailored to a client, or internal audit services.
Complade Insights
Canada’s cyber certification gap in numbers
The 2025 ISO Survey lists 547 ISO/IEC 27001 certificates in Canada, compared with 2,633 in Australia. Our October 2026 count found 51 active CyberSecure Canada certified organizations. See what the figures measure and why they need to change.
Analysis published October 7, 2026
Additional information
Download the controlled Audit Process Policy for the detailed procedures, requirements, and practices used in Complade certification audits.
Audit Process Policy
Download Audit Process PolicyCertification process review
Contact Complade to discuss your certification scope, application, audit process, or evidence requirements. Complade can explain the process but cannot provide implementation consulting.
Contact usStandard versions and official updates
- Published version
- ISO/IEC 27001:2022
- Previous version
- ISO/IEC 27001:2013
- Information checked
- October 31, 2026
The publication of a new version and the certification transition arrangements are separate steps. Your quotation and audit plan identify the edition, amendments and transition rules that apply to your engagement. A new publication alone does not change an existing certificate’s status.
Check SCC for standards and accreditation program news and notices. Use the standard publisher’s records for published editions and revision announcements. SCC listingIAF CertSearch listing
SCC: standards and program updatesPublisher: published standard versionComplade’s SCC accreditation scope SCC listingIAF CertSearch listing
Start with the basics
Understand the approach first, then use the detailed requirements and evidence examples below.
Internal audit and management review
These activities are part of operating your ISMS. Prepare their results so the auditor can assess your readiness for Stage 2.
Can an employee conduct our ISO 27001 internal audit?
Yes, if they have the competence needed for the audit and can remain objective and impartial. Assess their knowledge of the ISMS, the activities being audited and audit methods. Assign work so people do not audit their own work, and address any conflicts of interest. A course can support competence, but attendance alone does not establish it. Small organizations can use an independent external internal auditor where needed. ISO/IEC 27001 requires the organization to complete its internal audit before the Stage 2 certification audit. Complade does not conduct its certification clients’ internal audits.
View links and resources →What records should we prepare for the internal audit?
Keep evidence of your internal audit programme and completed audits. The programme sets the frequency, responsibilities and reporting arrangements, taking account of the importance of processes and previous audit results. Each audit needs defined criteria and scope. Retain results and evidence that findings were reported to relevant management and followed up. A set of policies alone does not demonstrate an internal audit. ISO/IEC 27001 clause 9.2 covers internal audits; ISO 19011 provides guidance on audit methods.
View links and resources →What evidence is needed for management review?
Top management reviews the ISMS at planned intervals using the inputs required by ISO/IEC 27001 clause 9.3. These include audit and monitoring results, changes affecting the ISMS, risk assessment and treatment status, and opportunities for improvement. Keep a record of the review results, including decisions about improvements and any needed changes to the ISMS. The required inputs and outputs must be covered, but a separate meeting or a particular minutes template is not prescribed. A calendar invitation alone does not show what was reviewed or decided.
View links and resources →Does ISO 27001 require a fixed number of policies?
ISO/IEC 27001 requires documented information, including documents describing your system and records showing activities were carried out. The number of files or policies depends on how you organize them and what your ISMS needs. Information can be combined or kept in suitable tools, provided it is controlled and available. Prepare the information required by the standard and the additional information your organization needs. Use the portal evidence list and audit guide; a file count alone does not demonstrate conformity.
View links and resources →Can we apply while some audit evidence is still being prepared?
Yes. You can submit an application and describe your current readiness before every record is ready. Applying does not confirm readiness for certification. After scope review and signing the agreements, you can make Stage 1 evidence available through portal uploads, controlled auditor access or an available integration. The published target for initial review starts after the complete required submission and payment. Stage 1 assesses readiness for Stage 2, including internal audits and management review. Missing or ineffective activities may delay progression. Complade explains audit requirements and findings without providing implementation consulting.
View links and resources →Start your application
Applying is free and non-binding. If your information security management system (ISMS) is ready or implementation is underway, apply with your scope, progress and target dates to begin the review and agreement process.
We review your application and required audit time, then provide the quotation, agreement and non-disclosure agreement (NDA). Review them before deciding whether to sign. Payment is due once the required evidence is available through the agreed sharing method, before the Stage 1 review, unless other terms are agreed.
The final price is usually close to the estimate when your scope, details and assumptions remain the same. The estimate does not guarantee the price.
Start your applicationHaven’t started yet?
Start with our audit preparation resources for requirements and examples of evidence.
One organization, an integrated management system
ISO/IEC 27001 remains our core service. ISO/IEC 42001 and ISO/IEC 27701 also address AI and privacy risks, with requirements of their own. ISO 9001 addresses the quality of products and services. Each standard can be used on its own or integrated with the others.
It is the same organization and its context. Where activities overlap, governance and common information can be shared. One internal audit programme and a joint management review can cover the integrated system, provided the requirements, competence, results and decisions needed for every standard are addressed. The scopes may differ and must remain explicit.
Complade reviews the degree of integration before planning a combined audit. Required audit hours and competence remain specific to each standard. Your organization arranges its internal audits; Complade provides independent certification.
Complade customers: 30% off each additional standard
Complade customers receive a 30% discount on the certification fees for each additional standard they add. The quotation shows the base fee and the discount. Required audit time is determined from the scope and applicable rules; the discount does not reduce that time. Taxes and travel are stated separately.