After certification, ISO 27001 turns into a routine: measure whether controls work (clause 9.1), run internal audits (9.2), hold management reviews (9.3) and fix nonconformities (clause 10). Certification bodies then return for surveillance audits. The teams that stay certified treat the ISMS as a monthly habit, not a yearly scramble.
Why does the certificate not mean you are finished?
The certificate says your management system met the standard on the days it was audited. It does not say it still works today. Your stack changes, people join and leave, suppliers change, and each of those moves the risk picture.
ISO's own pages were blocked when we tried to fetch them on 18 October 2026, so the clause and audit cycle details below come from widely used implementation guidance. Check dates and requirements with your certification body. In that guidance, certification is followed by annual surveillance audits that sample part of the system, and a full recertification audit after three years.
That cycle sets your real deadline. You do not need to be perfect every day. You need to be able to show, on any day an auditor picks, that you noticed problems and dealt with them.
What does ongoing monitoring look like in the standard?
Four clauses carry most of the load.
- Clause 9.1, monitoring and measurement: decide what you measure, how, and who looks at it. A metric nobody reads is a finding waiting to happen.
- Clause 9.2, internal audit: an audit programme, not a single audit. Cover every in-scope area over the certification cycle, using people who do not audit their own work.
- Clause 9.3, management review: leadership looks at audit results, incidents, risk changes and objectives, then records decisions.
- Clause 10, improvement: every nonconformity gets a cause, a fix and a check that the fix held.
Annex A also contains a control on monitoring activities (A.8.16 in the 2022 edition), which covers watching networks, systems and applications for odd behaviour. Treat it as the technical sibling of clause 9.
Which cadence is realistic for a small team?
Keep it boring and calendar driven.
Monthly: review the risk register for changes, look at vulnerability and patch status, check open nonconformities, and glance at access changes since last month.
Quarterly: run access reviews for critical systems, check supplier changes against your supplier list, and test one control end to end, such as restoring a backup.
Twice a year: tabletop an incident, and review any control where evidence has been thin.
Annually: refresh the risk assessment, run the internal audit programme slice for the year, hold the management review, and re-approve policies.
Put each item in a shared calendar with an owner and the evidence you expect, such as a ticket, a log export or signed minutes.
What evidence will a surveillance auditor ask for?
Expect them to start from your Statement of Applicability and pick controls to sample. They will also want the last internal audit report, the last management review minutes, the nonconformity log and any significant changes since the previous visit, such as a new product, a new office or a new cloud provider.
Keep a "changes since last audit" note running all year. Write one line each time something material changes, with the date and who approved it. It saves hours later.
What mistakes cause trouble after certification?
- A stale SoA. Controls were added or dropped but the document still shows the audit-day picture.
- Internal audits done by the person who built the control.
- Management review minutes that say "reviewed" and nothing else. Record what was decided and by whom.
- Nonconformities closed without a root cause.
- Scope drift. A new service ships and nobody asks whether it falls inside the certificate scope.
What to do
- Write down the three to five measures you will track under clause 9.1, with an owner and a review date for each.
- Build the internal audit programme for the full cycle and schedule this year's slice.
- Put the monthly, quarterly and annual items in a shared calendar with an evidence note beside each.
- Add a standing agenda item for scope and SoA changes to your monthly security meeting.
- Keep a nonconformity log with cause, fix, owner and verification date.
- Book the management review before the audit window, not after.
Quick check
How often are surveillance audits?
Implementation guidance describes annual surveillance audits during the certificate cycle, with recertification after three years. Confirm the exact schedule with your certification body, since ISO's own page could not be fetched for this article.
Do we need continuous monitoring tooling to stay certified?
The standard asks you to monitor and measure, not to buy a specific tool. Tooling helps you collect evidence reliably between audits, but a disciplined spreadsheet and calendar can satisfy the requirement for a small scope.
Sources
- ISO, ISO/IEC 27001 information security management: the page was blocked when fetched on 18 October 2026, so clause and cycle details are from implementation guidance and need checking against the standard text you buy.
- NIST, Cybersecurity Framework 2.0: used for the idea of continual improvement against a current and target profile.
How Safeguard helps automate this
The hard part after certification is keeping evidence fresh between visits. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence comes from connected systems and code instead of screenshots, and monitoring keeps running between audits. Technical evidence is drawn from your real code and dependencies, through scans, SBOMs and reachability, not only from policies. If you want it, the autonomous remediation agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and at what approval level. The audit is still done by your independent certification body. Book a call to see it.
Last reviewed: 18 October 2026.
