After an ISO 27001 certificate is issued, the audits that follow test whether your information security management system keeps running, not whether it once existed. A workable rhythm is daily event monitoring, monthly evidence checks, quarterly access and risk reviews, and an annual internal audit and management review before the surveillance visit.
What does the certificate cycle look like?
Consultancy write-ups describe a three-year cycle: initial certification, surveillance audits in the following years, then a full recertification that starts a new cycle. They sample controls, check whether earlier findings were fixed, and ask for current evidence such as this quarter's access reviews. The sources I could fetch disagree on exact timing, and ISO's own pages were blocked for my fetcher, so confirm dates and sampling rules with your certification body and the standard itself.
This post explains the framework. It does not say any product certifies you, and Safeguard does not issue ISO certificates.
What does the audit actually look for?
Per one fetched guide, surveillance audits check whether previous findings were fixed, what changed since last time, whether the system is effective, whether sampled controls work as documented, and whether evidence is current and complete. Notice the word current. A policy approved two years ago with no review will draw attention. A screenshot from certification week will not prove a control still operates.
What is a sensible monitoring rhythm?
The cadence below follows the structure in that guide, and you should tune it to your risk.
- Daily: security events, access requests and incidents.
- Weekly: metrics, open corrective actions and new vulnerabilities.
- Monthly: evidence freshness, spot checks of controls, the risk register and a short metrics report.
- Quarterly: access reviews, an update of the risk assessment, policy review and training status.
- Annually: full policy and risk review and a penetration test.
The guide also says the internal audit should be finished annually before the surveillance audit, with its findings addressed and a management review held first. Management review also belongs after major changes or incidents.
Which parts do teams neglect?
- Evidence that ages. Exports taken once a year for the auditor leave months with nothing behind them.
- Corrective actions without owners. Findings from the internal audit that stay open at the next visit look like a system that stopped working.
- Supplier changes. New vendors and new data flows arrive between audits and often skip assessment.
- Scope drift. A new product, region or cloud account may sit outside what you certified.
- Software inventory. Open source dependencies and their known vulnerabilities change weekly, far faster than a yearly review notices.
What to do
- Put the rhythm in a calendar with named owners for each recurring task.
- Collect evidence continuously from the systems themselves, such as access logs, scan results and ticket exports, and keep timestamps.
- Run the internal audit early, not the week before the surveillance visit.
- Hold the management review with real inputs: incidents, metrics, risk changes and audit findings.
- Add a change trigger. New suppliers, products or regions start a short risk assessment.
- Track vulnerabilities by exploitation status, and keep the record. Safeguard's reachability analysis and compliance automation can collect this kind of evidence for the technical controls.
- Close findings with proof, and keep the proof where an auditor can find it.
Quick check
Is the work finished once the certificate is issued?
No. Surveillance audits sample controls and look for current evidence that the management system still operates.
How often should access be reviewed?
One fetched guide suggests quarterly access reviews. Your own risk assessment and certification body decide the real interval.
Sources
Last reviewed: 18 October 2026.
