ISO/IEC 27001 certification is useful evidence that an information security management system has been certified for a stated scope. Due diligence should still check whether that scope includes the service, entity and locations relevant to the relationship. Certification does not by itself show every current technical exposure, service dependency or customer-specific risk.
FAQ
Third-Party Risk Management