Is the enterprise ISO 27001-certified?

Certification or only the standard applied

This question asks for a certificate, not for an intention. "ISO 27001-certified" means that an independent certification body has assessed the company and issued a certificate, with an expiration date and a scope description. If the company does operate according to the standard, but an auditor has never visited, then the answer to this specific question is no — even if the substantive practice may be comparable. That nuance is precisely what these kinds of questionnaires are about: not "do we engage in information security" but "has that been externally assessed and confirmed".

If there is no certificate, it is customary to simply report that, possibly with a brief explanation of what there is: an information security policy, a risk analysis, or measures that substantively align with the standard without the formal assessment. Many customers accept that as an interim answer, especially when the underlying measures — such as the policy for risk analysis and the protection of information systems or the arrangements for access control and company assets — are in order. A certificate is then the supporting evidence that is missing, not the practice behind it.

Annex A as a practical test

The rationale for what an auditor assesses is set out in Annex A of ISO/IEC 27001: the list of control measures that the standard requires, from access control to supplier relationships to incident management. That list is usable as a checklist, even without a certificate: anyone who can demonstrate that most Annex A measures have been implemented can provide that as an explanation with a "no" to the certification question. The certificate itself, with scope and expiration date, remains the only evidence that literally answers the question with "yes".