After certification, your certification body confirms the certificate each year through surveillance activities. The first visit usually falls 6 to 12 months after certification, and a full reassessment happens at the end of the cycle. The certificate is valid for three years, so the ISMS has to keep running between audits.
The cycle in outline
One certification body describes it this way. The certificate is valid for three years. Surveillance confirms it each year, with the first visit 6 to 12 months after certification. A full reassessment takes place in the fourth year. You get an estimate for the whole cycle at the start and a quotation for each year's work.
Terms differ between bodies, so read your contract and ask how your own cycle is scheduled.
What surveillance looks at
Surveillance samples parts of the ISMS rather than the whole thing. Expect the auditor to follow up earlier findings and to look at things that must keep happening: internal audits, management reviews, corrective actions and any changes you made. I could not confirm the exact scope rules of surveillance from the sources used, so check the scheme your certification body follows.
Keep these running all year
- Internal audits on the program you wrote.
- Management reviews on the schedule you set.
- Corrective action records closed with an effectiveness check.
- Risk assessment updates when systems, suppliers or threats change.
- A current Statement of Applicability.
- Training records for new starters.
An ISMS that was alive for the audit and dormant afterwards shows up quickly. Gaps in records are the easiest thing for an auditor to see.
Changes that deserve a note
Tell your certification body about big changes such as a new product line, a move to a different cloud, an acquisition or a change of scope. Clause 6.3, Planning for Changes, was added in the 2022 edition. It says changes to the ISMS must be made in a planned way, so keep a short change log.
A calendar that works
- Quarter 1: internal audit of first half of the scope.
- Quarter 2: internal audit of the rest, then management review.
- Quarter 3: risk review and Statement of Applicability refresh.
- Quarter 4: surveillance preparation and corrective action closure.
Adjust it to your own audit dates.
Budget for the cycle
Certification is a three year commitment, not a one off project. Plan time each quarter for the ISMS owner, and expect fees for each surveillance visit and for the full reassessment. Because quotes differ by body and scope, ask for the estimate across the whole cycle at the start, and compare it to the effort you will spend internally.
Quick check
How long is an ISO 27001 certificate valid?
Three years, with annual surveillance and a full reassessment at the end of the cycle.
Can we skip a surveillance audit?
Surveillance is how the certificate is confirmed. Skipping it puts the certificate at risk, so talk to your certification body if you cannot meet a date.
Sources
- What to expect from Stage 1 and Stage 2 ISO 27001 certification audits
- Schellman, preparing for ISO/IEC 27001:2022
Last reviewed: 19 October 2026.
