ISO/IEC 27001 surveillance and recertification: what the three-year cycle demands of an ISMS, year by year

How the ISO/IEC 27001 certification cycle runs

ISO/IEC 27001 makes you audit your own ISMS but is silent on how often a certification body audits you. That rhythm comes from ISO/IEC 17021-1, which every accredited certification body must meet, and ISO/IEC 27006-1:2024, which adds ISMS-specific rules. Each three-year cycle starts at the certification decision. Surveillance happens at least once in every calendar year except the recertification year, the first no more than 12 months after the decision, and recertification must be finished before the certificate expires.

The expiry date holds only while each audit happens in its window and its findings are closed. Sterling does not certify: your accredited certification body plans the programme, audits and decides whether certification continues.

Year by year: what each audit asks of the ISMS

The body sizes each visit under ISO/IEC 27006-1 from your scope, headcount and locations. Surveillance visits are shorter than the initial audit, and recertification is recalculated on current figures.

What ISMS surveillance samples

Surveillance is selective, not a full-system audit. ISO/IEC 17021-1 fixes a core for every visit: internal audits and management review, action on earlier nonconformities, complaints, progress on objectives and improvement, continuing operational control, changes, and use of the certificate and marks. The rest is sampled across the cycle. For an ISMS, that usually means:

Findings are graded as at Stage 2, and a major left open past the body's deadline can lead to suspension; ISO/IEC 27001 nonconformities: major, minor and how to close them explains how to respond.

What recertification re-examines

Recertification looks at the ISMS as a whole. After reviewing the cycle's surveillance reports, the body audits whether the system stays effective amid internal and external change, whether management remains committed to maintaining and improving it, and whether it achieves its intended outcomes. For an ISMS, the common thread is whether the risk assessment kept pace with three years of new services, platforms, suppliers and threats. Significant change, such as new legislation, can add a Stage 1.

Expiry is a hard stop. If the audit is unfinished, or a major nonconformity not corrected and verified, by that date, the certificate is not extended. Certification can be restored within six months once the outstanding recertification work is done; after that, at least a Stage 2 audit is needed. Recertify in time and the new expiry date can follow on from the old one.

Changes you must report to the certification body

Your certification agreement obliges you to tell the body without delay about changes that could affect the ISMS's continued conformity. ISO/IEC 17021-1 gives five examples; in an ISMS they look like this:

• Legal status or ownership: an acquisition, merger or new legal entity.
• Organisation and management: a new chief executive or information security lead.
• Address and sites: an office or data centre opened, moved or closed.
• Scope of operations: a new service or client environment, or an activity outsourced or dropped.
• Major changes to the system and processes: a new cloud platform, or IT operations handed to a managed service provider.

Serious security incidents are not on that list, but some certification agreements add them: read yours and write its definition into your incident procedure. Clause 6.3 of ISO/IEC 27001 already requires changes to the ISMS to be planned, so make notice to the body a step in the plan. Extending the scope needs an application, which the body reviews and audits, sometimes during surveillance; see ISO/IEC 27001 scope: boundaries, interfaces and the mistakes that cost you.

Keeping the ISMS alive between audits

Surveillance auditors read dates. A risk register untouched since Stage 2 or access reviews bunched into the week before the visit show an ISMS that wakes up for audits. Sterling's recommended rhythm for a single-site scope, not a requirement of the standard:

• Monthly: the incident and event log, vulnerability remediation, changes planned for the month.
• Quarterly: access reviews for critical systems and privileged accounts, a slice of the internal audit programme, the Statement of Applicability checked against controls in use.
• Twice a year: the risk register reviewed with its owners; reviews of key suppliers and cloud providers.
• Annually: a full risk assessment (and on significant change), a management review that decides, refresher awareness and an incident response exercise.

Two routines have their own guides: ISO/IEC 27001 internal audit: planning, conduct and reporting and ISO/IEC 27001 management review: inputs, outputs and the record.

The 2022 edition and Amendment 1 in your cycle

The transition from ISO/IEC 27001:2013 ended on 31 October 2025: every valid accredited certificate now cites the 2022 edition, and one still citing 2013 has lapsed. Auditors now sample a Statement of Applicability built on 93 controls in four themes, including those new in 2022, such as threat intelligence (5.7), use of cloud services (5.23) and data leakage prevention (8.12).

Amendment 1:2024 is audited too: be ready to show how you determined whether climate change is a relevant issue. A later revision has yet to be announced; when one is, transition rules issued through Global ACI will set the deadline and say whether the transition audit can join a visit already in your cycle.

How Sterling's Sustain™ supports the cycle

Sustain™ is Sterling's support after certification. As confirmed in your proposal, it covers surveillance readiness, internal audits, repeat risk assessments, refresher learning and future extensions.

ISO/IEC 27001 surveillance and recertification: questions buyers ask