The certificate arrives. The team celebrates, the sales deck is updated and the project is closed. Twelve months later, the surveillance audit approaches and an uncomfortable discovery emerges: the risk register has not been reviewed since the certification audit, several corrective actions are still open, the internal audit programme lapsed, and three new systems were launched outside the ISMS. What was a strong management system has quietly decayed.

This pattern is common because organisations treat certification as a destination. ISO 27001 treats it as a checkpoint in a continuous cycle. The standard's final clause is about improvement, and the certificate's validity depends on keeping the system alive.

What the certification cycle looks like

An ISO 27001 certificate is typically valid for three years, subject to conditions:

  • Surveillance audits are carried out by the certification body, normally annually, to verify that the ISMS continues to meet requirements. They usually sample parts of the system rather than testing everything.
  • Recertification audit takes place before the end of the three-year cycle and examines the whole ISMS again.
  • Special audits may be triggered by significant changes, serious incidents or complaints.

If nonconformities are not corrected, certification can be suspended or withdrawn.

What must keep happening

Risk management. Risks must be reviewed regularly and whenever significant changes occur, such as new products, acquisitions, migrations or suppliers. The risk treatment plan needs updating as controls are implemented or circumstances change.

Internal audits. The standard requires internal audits at planned intervals. Build an annual programme that covers all parts of the ISMS over the cycle, with additional focus on high-risk areas and previous findings.

Management review. Top management must review the ISMS at planned intervals, considering the status of actions, changes in internal and external issues, feedback, audit results, risk assessment results, opportunities for improvement and more. Outputs must include decisions about improvement and resource needs.

Corrective action. Nonconformities and incidents should lead to root-cause analysis and effective action, tracked to completion.

Awareness and competence. New joiners need training; existing staff need refreshers; roles with changing responsibilities need updated skills.

Document and record control. Policies and procedures need periodic review and version control; records must be kept as evidence.

Supplier oversight. Reassess critical suppliers, review their performance and incidents, and update contracts as needed.

Operational controls. Access reviews, vulnerability management, backups, monitoring and incident response must continue to run and generate evidence.

Building a sustainment calendar

Map the year in a simple calendar:

  • Quarterly: access reviews, steering group meetings, supplier performance checks, risk review for top risks.
  • Semi-annually: business continuity and incident response exercises, training refreshers.
  • Annually: full risk assessment review, policy review, internal audit cycle, management review, penetration test, Statement of Applicability review, surveillance audit.

Assign owners and send reminders. Calendar discipline prevents the slow drift that creates findings.

Embed the ISMS in change

Most ISMS gaps arise because the business changes and the ISMS does not follow. Link security to your change processes:

  • New projects and products undergo a security and privacy review.
  • New suppliers go through due diligence before contract signature.
  • Acquisitions and organisational changes trigger scope and risk reviews.
  • Infrastructure and architecture changes follow change control, with security input.

If these checkpoints exist, the ISMS stays current with minimal extra effort.

Measure and improve

Define a small set of metrics that show whether the ISMS is working: closure rate of corrective actions, time to remediate vulnerabilities, completion of access reviews, training coverage, number and severity of incidents, audit findings over time, and supplier assessment completion. Review them in steering meetings and look for trends. Improvement opportunities should be recorded and acted upon.

Prepare for surveillance audits without panic

A well-run ISMS does not need cramming. Practical tips:

  • Hold your internal audit and management review ahead of the surveillance audit with time to fix issues.
  • Close or make visible progress on previous audit findings.
  • Keep an evidence folder updated throughout the year.
  • Brief control owners on what auditors may ask.
  • Review changes since the last audit, including scope, systems, organisation and key staff.

Signs your ISMS is healthy

  • Management review minutes record real decisions.
  • The risk register changes over time.
  • Audit findings are fewer and less severe each cycle.
  • New projects consider security early.
  • Staff can describe what to do when they see an incident.

Signs of decay

  • The same corrective actions appear year after year.
  • Documents carry dates from the certification year.
  • Control owners cannot find their evidence.
  • The security team learns about new systems after launch.

Keep it alive

F9 Infotech supports organisations after certification with managed ISMS services: internal audits, risk reviews, management review preparation, evidence tracking and surveillance audit readiness. Talk to us about sustaining your ISMS and keep your certificate meaningful.

This article offers general guidance based on the ISO/IEC 27001 certification cycle.