ISO 27001 Surveillance and Recertification: Years 2, 3 and the Three-Year Cycle

An ISO 27001 certificate lasts three years. In years one and two, your certification body runs a shorter surveillance audit to check the system is still working. In year three, a full recertification audit re-examines the whole ISMS before the certificate expires. Miss a surveillance audit, or fail to close a major finding, and the certificate can be suspended.

Most companies treat certification day as the finish line. It is not. It is the start of a three-year cycle, and the certificate you framed on the wall is conditional — it stays valid only while the audits in years one, two and three keep going your way. The good news is that none of this is a surprise. The cycle is fixed, the rules are published, and a small team that keeps its evidence habit alive will find the later audits far easier than the first one. The companies that lose certificates are almost never the ones with weak security. They are the ones that stopped filing evidence the week after the Stage 2 audit ended.

This guide walks through the three years: what each audit checks, what happens when the auditor finds something, what recertification actually demands, what staying certified costs, and the mistakes that end certificates early.

The three-year cycle, at a glance

The cycle is set by ISO/IEC 17021-1, the standard that governs how certification bodies run management-system audits. Your certificate carries an issue date and an expiry date exactly three years later. Between those dates, the certification body must audit you at least once every calendar year, with the first surveillance no later than twelve months after the certification decision. Here is how it plays out.

Two things about this table matter more than the rest. First, the expiry date is fixed when the certificate is issued. A surveillance audit that slips from month 12 to month 15 does not push the expiry date back — it eats into the time left for the recertification audit that follows. Second, the recertification audit is a full re-evaluation, not a renewal form. The certification body has to confirm continued conformity before it issues a new certificate, and it will. Or it will not.

What a surveillance audit actually checks

Think of it the way you think about your health. The Stage 2 audit was the full medical: everything examined, everything measured. A surveillance audit is the annual check-up. The doctor does not repeat every test. They check the vitals, look at the bloodwork, ask what changed since last year, and check whether you followed the advice from the last visit. Same idea here.

Every surveillance audit must cover the same mandatory elements, whatever else the auditor samples:

• Internal audit results. Did you actually run the internal audits your programme promised, and did you do anything about the findings? An internal audit plan that exists only on paper is one of the fastest ways to earn a finding.
• Management review results. Did top management sit down, review the ISMS, and act on what came out of it? The minutes and the decisions matter more than the meeting.
• Corrective actions. What happened to every nonconformity from the last audit — internal or external? The auditor will trace each one to its closure evidence.
• Complaints and how they were handled. Security complaints from customers, staff or anyone else, and what you did about them.
• Whether the ISMS is still effective. Are the security objectives being met, and are the planned activities actually happening?
• Changes to the ISMS. New systems, new suppliers, new people, new risks — and whether the risk assessment and controls kept up.

On top of those, the auditor samples a subset of the Annex A controls each time — different ones each year, so that across the three-year cycle the whole control set gets covered. A control that passed in year one still has to produce records in years two and three. The auditor is not checking whether the control exists. They are checking whether it kept running.

Surveillance audits are shorter than Stage 2 — typically one to three audit days for a small company, against three to ten for the initial certification. Shorter does not mean gentler. A major nonconformity found during surveillance carries the same weight as one found during initial certification, and it must be resolved within the deadline the certification body sets.

What the auditor does with what they find

Findings come in two sizes, and the difference decides everything.

A minor nonconformity is a gap that does not break the system: a record filed late, a review that happened but was not minuted, a control that works but is not quite documented the way the procedure says it should be. Minors must be corrected, and the auditor will check the correction at the next visit, but they do not threaten the certificate.

A major nonconformity is different. It means the system has a hole that matters — a control that stopped operating, a risk that was never assessed, a corrective action from the last audit that was never done. The certification body will set a deadline for the correction and the corrective action, usually around ninety days, and it must verify that the fix actually worked, sometimes with a follow-up visit, before the certificate can continue. Miss the deadline, or fail to convince the auditor the fix is real, and the certificate can be suspended. Suspension is not the end — a suspended certificate can be restored once the finding is closed — but a suspended certificate cannot be shown to buyers, and a buyer who checks will find out. Leave a suspension unresolved and the certification body withdraws the certificate entirely, and the next certification starts from the beginning.

The practical rule is simple: close findings fast and keep the evidence. A major finding closed in three weeks with clean evidence is a story of a working system. The same finding still open at the next audit is a story of a system that only works when an auditor is in the room.

The recertification audit in year three

Somewhere around month thirty, start preparing. Three to six months before expiry is the window most certification bodies recommend, and it exists for a reason: if the recertification audit finds something that needs fixing, you need time to fix it while the old certificate is still valid. Start a month before expiry and a single major finding can leave you with a gap between certificates — and a gap is exactly what a buyer's vendor questionnaire will catch.

The recertification audit looks like the original Stage 2 audit, and in a sense it is one: it covers the whole ISMS scope, re-examines clauses 4 to 10 and a wide sample of Annex A controls, and judges the overall effectiveness and maturity of the system over the previous three years. The difference is the starting point. The auditors already hold two years of surveillance history, so they know where you were weak, which findings recurred, and whether the control environment kept pace as the business changed. They will sample the areas that were weak before. They will ask what changed since the last audit — new products, new infrastructure, new people, new threats — and whether the risk assessment and the Statement of Applicability moved with them.

It is usually shorter than the initial audit, because the certification body is not starting from zero. It is also, in one important way, harder: the initial audit judged a system you had just built, with fresh energy and a project team behind it. The recertification audit judges a system that has had three years to drift. The companies that pass comfortably are the ones whose internal audits kept running, whose management reviews kept happening, and whose evidence was filed as it was produced rather than assembled in a panic the month before.

Pass, and a new certificate is issued with a new three-year expiry date. The cycle starts again: surveillance in years one and two, recertification in year three. Fail, and there is no certificate to renew — the body will not issue one until the findings are closed, and the clock on the old certificate keeps running either way.

What changes between audits — and why you must tell the certification body

Three years is a long time for a growing company. You will add products, move to a new cloud region, open an office, take on a big customer, outsource a function, or bring one back in-house. Every one of those changes can move the edge of your certified scope.

The rule is to tell your certification body when something significant changes, before the next audit discovers it. A new site or a new product line may need extra audit time, and the body will say so. A change you report is a planning item. A change the auditor discovers is a finding. The same logic applies to the Statement of Applicability: if a control no longer applies, or a new risk needs a new control, update the SoA and the risk register when the change happens, not when the audit is booked. Our ISO 27001 documents checklist covers the records an auditor will ask for, and every one of them is a living document — the moment it stops being updated is the moment it starts failing audits.

This is also where the scoping decisions from your first certification matter. If you drew the scope around a product rather than an office, as our ISO 27001 guide for SaaS companies explains, then product changes are scope changes, and the certification body needs to know about them. If you drew the scope around a site, then a new site is a scope change. Either way, the habit is the same: scope is a decision you maintain, not a sentence you wrote once.

What staying certified costs

Nobody can quote you a fixed price for surveillance and recertification, because the certification body charges by audit day, and the audit days depend on your scope, your sites and your headcount. What you can budget for is the shape of it: one surveillance audit a year, each shorter and cheaper than the Stage 2 audit, and one recertification audit in year three that is closer in size to a Stage 2 but usually shorter, because the body already knows your system. The fees are charged at actuals by the body, and they vary enough between bodies that the quote is worth comparing before you sign — just as it was the first time.

On the consultancy side, the pattern is the same as the initial certification. ComplyKart's ISO 27001 consultancy starts at ₹14,999 for companies up to 25 employees and ₹29,999 for 26 to 100 employees, with certification-body fees extra at actuals — those are the prices for getting certified, set out in our ISO 27001 cost guide for IT companies and startups. For the years after, the consultancy you actually need is lighter: help with the internal audit programme, a pre-surveillance gap check, and recertification preparation. Budget for your own team's time too, because that is the cost nobody quotes and everybody pays: the hours spent running internal audits, holding management reviews, and filing evidence month after month. A system your team cannot sustain lapses at the first surveillance audit, and a lapsed certificate costs more to rebuild than a maintained one costs to keep.

One more cost worth naming: the cost of the gap. If a certificate lapses or is suspended, the tenders and security questionnaires that ask for it do not wait. The price of staying certified is a few audit days a year. The price of losing it is measured in deals.

Five mistakes that lose certificates

• Stopping the evidence habit the week after Stage 2. The access reviews, the incident log, the vendor assessments — if they stop, the next surveillance audit finds a year of silence, and silence is a finding.
• Treating the surveillance audit as a formality. It is shorter, but a major nonconformity found there carries the same weight as one found at certification, and the same suspension risk.
• Letting the first surveillance slip past month twelve. The expiry date does not move, so a late surveillance compresses the recertification window — and a compressed window is how a fixable finding becomes a lapsed certificate.
• Leaving recertification preparation to the last month. Three to six months before expiry is the window. A major finding found four weeks before expiry is a gap between certificates.
• Changing the scope silently. A new product, a new site, a new cloud region — report it to the certification body when it happens, not when the auditor finds it.

A simple year-by-year routine

The whole three-year cycle runs on two habits: an internal audit programme that covers the full ISMS across the three years, and a management review that actually happens. Everything else is keeping records as you go. Here is the routine in its simplest form.

That is the whole system. It is not glamorous, and it is not difficult. It is a calendar, a folder of evidence, and the discipline to keep both current. Our ISO 27001 process guide walks through the stages the first time round; the routine above is what keeps the certificate alive after that.

If the certificate is still a plan rather than a fact, start at the beginning: the ISO 27001 certification service page carries the current consultancy prices, and the compliance fee calculator can help you line up the year's filing costs beside the certification budget. And if you are buying from a supplier, remember that a certificate is only as good as its last audit — knowing how to check whether one is genuine is worth five minutes of your time.

FAQs

How long is an ISO 27001 certificate valid?

Three years from the date of issue, under ISO/IEC 17021-1. It stays valid only if you pass a surveillance audit in each of the two years in between, and a full recertification audit before it expires. The expiry date is fixed when the certificate is issued.

What does an ISO 27001 surveillance audit check?

Every surveillance audit must check your internal audit results, management review results, corrective actions from previous audits, complaints and how they were handled, whether the ISMS is still effective, and what changed since the last audit — plus a sample of Annex A controls that changes each year.

What happens if you fail an ISO 27001 surveillance audit?

A major nonconformity must be corrected within the deadline the certification body sets, usually around ninety days, and the body must verify the fix worked. Miss the deadline and the certificate can be suspended; leave a suspension unresolved and it is withdrawn.

When should I start preparing for ISO 27001 recertification?

Three to six months before the certificate expires. That leaves time to fix anything the recertification audit finds while the old certificate is still valid. Starting a month before expiry risks a gap between certificates.

Is recertification the same as the first certification audit?

Close, but not identical. It is a full re-evaluation of the whole ISMS, like the original Stage 2 audit, but the auditors start from three years of history, so it is usually shorter — and they will look hardest at the areas that were weak in earlier audits.