Obtaining an ISO 27001 certification marks a significant milestone for your organization’s Information Security Management System (ISMS), but that's not the end of the journey. In order to maintain an ISO 27001 certification, you must undergo regular audits and continuous improvement. This article explores the essential steps to keep your certification active, and helping your organisation stay compliant.
Understanding the Certification Cycle
ISO 27001 certification lasts for three years, starting with the initial certification after successful Stage 1 and Stage 2 audits. During this period, your organization undergoes surveillance audits in Years 1 and 2 to verify ongoing compliance, followed by a recertification audit in Year 3 to renew the certificate. This cycle ensures your ISMS adapts to evolving risks and organizational changes.
Step 1: Preparing for Surveillance Audits
Surveillance audits occur approximately 12 and 24 months after certification, serving as a lighter check compared to the initial process. Auditors focus on specific ISMS areas like recent updates, incident logs, or selected controls, reviewing evidence such as risk assessments and training records. Preparation involves conducting internal audits, updating documentation to reflect current processes, and ensuring staff are trained on security policies. These audits typically last 1–2 days depending on your organization’s size and scope, with a report issued to address any minor or major non-conformities that could affect certification if unresolved.
Step 2: Addressing Non-Conformities
When surveillance audits uncover non-conformities, prompt action is necessary. This involves creating a Corrective Action Plan that details the root cause, corrective steps, and a timeline for resolution, followed by submitting evidence like updated policies or training logs to the certification body. They may conduct a follow-up audit or review the evidence to confirm fixes, helping maintain your certification status.
Step 3: Preparing for the Recertification Audit
The recertification audit in Year 3 mirrors the initial Stage 2 audit, offering a comprehensive review of your entire ISMS to ensure it aligns with the latest standard version and remains effective. Auditors assess compliance through interviews, evidence reviews, and control testing. Preparation includes a gap analysis to address standard updates or organizational changes, internal audits, and management reviews, alongside updating risk assessments and the Statement of Applicability. This audit typically spans 2–5 days based on complexity, with successful completion granting a new three-year certificate after resolving any non-conformities.
Continuous Improvement
Beyond audit requirements, maintaining certification involves strengthening your ISMS over time. Regularly update risk assessments to tackle emerging threats and account for changes within and around your organisation.
