Which countries have the most ISO 27001 certificates?

China leads by a wide margin, with 35,389 valid certificates in the ISO Survey 2025. India (9,985), Japan (9,076), the United Kingdom (7,929) and the United States (5,297) follow. ISO says UKAS CertCheck statistics added for 2025 give a more complete picture, particularly for the United Kingdom, and that German coverage remains incomplete.

Is ISO 27001 certification growing?

The Survey cannot measure that cleanly. The edition totals are 96,709 (2024) and 125,622 (2025), but coverage changed between the two editions. ISO also publishes a file titled “comparison with 2024 - using data from providers taking part both years,” which it says “shows how much growth occurred in 2025.” We checked it against the two editions’ country tables: its ISO/IEC 27001 figures equal the full 2024 and 2025 edition figures. So we do not treat it as a like-for-like series and give no percentage. ISO’s caution: “Interpretations of the results and any conclusions on trends should take into account that coverage may vary across countries, industries, and standards.”

Is ISO 27001:2013 still valid?

No. IAF MD 26 required accredited certificates to ISO/IEC 27001:2013 to expire or be withdrawn by October 31, 2025. A valid accredited ISO 27001 certificate today should be to the 2022 revision, whose Annex A references the 93 controls of ISO/IEC 27002:2022. The ISO Survey does not split its count by revision; its 2025 table labels the count “ISO/IEC 27001:2013 & ISO/IEC 27001:2022.”

What does this data mean for an organization starting ISO 27001 now?

Two practical readings. First, the scale: ISO counts more than 125,000 valid accredited certificates in 193 countries and territories, and that count is a floor. Second, the IAF MD 26 transition from the 2013 revision ended on October 31, 2025, so a new ISMS should be documented to the 93-control 2022 set from day one: the ISMS policies and procedures plus the Statement of Applicability. A template set can speed up the drafting, but it does not make anyone certified. A certification body issues the certificate after it audits the management system.

ISO 27001 Certification in Numbers: ISO Survey 2025

The ISO Survey 2025 counts 125,622 valid accredited ISO/IEC 27001 certificates covering 226,262 sites as of December 31, 2025, in 193 countries and territories. China leads with 35,389, followed by India, Japan, the United Kingdom and the United States (5,297). ISO notes that some certificates may not yet be in its data, so treat the count as a floor. The 2024 edition counted 96,709, but coverage differs between editions, so we do not read the gap between the two as a growth rate. IAF MD 26 required certificates to the 2013 revision to expire or be withdrawn by October 31, 2025.

Reviewed by Dor Israel, Founder · Updated October 6, 2026

Related toolkits: ISO 27001 Complete Toolkit ($99) · ISO 27001 Policy Pack — Core ($59)

Free: The ISO 27001:2022 Starter Checklist (9 steps) →

The headline numbers

The ISO Survey is ISO’s annual count of valid certificates to selected management-system standards. The 2025 edition counts certificates and sites as of December 31, 2025; ISO’s explanatory note for it is dated October 2026. Accredited certification bodies upload the data to IAF CertSearch, the global database of accredited certifications.

Read the count as a floor, not a census. It covers accredited certificates only, and ISO notes that “some certificates may not yet be reflected in the database or the Survey.” For 2025, ISO says 80 of the 81 accreditation bodies in scope took part in IAF CertSearch.

Coverage also changes between editions. ISO’s 2024 results files say that “the data source has shifted from the voluntary ISO Survey to IAF CertSearch,” and the 2025 edition is compiled “primarily from anonymised and aggregated data in IAF CertSearch.” For 2025, ISO added statistics from UKAS CertCheck, which it says gave “a more complete representation of certifications across a range of countries, particularly the United Kingdom.” German coverage “remains incomplete.” For China, ISO says CNAS supplied statistics from its official government authority register, including accredited certificates and estimated sites.

ISO’s caution: “Interpretations of the results and any conclusions on trends should take into account that coverage may vary across countries, industries, and standards.” The 2019 and 2022 editions are different again: ISO’s notes for them name accredited certification bodies, taking part voluntarily, as the data providers; the 2022 note adds that some additional data came from IAF CertSearch. So the table labels each total by edition and gives no growth rate.

Metric	Figure	Edition
Valid ISO/IEC 27001 certificates worldwide	125,622	ISO Survey 2025 (as of December 31, 2025)
Certified sites worldwide	226,262	ISO Survey 2025
Countries and territories with at least one certificate	193	ISO Survey 2025
Valid ISO/IEC 27001 certificates, 2024 edition	96,709 (179,877 sites)	ISO Survey 2024
Valid ISO/IEC 27001 certificates, 2022 edition	71,549 (120,128 sites)	ISO Survey 2022
Valid ISO/IEC 27001 certificates, 2019 edition	36,362 (68,930 sites)	ISO Survey 2019
ISO 9001, for scale	1,611,729 certificates	ISO Survey 2025
ISO 14001, for scale	739,390 certificates	ISO Survey 2025

Source: The ISO Survey of Management System Standard Certifications 2025 (ISO/CASCO explanatory note, October 2026), results published on IAF CertSearch (https://iafcertsearch.org/services/iso-survey, accessed October 6, 2026). 2024 figures: the ISO Survey 2024 (ISO/CASCO explanatory note, September 2025) and its results files. 2019 and 2022 figures: ISO’s explanatory notes for those editions (dated September 2020 and September 2023), archived by ISO’s CASCO committee and accessed October 6, 2026. Row labels in those notes: “ISO/IEC 27001” (2019) and “ISO IEC 27001:2013” (2022).

The country count is our count of ISO’s country and territory rows with at least one certificate. Coverage differs between editions, so we do not present these totals as a growth series. ComplianceDocs is not affiliated with ISO, IAF or IAF CertSearch.

Where ISO 27001 certificates are

China has the most certificates by a wide margin: 35,389, or 28.2% of the world total. India (9,985), Japan (9,076) and the United Kingdom (7,929) follow. The United States ranks fifth, with 5,297 certificates covering 10,067 sites (4.2% of the total). The same five countries led the 2024 edition, in the same order. In all, 193 countries and territories have at least one certificate.

Sector data is mostly missing. ISO records no sector for 106,327 of the 125,622 certificates (84.6%). Among the 19,295 with a known sector, information technology is the largest group, with 9,699 (50.3%). These shares cover only certificates with a reported sector. They are not the sector mix of all certificates. In ISO’s sector-by-country table, China alone accounts for 5,405 of the 19,295 entries (28.0%).

Rank	Country or territory	Valid certificates (2025 edition)	Share of world total
1	China	35,389	28.2%
2	India	9,985	7.9%
3	Japan	9,076	7.2%
4	United Kingdom	7,929	6.3%
5	United States	5,297	4.2%
6	Türkiye	4,355	3.5%
7	Italy	4,162	3.3%
8	Germany	3,667	2.9%
9	Spain	3,246	2.6%
10	Chinese Taipei	2,784	2.2%

Source: ISO Survey 2025, IAF CertSearch (https://iafcertsearch.org/services/iso-survey), accessed October 6, 2026; ISO/IEC 27001 country table, as of December 31, 2025. Country names are shortened from ISO’s (ISO lists, for example, “United States of America (the)”). Shares are our arithmetic on ISO’s counts, against the 125,622 worldwide total. Per ISO, UKAS CertCheck statistics added for 2025 give a more complete picture, particularly for the United Kingdom, and Germany’s coverage remains incomplete.

The 2013 revision’s transition has ended

ISO published ISO/IEC 27001:2022 on October 25, 2022. IAF MD 26, the IAF’s transition requirements for accredited certification, set a three-year transition that ended on October 31, 2025, and states: “All certifications based on ISO/IEC 27001:2013 shall expire or be withdrawn at the end of the transition period.” On that basis, a valid accredited ISO 27001 certificate today should be to the 2022 revision.

Annex A of that revision references the controls in ISO/IEC 27002:2022, which IAF MD 26 counts as 93 controls in four groups, down from 114 controls in 14 groups. The standard also requires a Statement of Applicability, produced by comparing your own controls with those in Annex A.

The Survey does not show this itself. ISO’s 2025 table labels the count “ISO/IEC 27001:2013 & ISO/IEC 27001:2022” and does not split it by revision.

For anyone building an ISMS now, there is no choice of revision to make. Documentation, risk registers and the SoA should be written to the 2022 control set from day one.

Sources: IAF MD 26:2023, Issue 2, “Transition Requirements for ISO/IEC 27001:2022” (IAF Mandatory Documents, iaf.nu), and ISO’s page for ISO/IEC 27001:2022 (https://www.iso.org/standard/27001). Both accessed October 6, 2026.

What about ISO/IEC 42001 (AI management)?

ISO/IEC 42001:2023 is the certifiable AI management system standard. ISO added it to the Survey in the 2025 edition: “Data for ISO/IEC 42001 and ISO 37301 have been included in the 2025 survey.” The 2024 edition did not report it.

The 2025 edition counts 271 valid accredited ISO/IEC 42001 certificates covering 572 sites, in 40 countries and territories, as of December 31, 2025. The United States has the most, with 100 (36.9%), followed by India (25) and the Republic of Korea (24). ISO records a sector for 100 of the 271 certificates and lists 171 as “Sector unknown”; 92 of the 100 are information technology. With no 2024 figure, no change over time can be stated. Our ISO 42001 certification statistics page covers these figures in more detail.

Source: ISO Survey 2025, IAF CertSearch (https://iafcertsearch.org/services/iso-survey), accessed October 6, 2026.

Frequently asked questions

How many ISO 27001 certificates are there worldwide?: The ISO Survey 2025 counts 125,622 valid accredited ISO/IEC 27001 certificates covering 226,262 sites, as of December 31, 2025. Treat that as a floor: ISO notes that “some certificates may not yet be reflected in the database or the Survey.” The 2024 edition counted 96,709 certificates and 179,877 sites. Coverage differs between the two editions, so we do not read the gap as a count of new certifications.
Which countries have the most ISO 27001 certificates?: China leads by a wide margin, with 35,389 valid certificates in the ISO Survey 2025. India (9,985), Japan (9,076), the United Kingdom (7,929) and the United States (5,297) follow. ISO says UKAS CertCheck statistics added for 2025 give a more complete picture, particularly for the United Kingdom, and that German coverage remains incomplete.
Is ISO 27001 certification growing?: The Survey cannot measure that cleanly. The edition totals are 96,709 (2024) and 125,622 (2025), but coverage changed between the two editions. ISO also publishes a file titled “comparison with 2024 - using data from providers taking part both years,” which it says “shows how much growth occurred in 2025.” We checked it against the two editions’ country tables: its ISO/IEC 27001 figures equal the full 2024 and 2025 edition figures. So we do not treat it as a like-for-like series and give no percentage. ISO’s caution: “Interpretations of the results and any conclusions on trends should take into account that coverage may vary across countries, industries, and standards.”
Is ISO 27001:2013 still valid?: No. IAF MD 26 required accredited certificates to ISO/IEC 27001:2013 to expire or be withdrawn by October 31, 2025. A valid accredited ISO 27001 certificate today should be to the 2022 revision, whose Annex A references the 93 controls of ISO/IEC 27002:2022. The ISO Survey does not split its count by revision; its 2025 table labels the count “ISO/IEC 27001:2013 & ISO/IEC 27001:2022.”
How many ISO 42001 certificates exist?: The ISO Survey 2025 counts 271 valid accredited ISO/IEC 42001 certificates covering 572 sites, in 40 countries and territories, as of December 31, 2025. The United States has the most, with 100. ISO added the standard in the 2025 edition. The 2024 edition did not report it, so no change over time can be stated.Related: ISO 42001 certification statistics · ISO 42001 toolkit (the AI management system documentation set)
What does this data mean for an organization starting ISO 27001 now?: Two practical readings. First, the scale: ISO counts more than 125,000 valid accredited certificates in 193 countries and territories, and that count is a floor. Second, the IAF MD 26 transition from the 2013 revision ended on October 31, 2025, so a new ISMS should be documented to the 93-control 2022 set from day one: the ISMS policies and procedures plus the Statement of Applicability. A template set can speed up the drafting, but it does not make anyone certified. A certification body issues the certificate after it audits the management system.Related: ISO 27001 Complete toolkit (the 2022 documentation set) · What ISO 27001 certification actually costs

Related guides: ISO/IEC 27001 · ISO 42001

Toolkits that help

ISO/IEC 27001:2022

ISO 27001 Complete Toolkit

All 24 policies and procedures plus the risk register, 93-control Statement of Applicability and audit evidence checklist.

$99View toolkit

ISO/IEC 27001:2022

ISO 27001 Policy Pack — Core

16 editable ISO/IEC 27001:2022 policies plus the full 93-control Statement of Applicability — everything a small business needs to start its ISMS.

$59View toolkit

ISO 27001:2022 + SOC 2

ISO 27001 + SOC 2 Dual Toolkit

47 editable Word documents and four Excel workbooks for ISO 27001 and SOC 2, including a control crosswalk, risk register, Statement of Applicability and TSC mapping.

$149View toolkit

ISO/IEC 42001:2023 AI Management System

ISO 42001 AI Management System Toolkit

14 editable ISO/IEC 42001:2023 policies and procedures — impact assessments, AI lifecycle, data governance, third-party AI — plus the Annex A Statement of Applicability, an AI risk register, and an audit evidence checklist.