How to maintain ISO 27001 certification: 3-year certificate term, first surveillance audit within 12 months, and 6 months to restore an expired certificate

How to Maintain ISO 27001 Certification

An ISO 27001 certificate often sits in the deal file next to the security questionnaire and the certificate of insurance. Keeping it there takes steady work long after the first audit.

This guide covers how to maintain ISO 27001 certification between audits, from preparing for surveillance visits to handling scope changes and suspensions. Audit rules come from ISO/IEC 17021-1 and accreditation body guidance, breach data comes from the 2026 Verizon and IBM reports, and advice based on common practice is labeled as such.

Key takeaways

  • Maintaining ISO 27001 certification means running your information security management system (ISMS) throughout the certificate’s three-year term. Your certification body checks it with a surveillance audit in each of the first two years and a full recertification audit before expiry.
  • A certificate’s status, expiry date, and scope matter before every renewal, because buyers can look all three up in IAF CertSearch.
  • Business changes are ISMS changes. A new cloud region, vendor, product line, or AI tool affects your scope, risk register, or Statement of Applicability.
  • Recertification deadlines are fixed. An expired certificate is invalid from its expiry date, and restoration is possible only within six months.

How long does ISO 27001 certification last?

An ISO 27001 certificate is valid for three years under ISO/IEC 17021-1, the standard that sets how certification bodies run audits. 

An ISO 27001 certificate cycleAlt text: Timeline of the ISO 27001 certification cycle: two surveillance audits, then recertification before the month 36 expiry.

Figure 1. The ISO 27001 certification cycle, with timing from ISO/IEC 17021-1.

The first surveillance audit must take place within 12 months of the certification decision. The second follows a year later, and the recertification audit, plus the certification body's decision, has to be completed before the expiry date printed on the certificate.

What happens if recertification runs late

A certificate that expires before the recertification decision stops being valid on its expiry date. Under ISO/IEC 17021-1, the certification body can restore it within six months if the outstanding recertification work is finished. After six months, you repeat at least a Stage 2 audit, the full on-site review of your controls.

What do surveillance and recertification audits check?

A surveillance audit samples part of your ISMS to confirm it still works, and a recertification audit reviews the entire system. 

Table 1. Surveillance audit vs. recertification audit

Area Surveillance audit (years 1 and 2) Recertification audit (year 3)
Always reviewed Internal audit, management review, fixes for earlier findings, and changes since the last visit Every requirement and applicable control, including the surveillance items
Result The certificate continues, or is suspended if serious findings stay open A new certificate, valid for another three years

Based on ISO/IEC 17021-1. Audit length and sampling vary by certification body.

How nonconformities affect your certificate

Auditors classify each gap as a major or minor nonconformity. A major one means a requirement isn't met in a way that undermines what the ISMS should achieve, and the certification body sets a deadline to correct it. A major left open past that deadline can lead to suspension. A minor one needs a corrective action plan that gets checked at the following audit, and observations carry no deadline, though the next auditor will likely ask how you handled each one.

How do you prepare for a surveillance audit?

Start about two months before the audit date and work through these steps in order.

  1. Close the last audit's findings: Confirm every corrective action from the previous visit is complete and has evidence.
  2. Run the internal audit: Cover the parts of the ISMS the certification body hasn't sampled recently, and record findings the way an external auditor would.
  3. Hold the management review: Leadership looks at audit results, incidents, risks, and security objectives, and the meeting record becomes evidence.
  4. Refresh the risk register and Statement of Applicability: The document listing which controls apply to you and why any are excluded. Update both to reflect each change logged since the last visit.
  5. Confirm the certified scope: Compare the scope statement on your certificate with the company you run today. 
  6. Pull evidence for the whole period: Auditors sample records from across the months since their last visit, such as access reviews, offboarding tickets, change approvals, and vendor assessments.
  7. Brief each control owner: Every owner should be ready to walk an auditor through their control and its records.

What does certificate status mean for open deals?

A certificate's status is visible to buyers. IAF CertSearch lists each accredited certificate as active, suspended, withdrawn, or expired, and procurement teams use it to verify supplier claims.

Vendor reviews also repeat after the first contract. Third parties were involved in 48% of breaches in the 2026 Verizon DBIR, up from 30% the year before, which gives buyers reason to recheck a vendor's credentials at renewal.

Before any renewal or new security review, confirm these three points:

  • The certificate shows as active, with a surveillance audit within the last 12 months.
  • The expiry date falls after the contract's renewal date, or recertification is already booked.
  • The certified scope still covers the product, sites, and teams the customer is buying from.

What to do if your ISO 27001 certificate is suspended mid-deal

Tell the customer before their procurement team finds the status change. Share the certification body's notice, your corrective action plan with dates, and the date of the follow-up audit.

How do you keep an ISMS audit-ready between audits?

ISO 27001 maintenance is mostly routine work spread across the year, and the following five habits cover it:

  1. Give every control a named owner

Assign each policy, review, and evidence artifact to one person. At a 30-person company, for example, the engineering lead might own access and change management, the head of people might own onboarding and training, and finance might own vendor contracts. Put each owner's due dates in the calendar they already use.

  1. Attach compliance tasks to work you already do

Run access removal inside HR offboarding, vendor reviews at contract renewal, and change approvals inside your deployment pipeline. Evidence then comes out of normal operations.

  1. Hold a quarterly internal review

ISO/IEC 27001 requires internal audits and management reviews at planned intervals. A quarterly check between them should confirm that access reviews ran, scan findings were closed, new vendors were assessed, and last quarter's corrective actions were done.

  1. Update the ISMS when the business changes

In the 2026 Verizon DBIR, 45% of employees regularly used AI on corporate devices, up from 15% a year earlier, and IBM found shadow AI incidents more than doubled to 43%. Log each change in the records below on the day it happens.

Table 2. Business changes and the ISMS records they touch

Change Records to update
New cloud environment or region Scope, asset inventory, risk register
New vendor with access to data Vendor assessment, risk register
New product line or acquisition Scope, Statement of Applicability, risk register
New AI tool in daily use Acceptable use policy, risk register
Team growth or reorganization Control owners, access reviews, training records
Amendment to ISO 27001 Context analysis, policies

Based on ISO/IEC 27001 requirements for scope, risk assessment, and the Statement of Applicability. Your ISMS may track additional records.

  1. Automate evidence collection

Set your cloud, identity, HR, and ticketing tools to export evidence on a schedule, then review only the exceptions.  Scheduled exports cover the whole period an auditor samples, and your team reviews only the exceptions.

Where do ISO 27001 controls drift?

The 2026 breach data points to vulnerability management as the first place to look. Exploited vulnerabilities became the most common way into a breach at 31%, and only 26% of critical known-exploited vulnerabilities were fully fixed, according to the 2026 Verizon DBIR. Detection lags as well, with breaches taking an average of 247 days to identify and contain in IBM's 2026 report.

ISO 27001 sorts its controls into organizational, people, physical, and technological themes.

Table 3. Common drift points by control theme

Theme Where it drifts Cadence that holds
Organizational Policies describe systems you no longer run, vendor assessments go stale, and the risk register stops changing Policies yearly, risk register quarterly, vendors at each renewal
People Former employees keep access, role changes skip access updates, and training goes unrecorded Access reviewed quarterly, training logged yearly
Physical Cloud provider responsibilities go undocumented, and old devices leave without disposal records Cloud provider responsibilities reviewed yearly, disposal recorded for each device
Technological Scan results go unreviewed, deployment approvals get skipped, and logs are collected but never read Scans and logs reviewed monthly with recorded findings, approvals enforced in the pipeline

Cadences reflect common practice. The frequencies written in your ISMS are the ones auditors hold you to.

If you can fix only three areas this quarter, start with vulnerability patching, vendor reviews, and access removal at offboarding. They match three findings in the 2026 Verizon DBIR on exploited vulnerabilities, third-party breaches, and credential abuse.

Stay audit-ready with Koop

Koop keeps the work in this guide on schedule from one platform. Its ISO 27001 program pulls evidence from your cloud and work tools as systems change, and the Housekeeper AI Agent completes recurring compliance tasks between audits.

When you add a vendor or a new rule takes effect, Third-Party Risk Management and Regulatory Intelligence show what needs updating. Surveillance and recertification audits then run through Koop's auditor network, and the Trust Center shows buyers your certificate is active.

Start free with Koop and show buyers an active certificate.

Start free

Disclaimer: 

Based on the sources listed below, checked October 21, 2026. Confirm current requirements with your certification body. Koop publishes this guide.

Frequently asked questions

  1. Does the 2024 ISO 27001 amendment affect an existing certificate?

An existing ISO 27001 certificate stays valid after ISO's February 2024 amendment. The amendment requires you to decide whether climate change is relevant to your ISMS and notes that interested parties can have climate-related requirements. Auditors must verify that decision at your next surveillance or recertification audit.

  1. Do you need to tell your certification body when your scope changes?

Yes, as soon as the change is planned and before it takes effect. Send your certification body a written request describing what is changing, such as a new product line, site, or legal entity, and when. Under ISO/IEC 17021-1, the certification body then assesses the change at a scheduled surveillance audit or a separate special audit and updates the certificate. 

  1. Who should own ISO 27001 maintenance at a startup?

At a startup, one ISMS owner, usually the security lead or a technical cofounder, coordinates ISO 27001 maintenance. 

Sources

  1. ISO, ISO/IEC 17021-1 (requirements for bodies providing audit and certification of management systems): https://www.iso.org/standard/61651.html
  2. IAF CertSearch, understanding certification status: https://support.iafcertsearch.org/verifiers/getting-started/certificate-verification-guide/understand-the-certification-status
  3. Verizon, 2026 Data Breach Investigations Report, Executive Summary: https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf
  4. ISO, ISO/IEC 27001 standard page: https://www.iso.org/standard/27001
  5. Baker Donelson, ten takeaways from IBM's 2026 Cost of a Data Breach Report: https://www.bakerdonelson.com/ten-takeaways-from-ibms-2026-cost-of-a-data-breach-report
  6. Standards Council of Canada, accreditation bulletin on climate change considerations in management system standards: https://scc-ccn.ca/accreditation/bulletins/incorporating-climate-change-considerations-management-system-standards
  7. Koop, ISO 27001: https://www.koop.ai/iso
  8. Koop, Housekeeper AI Agent: https://www.koop.ai/housekeeper-ai-agent
  9. Koop, Third-Party Risk Management: https://www.koop.ai/risk-management
  10. Koop, Regulatory Intelligence: https://www.koop.ai/regulatory-intelligence
  11. Koop, audits and auditor network: https://www.koop.ai/audit
  12. Koop, Trust Center: https://www.koop.ai/trust-center
  13. Koop, plans and pricing: https://www.koop.ai/plans

‍

View All
article highlights:
Link
Link
Share the article: