I used to do this sort of thing informally (meaning that we followed the standard and based our internal standards on it, but never sought certification) when I

I used to do this sort of thing informally (meaning that we followed the standard and based our internal standards on it, but never sought certification) when I was an ISO. It would be interesting to see the scope that describes in detail what exactly was certified. These certifications are typically very focused and not general or broad. For example, I saw a company's data center certified once and one specific system is a teaching hospital's IT department, but I've never seen a very broad, general certification. Based on what I've seen, the cost would be enormous and it would take years. It's an on-going process too that never really ends.