Earning ISO 27001 certification is a milestone, not a finish line. The certificate is valid for three years, and keeping it active means demonstrating, on an ongoing basis, that your ISMS still works. This article covers the certification cycle and what it takes to stay certified.
Understanding the Certification Cycle
ISO 27001 certification lasts for three years, starting with the initial certification after successful Stage 1 and Stage 2 audits. During this period, your organization undergoes surveillance audits in Years 1 and 2 to verify ongoing compliance, followed by a recertification audit in Year 3 to renew the certificate. This cycle ensures your ISMS adapts to evolving risks and organizational changes.
Preparing for Surveillance Audits
Surveillance audits happen roughly 12 and 24 months after certification and are narrower than the initial assessment. Auditors focus on specific areas — recent changes, incident logs, selected controls — and review evidence such as risk assessments and training records. They typically last one to two days.
To prepare, run internal audits, keep your documentation current with how you actually work, and make sure staff remain trained on security policies. The audit produces a report noting any minor or major nonconformities that must be addressed to keep certification.
Addressing Nonconformities
When an audit finds a nonconformity, prompt action is essential. You create a Corrective Action Plan that identifies the root cause, the corrective steps, and a timeline, then submit evidence — updated policies, training logs — that the fix is real. The certification body either reviews the evidence or runs a follow-up check to confirm resolution.
Preparing for Recertification
The Year 3 recertification audit mirrors the original Stage 2 audit: a comprehensive review of the whole ISMS to confirm it still aligns with the current version of the standard and remains effective. Auditors assess compliance through interviews, evidence review, and control testing.
Preparation includes a gap analysis against any standard updates or organizational changes, internal audits, a management review, and refreshed risk assessments and Statement of Applicability. This audit typically runs two to five days based on complexity, and successful completion grants a new three-year certificate once any nonconformities are resolved.
Continual Improvement
Beyond satisfying audits, staying certified means genuinely strengthening the ISMS over time — the continual improvement that ISO 27001 is built around. Regularly update risk assessments to address emerging threats and changes inside and around your organization, act on the findings from internal audits and management reviews, and treat every incident as a chance to improve. An ISMS that improves is one that sails through surveillance and recertification rather than scrambling for each.
Make maintenance routine, not a recurring scramble
The organizations that find surveillance and recertification painless are the ones whose ISMS runs as a living system — current documentation, regular internal audits, evidence captured as you go. The ones that struggle are those who let it lapse between audits and rebuild under pressure each year.
Our ISO/IEC 27001 Lead Implementer Toolkit helps you operate the ISMS as an ongoing system, not a one-off project: maintainable, ISO-aligned templates and a structured plan you keep using well past the initial certificate, built by a practising ISO 27001 Lead Auditor. New to the process? Start with How to Become ISO 27001 Certified to see how the first certificate is earned.