ISO/IEC 17065 EXPLAINED

ISO/IEC 17065:2012 defines the requirements for organisations that certify products, processes and services. It is the procedural framework that turns a technical evaluation into a procurement-grade attestation — covering impartiality, confidentiality, structural independence, certification decision-making, surveillance, public verifiability, and complaints and appeals. Where the OWASP standards (ASVS, OWASP Top 10, OWASP API Security Top 10) provide the technical content of evaluation, ISO/IEC 17065 provides the procedural content. Both layers are required for procurement-grade certification.

No. ISO/IEC 17065 is an accreditation standard for certification bodies — it governs the bodies that issue certificates. ISO/IEC 27001 is a certifiable standard for information security management systems — it is what some bodies issue certificates against. They operate at different layers and address different questions: 17065 governs the body issuing certificates, 27001 is what certain bodies (specifically those accredited under 17021-1, not 17065) certify organisations against. The two are complementary in mature procurement contexts; ISO/IEC 27001 attests to the management system, Guardian SecureApp™ (which is 17065-accredited) attests to a specific software product.

Your product is certified against the Guardian SecureApp™ scheme — anchored in OWASP ASVS (Modules A and B) or OWASP API Security Top 10 (Module C), at the chosen Level (1 Basic / 2 Advanced / 3 High-Risk Critical). Guardian, the certification body, is accredited under ISO/IEC 17065 by UAF — accreditation 52605385601. The chain reads: ‘Your product is certified by Guardian, against the Guardian SecureApp™ scheme; Guardian is ISO/IEC 17065-accredited by UAF.’ Saying a product is ‘17065-certified’ is technically incorrect — products are certified against schemes; certification bodies are accredited against 17065.

Because it provides structural integrity that self-declarations and private security reports cannot. Specifically: the certification decision is taken by an independent decision-maker separate from the evaluation team (Cl. 7.6); the body’s impartiality is audited annually (Cl. 4.2); certificates are publicly verifiable in a directory (Cl. 7.8); surveillance maintains the assurance signal over time (Cl. 7.9); complaints and appeals procedures provide recourse to procurement teams (Cl. 7.13). These are not aspirational principles — they are audited requirements with corrective-action and accreditation consequences for non-compliance. That structural integrity is what makes a 17065-accredited certificate procurement-grade.

Only certification bodies that have been independently audited and accredited by an accreditation body. The accreditation body must itself be subject to peer evaluation under ISO/IEC 17011 — typically through membership of the International Accreditation Forum (IAF). Guardian Assessment Pvt. Ltd. is accredited by United Accreditation Foundation (UAF), an IAF member. The accreditation is granted only after multi-stage assessment (documentation review, on-site assessment, witness audits) and is maintained through annual surveillance. Any organisation can call itself a ‘certification body’ — only those with verifiable accreditation produce internationally recognised certificates.

No. Unlike OWASP standards (which are public goods freely available under Creative Commons), ISO standards are sold commercially through ISO and national-standards-body resellers. The full text of ISO/IEC 17065 must be purchased from iso.org/standard/46568.html or from a national-standards body (Bureau of Indian Standards in India). Excerpts and the table of contents are publicly visible. The standards-development process is funded substantially through this sale revenue. This page paraphrases the requirements rather than quoting them, in line with ISO’s copyright.

The International Accreditation Forum (IAF) Multilateral Recognition Arrangement (MLA) is the framework under which signatory accreditation bodies mutually recognise the certifications issued by certification bodies they accredit. It allows certifications issued in one country to be recognised in others — making accreditation internationally portable. The MLA is structured by scheme type (separate scopes for management system certification under 17021-1, product certification under 17065, inspection bodies, testing laboratories, and so on), and each scope is administered separately. UAF is an IAF member; UAF’s IAF MLA recognition for product certification (PrCB) is currently under process, and the current scope can be verified at iaf.nu.

Clause 4.2 — the standard’s most-referenced impartiality clause — requires the certification body to identify and manage threats to impartiality on an ongoing basis. Specific requirements include: separation of consultancy from certification (a body that has consulted on a product cannot certify the same product), management of financial and personnel conflicts, fee structures that do not influence certification decisions, and oversight by an impartiality committee or equivalent stakeholder mechanism. The standard does not just require impartiality; it requires a documented programme to identify, evaluate and manage impartiality risks — and that programme is audited by the accreditation body annually.

These are three distinct procedural stages, defined in the standard’s Clause 3 and operationalised in Clause 7. Evaluation (Cl. 7.4) is the technical assessment of the product against the scheme criteria — performed by the evaluation team. Review (Cl. 7.5) is the verification that the evaluation has been conducted correctly, completely and consistently — typically by a senior reviewer. Decision (Cl. 7.6) is the determination whether to grant, deny, or defer certification — taken by an independent decision-maker who is not part of the evaluation team. The three-stage separation is structural: the same person cannot perform all three roles on the same engagement. This is what produces independent decision integrity.

A penetration test is a technical activity. 17065-accredited certification adds the procedural infrastructure that turns a technical activity into an attestation: independent decision-making (Cl. 7.6), public-directory listing (Cl. 7.8), surveillance throughout the cycle (Cl. 7.9), complaints and appeals procedures (Cl. 7.13), accreditation oversight by an external body (UAF in Guardian’s case), and cross-recognition through the IAF MLA. A penetration test report is private and point-in-time; a 17065-accredited certificate is publicly verifiable and ongoing. Both have value in different contexts; for procurement evidence at scale, the certificate is what procurement teams now expect.

Both are accreditation standards governing certification bodies. ISO/IEC 17065 governs bodies that certify products, processes and services. ISO/IEC 17021-1 governs bodies that certify management systems (organisational frameworks). The most consequential consequence of this distinction: bodies certifying organisations against ISO/IEC 27001 are accredited under 17021-1, not 17065. Bodies certifying software products under product certification schemes (like Guardian SecureApp™) are accredited under 17065. The two are complementary at the layer of organisational maturity — many mature regulated entities hold both kinds of certificate, against different aspects of their operations.

Withdrawal of accreditation is a serious event with cascading consequences. Existing certificates issued under the accreditation lose their accredited status from the withdrawal date forward (typically with a notice period). Certified clients are usually given the option to transfer their certification to another accredited body for the remainder of the cycle. The withdrawn body is removed from the accreditation body’s public directory. Withdrawal happens — in practice — through a documented process triggered by serious or persistent non-compliance with 17065, identified through annual surveillance or complaint investigation. The accreditation framework is engineered to make this consequential precisely so that certification bodies have strong incentives to maintain compliance.

Indian regulators in financial services, healthcare, government IT and other regulated sectors increasingly reference ISO/IEC 17065-accredited product certification as one form of acceptable third-party evidence — formally or by analogy. Specific regulatory acceptability for any specific Indian regulator depends on the regulator’s mandate. National Accreditation Board for Certification Bodies (NABCB), the Indian accreditation body, accredits several certification bodies under ISO/IEC 17065; UAF (Guardian’s accreditation body) is a separate IAF member. We are happy to discuss specific regulatory drivers at scoping; in regulated procurement processes, 17065-accredited certification typically serves as evidence alongside regulator-specific requirements rather than as a substitute.

A normative document is the standard or specification that defines the criteria a product is certified against — distinct from the standard that governs the certification body itself. In the Guardian SecureApp™ context: ISO/IEC 17065 governs Guardian (the certification body); the normative documents Guardian evaluates products against are OWASP ASVS (for Modules A and B), OWASP API Security Top 10 (for Module C), with GSA-PR-01 (Guardian’s own scheme document) acting as the consolidating normative that operationalises the OWASP standards. The certificate names the normative document the product was evaluated against; that is what the certificate actually attests to.

ISO standards undergo systematic review every five years to determine whether they should be confirmed (continued without change), revised (a new version issued), or withdrawn (no longer maintained). ISO/IEC 17065:2012 has been confirmed in successive reviews and remains the operative version. When a future revision is published, ISO will issue it under the same number with a new year suffix (e.g., ISO/IEC 17065:YYYY). Until that happens, 17065:2012 is the standard accreditation bodies enforce. Any future revision would trigger transition assessments for accredited certification bodies.

ISO/IEC 17065:2012 is sold by ISO at iso.org/standard/46568.html (opens external site). National-standards bodies (Bureau of Indian Standards in India, ANSI in the United States, BSI in the United Kingdom, and equivalents in around 170 member countries) also distribute the standard as national adoptions. Many corporate libraries, university libraries and standards-research databases carry it. The catalogue page on iso.org provides the official scope, table of contents and previewable excerpts; the full normative text requires purchase. This page paraphrases the requirements rather than quoting them, in line with ISO’s copyright.