ISO/IEC 27001 Compliance

Johanson Group LLP is responsible for and will retain authority for its decision relating to certification, including the granting, refusing, maintaining, renewing, suspending, restoring, or withdrawing of certification. The client is responsible for maintaining compliance with ISO/IEC 27001 requirements during the period of certification. Following the confirmation of the successful remediation of necessary corrective actions, the findings and recommendations made in the audit report will be reviewed and considered for certification will be conducted. If the organization’s ISMS is approved for certification, Johanson Group LLP will issue an ISO/IEC 27001 certification / or scope of certification, which is valid for three years from the issuance date and subject to the successful completion of annual surveillance audits. Based on the results of surveillance audits or other circumstances, Johanson Group LLP holds the right to suspend, withdraw, or reduce the scope of the certification. Refusal of certification could occur due to the client’s non-compliance with a number of factors including Johanson Group LLP’s terms and agreements. Detailed information and documentation outlining terms and conditions will be provided upon completion of the certification process. All decisions will be communicated to the organization in writing detailing the grounds for refusal of certification. When a client’s certification is suspended, refused, or withdrawn the client must cease the use of the certification mark or any promotional material that advertises the fact that the client is certified.

Surveillance audits are conducted annually and are required in order to help ensure the certified organization is able to maintain its compliance with the standard. As part of this process, limited testing and an onsite review will be conducted to determine the impact of any significant changes since the original certification and that the initial certification scope remains valid.

Before the certificate expires, arrangements for recertification are planned. Recertification activities include a full audit of the ISMS.

If during the 3-year certification cycle there are changes in the scope of the certification or changes to requirements, this will be discussed with the Johanson Group LLP certification team.

Information about a particular certified client shall not be disclosed to a third party without the written consent of the certified client except as required in ISO/IEC 17021.

Johanson Group LLP is committed to maintaining professionalism in our organization and our clients. As such Johanson Group LLP is impartial, intellectually honest, and free of conflicts of interest. This policy helps ensure commitments to independence, impartiality, and objectivity of its management systems certification activities.

Our stated impartiality policy clearly identifies and assesses all relationships that may result in a conflict of interest or may pose a threat to impartiality. The policy helps ensure that our personnel are, and will remain, impartial in our certification activities.

Johanson Group LLP will not provide advisory or management systems consulting services to assist in the design, selection, or implementation of controls or internal audit services used to meet the ISO/IEC 27001 requirements. This requirement does not prevent Johanson Group LLP from performing ISO/IEC 27001 pre-audit assessment services.

Item descriptionJohanson Group LLP maintains a Client Directory containing the current status of all client certifications.

Clients can appeal an application, certification, or other decisions taken by Johanson Group LLP. The appeal must be submitted by requesting and completing an appeals document which will be provided by Johanson Group LLP via email. Acknowledgment of receipt of the appeal will be conveyed by Johanson Group LLP and the client will be notified of the status of the appeal. Johanson Group LLP personnel involved in the certification activity will not be involved in the matter of the appeal. Johanson Group LLP will ensure the investigation, and decision on an appeal submitted does not result in any discriminatory action taken against the client and will give formal notice to the appellant at the end of the process.

Once a decision has been made regarding the appeal, no counterclaims can be made by either party to change the decision unless additional supporting documentation is provided. Johanson Group LLP will consider the results of historical cases when similar appeals are received. If an appeal is successful and certification is insured or reinstated, claims cannot be made against Johanson Group LLP for reimbursement of costs associated with the withholding, suspension, or withdrawal notification.

Johanson Group LLP shall acknowledge the receipt of any complaint and will provide the client with the progress of its resolution. The decision, formally communicated at the end of the complaint-handling process, will be communicated by individuals not previously involved in the subject or the complaint. Prior to disclosing any complaints against Johanson Group LLP or its clients, both parties will collectively discuss such matters unless disclosure is required by law.

To file a confidential complaint, please send an email to complaints@johansonllp.com with “ISO/IEC 27001 Complaint” in the subject line.

Johanson Group LLP clients are responsible for maintaining the certified ISMS. If the client fails to complete the surveillance audits or recertification activities or fails to remediate major non-conformities within the specified time frame, Johanson Group LLP will initiate certification suspension procedures. Suspension status will be communicated to the client, and the client will have six months from the audit to remediate the issues, after which certification may be restored. If remediation is not completed, Johanson Group LLP will determine if certification should be withdrawn, or the scope of certification reduced. The client should contact Johanson Group LLP upon reduction or expansion of the ISMS scope to initiate the scope review process.

If a client fails to maintain compliance with certification conditions, Johanson Group LLP reserves the right to suspend certification. During a suspension period, certification is invalid, and these periods are reflected in the status field within our client directory.

Rules for the use of the Johanson Group name and logo are documented within the terms and conditions section of our client agreement and within documentation given to clients upon successful certification. We closely monitor the use of our name and logo to ensure compliance with standards governing us as a certification body. Complaints against Johanson Group or our clients are not made public unless required by law. Certified clients may use our certification mark subject to the following conditions:

1. The certification mark may be used on correspondence, advertising, and promotional material in conjunction with the certified client’s name, and shall not be used in connection with services, activities, or locations not covered by the scope of certification;

2. The certification mark shall not be used on a product nor product packaging nor in any other way that may be interpreted as denoting product conformity;

3. The certification mark shall not be altered, including both style and colors;

4. Upon termination of certification, the certified client shall immediately discontinue the use of the mark. Use of the marks is not to be reinitiated unless certification is fully reinstated.