Skip to main content
Control Institute
Category: Certification and Accreditation

ANAB Accreditation

Also known as: ANAB, ANSI National Accreditation Board, ANAB Accreditation
Simply put

ANAB accreditation is a formal, independent third-party declaration that an organization conforms to established standards and is competent to perform specific work. ANAB, the ANSI National Accreditation Board, is a wholly owned subsidiary of ANSI and one of the largest accreditation bodies in North America, providing accreditation services in over 75 countries. In practical terms, ANAB does not audit or certify individual companies against standards such as ISO 27001 directly; instead, it accredits the bodies that perform that work.

Formal definition

ANAB accreditation is the assessment and accreditation, by the ANSI National Accreditation Board, of conformity assessment bodies (CABs), including certification bodies, calibration and test laboratories, and inspection bodies, against international and domestic standards and requirements. It confirms that an accredited entity possesses the appropriate competence and management system to properly perform conformity assessment activities. In an ISO/IEC 27001 context, an ISMS certificate carries greater assurance when issued by a certification body accredited by a recognized accreditation body such as ANAB, since accreditation attests to the certification body's competence rather than to any individual organization's ISMS. ANAB accreditation is distinct from SOC 2 attestation work, which is performed by licensed CPA firms under the AICPA SSAE 18 standard and is not subject to this accreditation regime. The scope and applicable standards of any given ANAB accreditation vary by the type of conformity assessment activity accredited.

Why it matters

ANAB accreditation matters because it establishes a chain of trust behind certifications rather than the certifications themselves. When an organization holds an ISO/IEC 27001 certificate, the assurance value of that certificate depends heavily on whether the certification body that issued it is itself accredited by a recognized accreditation body such as ANAB. Accreditation attests to the certification body's competence and management system, not to any individual organization's ISMS, so it functions as the quality control layer that makes third-party certification credible to customers, regulators, and business partners.

For GRC professionals and compliance managers evaluating a vendor's ISO 27001 certificate, understanding ANAB accreditation helps distinguish certificates carrying meaningful independent oversight from those issued by unaccredited bodies. Because ANAB provides accreditation services in over 75 countries and is one of the largest accreditation bodies in North America, its accreditation is a widely recognized marker of certification body competence. This distinction is easy to overlook, since a certificate on its own does not indicate who stood behind the certifying body.

It is important to note the boundaries here: ANAB accreditation applies to conformity assessment bodies such as certification bodies, laboratories, and inspection bodies, not to the end organizations being certified. It also does not extend to SOC 2 attestation work, which is performed by licensed CPA firms under the AICPA SSAE 18 standard and sits outside this accreditation regime. Confusing these two governance models is a common source of error when comparing SOC 2 reports and ISO 27001 certificates.

Who it's relevant to

Compliance and GRC Managers
When assessing a vendor's or your own organization's ISO 27001 certificate, ANAB accreditation of the issuing certification body indicates that the certifier's competence has been independently evaluated. This helps distinguish certificates backed by recognized accreditation oversight from those that are not, which can matter in vendor risk assessments and customer due diligence.
Auditors and Certification Bodies
Certification bodies that perform ISO 27001 audits are among the conformity assessment bodies that ANAB accredits. For these bodies, ANAB accreditation confirms they maintain the competence and management system required to conduct their assessment activities, and it underpins the credibility of the certificates they issue.
Security and Procurement Teams Evaluating Vendors
Teams reviewing third-party ISO 27001 certificates can use knowledge of ANAB accreditation to gauge the strength of the assurance behind a certificate. Note that this is specific to ISO-style certification; SOC 2 reports are produced by licensed CPA firms under AICPA SSAE 18 and are not subject to the ANAB accreditation regime, so the two should be evaluated on their own terms.

Inside ANAB

Accreditation Body Role
ANAB (the ANSI National Accreditation Board) is a body that accredits certification bodies, assessing their competence to issue certifications such as ISO/IEC 27001 against recognized international standards. It does not itself certify individual organizations' management systems.
Certification Body Oversight
Accreditation provides oversight of the certification bodies (also called registrars) that perform ISO 27001 audits, evaluating whether they operate consistently, impartially, and competently. This chain of trust supports confidence that an ISO 27001 certificate was issued through an accredited process.
Distinction from Certification
Accreditation of a certification body is separate from the certification an organization receives. An organization achieves ISO 27001 certification from an accredited certification body; the organization is not itself 'ANAB accredited.'
Scope Boundary
Accreditation attests to a certification body's competence within defined schemes or standards. It does not extend to the substantive contents of any single client's ISMS, nor does it guarantee outcomes for organizations that certification body audits.

Common questions

Answers to the questions practitioners most commonly ask about ANAB.

Does ANAB accreditation mean my organization is ISO 27001 certified?
No. ANAB accredits certification bodies, not the organizations seeking certification. Accreditation attests that a certification body is competent to conduct ISO 27001 audits and issue certificates. Your organization earns its ISO 27001 certification by undergoing an audit performed by an accredited certification body against the ISMS requirements in clauses 4 through 10. The accreditation applies to the auditing body; the certification applies to your ISMS within its defined scope.
Is ANAB accreditation relevant to a SOC 2 report?
Generally no. A SOC 2 report is an attestation examination performed by a licensed CPA firm under the AICPA SSAE 18 standard, and its assurance rests on the licensing and peer-review framework governing CPA firms rather than on ISO-type accreditation. ANAB accreditation is typically associated with certification bodies operating in the ISO/IEC 27001 certification context. Do not treat an ANAB-accredited certification body as interchangeable with a CPA firm issuing a SOC 2 report; the two frameworks and their oversight structures are distinct.
How can I verify that a certification body is accredited?
Accreditation bodies typically maintain publicly searchable directories of the certification bodies they accredit, along with the scopes for which each is accredited. When selecting a certification body for ISO 27001, confirm that its accreditation covers ISO/IEC 27001 specifically, since a body may be accredited for some standards and not others. Verifying accreditation status directly with the accreditation body is more reliable than relying solely on a certification body's own marketing claims.
Does choosing an accredited certification body affect the recognition of our ISO 27001 certificate?
In most cases a certificate issued by an accredited certification body carries broader recognition than one issued by a non-accredited body, because accreditation provides independent assurance of the certification body's competence and impartiality. Whether a given customer, regulator, or partner requires an accredited certificate depends on their own requirements, so it is worth confirming stakeholder expectations before engaging a certification body. Keep in mind that the certificate covers only the defined scope of your ISMS regardless of accreditation.
Should we confirm the accreditation scope matches our certification needs?
Yes. Accreditation is granted for defined scopes, and a certification body may be accredited for certain standards, sectors, or regions but not others. Before engaging a body to certify your ISMS against ISO/IEC 27001, confirm that its accreditation specifically covers that standard and any relevant sector considerations for your organization. Matching the accreditation scope to your needs helps avoid situations where a certificate is not recognized as expected.
Does using an accredited certification body guarantee we will pass certification?
No. Accreditation speaks to the competence and impartiality of the certification body, not to the outcome of any individual audit. Your organization must still demonstrate that its ISMS meets the requirements in clauses 4 through 10 and that Annex A reference controls have been appropriately selected via the Statement of Applicability and informed by risk assessment. The audit result depends on the state of your ISMS within its defined scope, and outcomes can vary based on the certification body, auditor, and scope.

Common misconceptions

An organization can be 'ANAB accredited' to demonstrate its security posture.
Organizations are not accredited by ANAB. ANAB accredits certification bodies. An organization typically pursues ISO/IEC 27001 certification from a certification body that is itself accredited; the accreditation belongs to the certification body, not the certified organization.
Accreditation of the certification body guarantees an organization is free from security breaches or has a flawless ISMS.
Accreditation speaks to the competence and impartiality of the certification body's processes, not to the completeness or breach-resistance of any certified organization's controls. An ISO 27001 certificate covers only the defined scope of the ISMS and does not guarantee freedom from incidents.
ANAB accreditation applies to SOC 2 examinations in the same way it applies to ISO 27001 certifications.
SOC 2 is an attestation examination performed by a licensed CPA firm under the AICPA SSAE 18 standard and results in a report, not a certification issued by an accredited certification body. The accreditation model discussed here relates to certification bodies issuing certifications such as ISO 27001, which is a distinct framework and process.

Best practices

When reviewing an ISO 27001 certificate from a vendor, confirm that the issuing certification body operates under recognized accreditation rather than assuming the certificate alone establishes accredited status.
Distinguish clearly in internal and vendor documentation between the certification an organization holds and the accreditation held by the certification body that issued it, to avoid mislabeling.
Verify the defined scope of the ISMS on any ISO 27001 certificate, since accreditation of the certification body does not extend coverage beyond that stated scope.
Do not treat an accredited ISO 27001 certification as equivalent to a SOC 2 report; recognize that these are separate frameworks with separate processes, and satisfying one does not automatically satisfy the other.
When mapping vendor assurance across frameworks, treat the ISO 27001 certification and any SOC 2 report as complementary but partial, and evaluate each against the criteria and scope actually covered.
Retain qualified language when describing accreditation in policies and communications, noting that specific certification body practices and scheme coverage can vary depending on the body and the applicable standard.