ISO 27001 for Multiple Sites: One ISMS, Site Sampling and Certifying One Location First

For ISO 27001 with multiple sites, you can certify several offices or data centres under one information security management system, provided one central function runs it, every site is covered by the same internal audit programme and management review, and the scope statement names each site. Whether the certification body visits every site or samples them depends on how similar the sites are and on the accreditation rules it audits under.

Companies with more than one location usually ask two questions. Do we need a separate certificate for each site? And can we certify just part of the business first? The short answers are no, and yes. The longer answers decide your audit cost and how much of your business your customers think is covered, so they are worth getting right before you request quotes.

One ISMS or one per site?

ISO/IEC 27001 certifies a management system, not a building. If the same people set the policies, run the risk assessment, own the Statement of Applicability, audit the sites and review the results, you have one ISMS, and it can cover as many locations as you put in scope.

The alternative, separate ISMSs per site, is sometimes right for very different businesses under one owner. It means separate risk assessments, separate management reviews and separate certificates. For most growing companies it is more work for less benefit.

The international rules for auditing a multi-site organization point the same way. IAF Mandatory Document 1 (MD 1), which sets requirements for certifying management systems run across several sites, describes an organization that qualifies as one with:

• A single management system.
• An identified central function that is part of the organization, not subcontracted, with authority to define and maintain that system.
• A centralised management review covering the whole system.
• All sites inside the organization's internal audit programme.
• A central function responsible for collecting and analysing data from every site.

If you can show those five things, you are a multi-site organization with one ISMS, and you get one certificate listing your sites.

Multiple data centres under one ISMS

Data centre operators ask this most often, because each facility looks physically different: separate power, cooling, access control and staff. That does not mean separate ISMSs. What matters is whether the facilities run under the same policies, the same risk method and the same management oversight.

Where facilities differ, the differences belong in your risk assessment and your Statement of Applicability, not in a separate management system. For example, a colocation site and a site that also hosts your own compute platform face different risks. One risk register can carry both, with controls applied per site.

We ran a dual SOC 2 Type II and ISO 27001:2022 programme for a data centre operator across three physical sites, written up in our case study on running SOC 2 and ISO 27001 in parallel. The scoping decisions there, which sites, which services and where the boundary sat, shaped everything that followed.

Will the certification body visit every site?

Not necessarily. This is where multi-site rules save money, and where expectations most often go wrong.

IAF MD 1 allows certification bodies to audit a sample of sites when the sites carry out very similar activities. For the management systems it covers, it sets minimum sample sizes based on the square root of the number of sites:

Audit	Minimum sample under IAF MD 1
Initial certification	Square root of the number of sites, rounded up
Surveillance	0.6 times the square root, rounded up
Recertification	Same as initial, which may be reduced to 0.8 times the square root where the system has proved effective

Under MD 1, the central function is audited at initial certification, at every recertification and at least once a calendar year during surveillance. At least a quarter of the sample is chosen at random, and the rest is chosen to cover as different a range of sites as possible over the certificate's life.

Two important cautions. First, MD 1 itself lists ISO/IEC 27006 among the scheme documents whose own requirements apply to information security. ISMS certification bodies follow ISO/IEC 27006-1 for audit time and multi-site, so the exact sampling your body applies may differ from the table. Second, certification bodies must restrict sampling where sites are not similar enough, for instance where processes, risks, regulatory requirements or local implementation differ. Data centres with different services often fall into that category. Ask your certification body how many sites it will visit, and why, before you sign.

Can you certify one location or business unit first?

Yes. ISO 27001 lets you define the scope. You can certify one product line, one office or one data centre, as long as the scope makes sense, its boundaries and interfaces are documented, and the certificate does not imply it covers more than it does.

Clause 4.3 asks you to determine the ISMS scope by considering your internal and external issues, the requirements of interested parties, and the interfaces and dependencies between your activities and those performed by others. In practice that means three things:

1. The scope should match what customers buy. If a customer's contract covers your platform, a scope that covers only your head office will not satisfy their procurement team.
2. Interfaces must be handled. If the in-scope unit depends on shared services outside scope, such as corporate IT, HR or a shared identity provider, you need to show how those services are controlled where they touch the scope.
3. You can expand later. Adding sites or business units at a surveillance audit or recertification is normal. The certification body will reassess audit time when you do.

A narrow first scope is a sensible way to get certified sooner and learn how the ISMS runs. Our piece on how long ISO 27001 takes covers the factors that drive the timeline.

How to write a multi-site scope statement

The scope statement printed on your certificate is what customers read. Vague wording undermines it. A clear multi-site scope statement names:

• The legal entity or entities.
• The products, services or activities covered.
• Each physical site, with its address or at least city and function.
• The version of the Statement of Applicability it relates to.

Write it in plain words. "The information security management system supporting the design, operation and support of [platform], delivered from [site A, city, head office] and [site B, city, data centre], in accordance with the Statement of Applicability version 3" tells a buyer exactly what is covered. See our Statement of Applicability example for how the SoA ties back to the scope.

What multi-site does to cost and effort

Adding sites adds audit time, though not one-for-one. ISO/IEC 27006-1 bases audit time mainly on the number of people working within the ISMS scope, then adjusts for complexity, and the number of sites is one of those complexity factors. Travel between sites is usually billed on top.

The internal effort is where companies underestimate. Every site needs:

• Coverage by your internal audit programme within the cycle. Our guide to the ISO 27001 internal audit under clause 9.2 explains how to plan one that covers sites properly.
• Evidence that site-level controls operate: physical access logs, visitor records, environmental monitoring, local incident handling.
• Someone on site who can walk an auditor through it.
• Inclusion in the management review data.

The common failure is a strong head office and a forgotten remote site that nobody has internally audited. Under sampling rules, the remote site may well be the one an auditor picks at random.

Common questions about ISO 27001 with multiple sites

Do I need a separate ISO 27001 certificate for each location?

No. If one central function runs a single ISMS across your sites, with one risk process, shared internal audit and a central management review, one certificate can list every site. Separate certificates only make sense when the sites run genuinely separate management systems, which is usually more work for less benefit.

Can I certify only one data centre and add others later?

Yes. You define the scope, and starting with one facility is common. The scope must be clearly worded so customers know what is covered, and interfaces with out-of-scope services must be controlled. Further sites can be added at a later surveillance or recertification audit, with audit time recalculated.

Will the auditor visit every site?

It depends on how similar the sites are and on the rules the certification body follows. General IAF multi-site rules allow sampling based on the square root of the site count, but ISMS certification follows ISO/IEC 27006-1, and sampling is restricted where sites differ. Ask the certification body to state which sites it will visit.

Does a remote-only company count as multi-site?

Not in the usual sense. A fully remote team with cloud infrastructure typically has one registered location in scope, with home working covered by policy and controls. If you also have a physical office or data centre, list those. Ask your certification body how it treats remote staff when it calculates audit time.

What is the central function in ISO 27001 multi-site certification?

It is the part of the organization that owns and controls the ISMS: sets policy, runs the risk assessment, plans internal audits, holds the management review and can require corrective action at any site. It must be inside the organization, not outsourced, and it is audited at every certification cycle.