How do we keep our ISO 27001 certificate after the certification audit?

Start

We are certified and want to keep the certificate

The certificate names the scope and is usually valid for three years, provided the surveillance audits go well. The phases of the project become a yearly cycle: risk assessment, operation, internal audit and management review.

• Then: Put the three-year cycle in a calendar and a budget

Step

Put the three-year cycle in a calendar and a budget

Mark the surveillance audits, the recertification date, the internal audits and the management reviews. The pack estimates surveillance at about a third of the initial fee each year and recertification at about two thirds every three years. Budget for them at the start, because a missed surveillance audit can lead to suspension.

• Then: Keep the system running between audits

Step

Keep the system running between audits

Between audits the ISMS keeps running: measures, reviews, audits and records. Keep reporting the headline measures, and watch overdue gaps most closely between audits. A system that stops producing records between audits gives the auditor nothing to sample.

• Then: Is a surveillance audit overdue or postponed?

Decision

Is a surveillance audit overdue or postponed?

For schemes under the international accreditation arrangement, failure to hold a surveillance audit in time can lead to suspension, during which the certificate and marks cannot be used. If it is not resolved in the body's time, suspension can lead to withdrawal. If you are not sure of the date, answer yes and check.

• Yes, or not known: Speak to the certification body at once
• No: Is the next surveillance audit booked with the body?

Step

Speak to the certification body at once

Ask the body what date it will accept and what suspension would mean for your customers. Tell the sponsor the same day, and do not use the certificate or marks if it is suspended. Then carry on with the rest of this route.

• Then: Is the next surveillance audit booked with the body?

Decision

Is the next surveillance audit booked with the body?

The first falls within 12 months of the certification decision by the pack's default, set by the accreditation rules the body works under. If it is not in the body's calendar, answer no.

• Yes: Prepare for what the surveillance auditor reads
• No, or not known: Book it, with the audit days in the quote

Step

Book it, with the audit days in the quote

Ask for the date, the audit days and the person who will lead it, and put it in the calendar with the internal audit and review before it.

• Then: Prepare for what the surveillance auditor reads

Step

Prepare for what the surveillance auditor reads

The auditor usually looks at the internal audit, the management review, the nonconformity log, the corrective actions from the last audit, changes to the ISMS and a rotating part of the controls. Public sources add the use of the certification marks and complaints.

• Then: Is every finding from the last audit closed and checked?

Decision

Is every finding from the last audit closed and checked?

A finding fixed only at the symptom returns at the first surveillance audit. Each needs a root cause, a correction, a corrective action and a check that it worked. If any is open without a dated plan, answer no.

• Yes: Has the scope, ownership, a site or a serious incident changed?
• No, or not known: Finish them before the audit

Step

Finish them before the audit

Close each at its cause, record the check, and put any remainder on a dated plan. Bring the position to the management review.

• Then: Has the scope, ownership, a site or a serious incident changed?

Decision

Has the scope, ownership, a site or a serious incident changed?

The pack says to tell the certification body about a change of scope, ownership, sites or a serious incident. It may adjust the next audit or visit sooner. Public sources add that severe breaches, serious complaints and major restructuring can lead to a short-notice audit. If you are not sure, answer yes.

• Yes, or not known: Tell the certification body, before it hears elsewhere
• No: Do you want to add a new service or site to the scope?

Step

Tell the certification body, before it hears elsewhere

Write to your contact with what changed, what it affects and what you are doing. Update the scope, the risk assessment and the Statement of Applicability for the change, and keep the correspondence.

• Then: Do you want to add a new service or site to the scope?

Decision

Do you want to add a new service or site to the scope?

The pack's rule is to add a new service at a surveillance audit once it has records, rather than before it has run. If a part of the organisation is joining the ISMS, answer yes.

• Yes: Ask the body to assess it once it has records
• No: Have an internal audit and a management review been held this year?

Step

Ask the body to assess it once it has records

The body reviews the updated scope, risk assessment and Statement of Applicability. It may assess the extension at a surveillance audit with added days or in a separate audit, and then issue a revised certificate.

• Then: Have an internal audit and a management review been held this year?

Decision

Have an internal audit and a management review been held this year?

The pack's default is at least every 12 months, with the audit results as an input. The pack audits blocking items every year and everything else once in the cycle, and the review comes after the audit. A review held too early has to be held again. If the date has passed or the minutes show no decisions, answer no.

• Yes: Plan recertification from the start of year three
• No, or not known: Hold what is missing: the audit first, then the review

Step

Hold what is missing: the audit first, then the review

Hold the internal audit, then the review so its results are an input, and minute the decisions and the owners of the actions.

• Then: Plan recertification from the start of year three

Step

Plan recertification from the start of year three

Recertification is a full audit before the certificate expires. It covers the whole ISMS and its performance over the cycle, and every clause and applicable control should have been audited internally once by then. Resolve any open major nonconformity and the body's decision before expiry.

• Then: Cycle in place: repeat it each year

Outcome

Cycle in place: repeat it each year

Keep the calendar, the records and the log current, and review the programme after each management review. Re-rate the areas that had a finding or an incident.