ISO certifications at a security company: what each one means

ISO’s page on certification distinguishes two ideas:

• Certification: written assurance (a certificate) from an independent body that a product, service or system meets specific requirements.
• Accreditation: formal recognition by an independent accreditation body that a certification body operates according to international standards.

The standards in this guide are management system standards: they certify how an activity is organised and controlled, not a specific result at a specific site.

According to its abstract on iso.org, ISO 18788 provides a framework for establishing, implementing, operating, monitoring, reviewing, maintaining and improving the management of security operations. It is meant for organisations conducting or contracting security operations, and helps them demonstrate:

• professional conduct of security operations that meets the requirements of clients and other stakeholders;
• accountability to law and respect for human rights;
• consistency with the voluntary commitments the organisation subscribes to.

• ISO 9001 — official title “Quality management systems — Requirements”. Per iso.org, its requirements define how to establish, implement, maintain and continually improve a quality management system.
• ISO/IEC 27001:2022 — official title “Information security, cybersecurity and privacy protection — Information security management systems — Requirements”. Per iso.org, it defines the requirements an information security management system must meet, to manage risks to the data an organisation owns or handles.

Standards are revised. On iso.org, ISO 9001:2015 is now shown as withdrawn and replaced by ISO 9001:2026, and ISO says organisations certified to the 2015 edition should consult their certification body on transition. Always ask which edition a certificate refers to.

• ISO 45001:2018 — official title “Occupational health and safety management systems — Requirements with guidance for use”. Per iso.org, it specifies requirements for an occupational health and safety management system and gives a framework to manage those risks and improve performance. iso.org notes that the standard is being revised.
• ISO 37001 — official title “Anti-bribery management systems — Requirements with guidance for use”. Per iso.org, it gives requirements and guidance for systems that help an organisation prevent, detect and respond to bribery and comply with anti-bribery laws.

The edition matters here too: on iso.org, ISO 37001:2016 is shown as withdrawn and replaced by ISO 37001:2025.

1. Certificate number: unique, so you can confirm it with the issuing body.
2. Name and address: it must be the company you will sign with, not an affiliate.
3. Scope: which activities and which sites it covers. A certificate for “administrative services” does not cover guarding.
4. Standard and edition: for example ISO 9001:2015 or ISO 9001:2026.
5. Certification body: who issued it, and whether it carries an accreditation mark.
6. Dates: issue, expiry and, where shown, the surveillance audits in between.

To confirm it, ISO points to the International Accreditation Forum’s IAF CertSearch database, or to contacting the certification or accreditation body directly. In Greece, the National Accreditation System (Ε.ΣΥ.Δ.) is the national accreditation body under Regulation (EC) 765/2008 and publishes lists of accredited bodies.

ISO notes that accreditation is not compulsory and that its absence does not necessarily mean a certification body is not reputable. A certificate from an accredited body is, however, far easier to verify independently.

Treat certification as one piece of evidence, not the answer. Legal operation is checked separately — see security company licence check — and quality on your site shows in the people, the supervision and the reporting, as the guide how to choose a security company explains.

On its company page, OVIT shows these certifications: ISO 18788:2015, ISO 27001:2022, ISO 37001:2025, ISO 9001:2026 and ISO 45001:2018, plus two certified programmes that are not ISO standards, Whistleblow Engaged and COVID PROOF. The site states that certificates, scope statements and audit dates are available on request — ask for them and check them with the same six steps.