SNI ISO/IEC 27001 vs ISO/IEC 27001: What's Different, and Which Certification Body to Choose

The Tender Says “SNI ISO/IEC 27001”. Is That a Different Standard?

The question almost always arrives at the same moment: a team reads a procurement document, finds a requirement for an “SNI ISO/IEC 27001:2022 certificate”, then realises the certificate they hold — or are pursuing — reads “ISO/IEC 27001:2022” with no SNI prefix. The worry follows that they have been chasing the wrong standard all along.

The good news is that the content is identical. What differs is not the standard but who accredited the body issuing your certificate — and that difference still matters, because it decides whether your certificate is accepted by whoever asked for it.

The Short Answer

• The content is identical

  SNI ISO/IEC 27001:2022 is an identical adoption of ISO/IEC 27001:2022. No added clauses, no removed controls.

• Accreditation is what differs

  Certificates are issued by certification bodies. Those bodies are themselves accredited — in Indonesia by KAN, elsewhere by bodies such as UKAS or ANAB.

• One ISMS, two routes

  The information security management system you build does not need to differ. Only the body auditing and issuing the certificate does.

• The reader decides the route

  Domestic tenders generally name SNI and KAN-accredited bodies. Foreign parent companies or clients generally recognise UKAS or ANAB.

Who Issues What: The Chain People Confuse

Confusion about SNI almost always traces to one thing: the chain between the standard, the certification body, and the accreditation body is never explained. Yet all three are different parties with different roles.

KAN, UKAS, and ANAB: What It Means for You

KAN (Komite Akreditasi Nasional) is Indonesia's accreditation body. Certification bodies it accredits issue certificates referencing SNI ISO/IEC 27001:2022 — and this is what government and state-owned enterprise procurement documents generally ask for.

UKAS and ANAB are foreign accreditation bodies better known in multinational environments. Certificates from bodies they accredit are commonly requested by foreign parent companies, global enterprise clients, or partners running cross-border vendor risk programmes.

Mutual recognition between countries runs through the International Accreditation Forum (IAF) framework and its recognition arrangements. That framework is what makes a certificate from one jurisdiction recognised in principle elsewhere. But “recognised in principle” and “accepted by the party asking” are not always the same thing — and for you, only the second one counts.

How to Decide in Five Minutes

Cost & Time: What Changes, What Doesn't

The most misunderstood part: choosing an accreditation route does not change the implementation work. Gap analysis, risk assessment, ISMS development, training, and internal audit are the same either way — because the standard is the same.

What differs is the certification body's audit fee and the evidence it demands. That is why the route should be decided at the start of the programme rather than the end: preparing evidence to a higher standard from the outset is far cheaper than redoing evidence collection a month before the audit.

Four Expensive Mistakes

Conclusion

SNI ISO/IEC 27001:2022 and ISO/IEC 27001:2022 are not competing standards — one is the national adoption of the other, with identical content. So there is no such thing as choosing the wrong standard; there is only choosing the wrong certification body for whoever will read your certificate.

The decision is straightforward when asked in the right order: start from who is asking, read the requirement literally, then pick the accreditation route. What is not straightforward — and what actually decides the outcome — is building an ISMS that genuinely runs, because that part is identical on both routes and has no shortcut.