orbit by reconn.Quick answers on ISO 27001 and information security
How long does ISO 27001 certification last?
It depends on the certification body, but the audit cycle is the same.
- By Shenoy
- Updated
Every great mission starts with reconn.
It depends on the certification body. ANAB says some bodies issue three-year certificates with an expiry date, while others issue certificates that stay valid unless withdrawn, and both are acceptable. Either way, certification includes annual surveillance audits and a re-assessment audit, normally in the third year.
A certificate is not a one-time prize. It stays valid only while the ISMS keeps passing audits.
The audit cycle
ANAB describes two common patterns for surveillance: one audit each year, or two audits about six months apart. Total surveillance audit days are usually similar either way, about one third of the initial audit days under IAF guidance. The re-assessment audit normally comes in the third year and lasts about two thirds of the initial audit.
What this means for you
Ask your certification body which pattern it uses and when the certificate expires. If the validity of someone else's certificate is in doubt, ANAB recommends contacting the certification body directly.
This is different from a personal PECB credential, which is valid for three years. See how long PECB certification is valid.
Practitioner note: Put the surveillance dates in your management calendar on day one. Surveillance years are when drift shows up, because the ISMS has fewer reasons to be refreshed.
How reconn helps
Keeping an ISMS audit-ready between audits is a skill. The PECB ISO 27001 Lead Auditor course helps your team run credible internal audits, and reconn's implementation services can support the cycle.