ISO 27001 Surveillance Audits and Recertification: The 3-Year Cycle

Typical cycle

• Year 0 — Stage 1 / Stage 2 certification
• Years 1–2 — surveillance audits
• Year 3 — recertification

Surveillance prep

Sample controls rotated, NC closure proof, risk register updates, and supplier performance.

Significant changes

Notify the CB of major scope changes (new sites, acquisitions) per contract.

How CyberSilo Helps

• Evidence mapping in CyberSilo CSA
• Detection and logging proof with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Can surveillance be remote?

Often partially — confirm with your CB and accreditation rules.

Failed surveillance?

Major NCs can threaten certification {EM} close urgently.

Transfer mid-cycle?

Possible under IAF transfer rules with documentation.

Related Resources

• Nonconformities
• Choose a CB