ISO 27001 Stage 1 vs Stage 2 Audit: What Auditors Check

Stage 1 — What Auditors Check

• Documented information: scope, policy, risk process, SoA, objectives
• Understanding of context and readiness for Stage 2
• Planning of Stage 2 (sites, sampling, logistics)

Stage 2 — What Auditors Check

• Implementation and effectiveness of the ISMS
• Sampling of Annex A controls marked applicable in the SoA
• Internal audit and management review operating evidence

After Certification

Surveillance audits typically occur annually. Recertification occurs at the end of the ~3-year cycle.

Frequently Asked Questions

What is Stage 1?

The initial certification audit stage focused on reviewing documented information and readiness of the ISMS for Stage 2 (certification-body practice under ISO/IEC 17021-1 / ISO/IEC 27006).

What is Stage 2?

The on-site (or remote-equivalent) evaluation of ISMS implementation and effectiveness before a certification decision.

How long is the certificate cycle?

Typically three years, with annual surveillance audits, then recertification — per accredited certification practice.

Related ISO 27001 Resources

ISO 27001 hub · 93 controls · SoA · CSA · How long certification takes