If Stage 2 is the real test, the years after certification are the proof.
Passing your Stage 2 audit is a big moment, and it deserves to be celebrated. But the certificate is not the finish line. It is the start of a three year cycle in which your certification body will come back every year to check that your Information Security Management System (ISMS) is still working.
This is where many organisations quietly slip. The project team disbands, priorities move on, and by the time the first surveillance audit arrives, the ISMS has gone stale. Here is how to avoid that.
The Three Year Certification Cycle
An ISO 27001 certificate is valid for three years, but it is not a one time pass. The cycle looks like this:
- Year 0: Initial certification. Stage 1 and Stage 2 audits, followed by the certification decision.
- Year 1: First surveillance audit. Usually within 12 months of the certification decision.
- Year 2: Second surveillance audit. Around a year after the first.
- Year 3: Recertification audit. A fuller review of the whole ISMS before the certificate expires, which starts a new three year cycle.
Miss a surveillance audit, or fail to close major nonconformities in time, and your certificate can be suspended or withdrawn. Surveillance is not a formality.
What Is a Surveillance Audit?
A surveillance audit is a shorter, sampled check that your ISMS continues to meet ISO 27001 and continues to improve. It typically takes around a third of the time of your initial certification audit, so auditors will not look at everything. They will choose a sample of controls and processes, and some areas come up every single time.
What Auditors Focus On
- Previous findings: closed, with root cause and evidence that the fix worked
- Internal audit and management review: completed since the last visit, with real decisions and actions
- Changes: new systems, sites, suppliers or migrations reflected in your scope, risks and Statement of Applicability
- Risk management: a register that is reviewed and updated, not frozen at certification day
- Continual improvement: evidence that the ISMS gets better each year
Why Organisations Slip
Once certification is done, the project team disbands, evidence stops being collected, and the internal audit gets rushed a few weeks before the visit. None of this is dramatic. It is slow drift, and surveillance audits are designed to catch it.
How to Keep Your ISMS Alive
- Name an owner with real time allocated to the ISMS
- Build an annual calendar: monthly metrics and actions, quarterly risk and access reviews, and the internal audit and management review planned well before the surveillance date
- Collect evidence as you go, not the week before the audit
- Treat change as an ISMS event: check scope, risks and Statement of Applicability whenever something significant changes
- Track corrective actions to closure in a single log
Final Thoughts
Certification proves your ISMS worked on audit day. Surveillance asks whether it still works. When security is owned, scheduled and part of normal operations, surveillance audits and the year three recertification become routine rather than a new project.
Need Help Keeping Your ISMS on Track?
If your first surveillance audit is approaching or your ISMS has drifted since certification, get in touch. I can help you close open findings, run your internal audit and set up a practical ISMS calendar.