Getting your ISO 27001 certificate is the easy part. Working out how to maintain ISO 27001 certification through three years of surveillance audits, staff turnover, and shifting risks is where most organisations struggle. Certificates get suspended not because businesses fail to care about security, but because nobody owned the ongoing admin once the champagne wore off.
This article gives you the direct answer: eight practices that keep your Information Security Management System audit-ready every single day, not just in the weeks before an assessor visits. You’ll find guidance on surveillance audit preparation, keeping documentation current, managing corrective actions, and running the internal audits and management reviews that certification bodies expect to see evidence of.
We’ve built this list from what actually trips up organisations during recertification, drawing on our own experience supporting clients through ISO 27001 implementation and ongoing compliance. Whether you’re six months post-certification or approaching your three-year recertification, these practical best practices will help you avoid nonconformities and keep your certification, and your security posture, genuinely fit for purpose.
1. Work with ISO 27001 specialists for ongoing support
Many organisations treat ISO 27001 as a project with a start and end date, when it’s really an operating rhythm that needs continuous attention. Ongoing specialist support means retaining access to people who understand the standard’s clauses, know how your certification body interprets them, and can spot gaps before an auditor does. This isn’t about outsourcing your entire security function. It’s about having someone in your corner who has sat through dozens of surveillance audits and knows exactly what evidence assessors want to see.
Small and mid-sized businesses rarely have a full-time ISO 27001 lead on staff, and that’s fine. What causes problems is having nobody accountable at all. Documentation drifts, risk registers go stale, and by the time the surveillance audit notice lands, three years of small decisions have accumulated into a pile of nonconformities nobody can explain.
What it involves
Working with specialists covers a mix of scheduled and reactive support. Typically, this includes quarterly or biannual check-ins to review your Information Security Management System (ISMS), on-call guidance when a new supplier contract or system change raises a compliance question, and hands-on help preparing for surveillance and recertification audits. Some organisations bring in a named consultant for a set number of days each year; others prefer a retainer arrangement that scales support up around audit windows.
At TrustedIA, we structure this as ongoing professional services built around our clients’ certification cycle. That means we’re already familiar with your ISMS documentation, your risk treatment plan, and your previous audit findings when a surveillance visit approaches, rather than starting from scratch each time.
Why it matters for certification
Certification bodies don’t just check whether controls exist; they check whether your ISMS is actively managed. A specialist relationship gives you a second set of eyes that catches drift long before an external auditor does, and it means corrective actions get closed properly rather than left open across multiple audit cycles.
The organisations that keep their certification without drama are the ones who never stopped treating ISO 27001 as ongoing work.
Organisations without this support often discover problems reactively, usually during the audit itself, which is the most expensive and stressful time to find them. Specialists also bring visibility into how ISO/IEC 27001 guidance and interpretation evolves, something worth checking against the official standard resources from the International Organization for Standardization as your ISMS matures.
How to put it into practice
Putting this into practice doesn’t require a huge budget. It requires consistency and a clear scope of work.
- Define the cadence: agree fixed check-in points, ideally tied to your surveillance audit schedule, not just ad hoc calls when something breaks.
- Assign an internal owner: even with external support, someone in your business needs to be the point of contact who chases actions between visits.
- Share access early: give your specialist visibility into your risk register, Statement of Applicability, and previous audit reports so they can spot patterns rather than starting cold.
- Budget for the full cycle: cost in support across all three years, not just the recertification year, since surveillance audits in years one and two carry real weight too.
- Review the relationship annually: confirm the specialist’s scope still matches your business as it grows, adds systems, or changes suppliers.
Get this right and specialist support stops feeling like an expense and starts feeling like insurance against the audit findings that actually cost you time and reputation.
2. Schedule surveillance and recertification audits early
Certification bodies work on a fixed rhythm: annual surveillance audits in years one and two, then a full recertification audit in year three before your certificate expires. Yet plenty of organisations treat these dates as something to react to rather than plan around, booking the audit slot only weeks before it’s due and then scrambling to gather evidence. Scheduling early gives you breathing room to fix gaps before an assessor ever sees them, rather than trying to explain them away on the day.
What it involves
This practice means locking in your audit dates with your certification body as soon as your current cycle allows, typically 8 to 12 weeks ahead, and working backwards from that date to set internal milestones. It also means treating audit scheduling as a calendar item owned by a named person, not something that sits in an email thread until someone remembers it. Your audit calendar should map against internal audits, management reviews, and any planned system changes so nothing collides with the assessor’s visit.
Why it matters for certification
Leaving scheduling too late compresses your preparation window and increases the risk of walking into an audit with unresolved corrective actions from the last visit. Certification bodies also have limited assessor availability, particularly around common financial year-end periods, so late requests can push your audit past your certificate’s renewal deadline, which risks suspension.
A late-booked audit almost always means a rushed one, and rushed audits produce more nonconformities, not fewer.
Booking early also signals to your certification body that your ISMS is under active management, which sets a better tone before the assessor even arrives.
How to put it into practice
Build your audit scheduling into a repeatable checklist rather than relying on memory:
- Confirm your certificate expiry date and count back to identify your recertification window.
- Book surveillance and recertification slots with your certification body at least two to three months ahead.
- Set internal deadlines for evidence gathering, internal audit completion, and management review at least four weeks before the assessor’s visit.
- Flag scheduling conflicts with holidays, system migrations, or major projects as early as possible.
- Assign one owner to track all audit dates across the three-year cycle in a shared calendar.
Get the dates fixed early and everything else on this list becomes far easier to plan around.
3. Keep risk assessments and treatment plans current
Risk assessments sit at the heart of ISO 27001, yet they’re often the first thing to gather dust once certification is in hand. A risk register built during implementation reflects the business you had at that point, not the one you’re running now. New systems, new suppliers, remote working arrangements, and departing staff all change your risk exposure, and an assessor will expect your risk treatment plan to reflect those changes, not the snapshot from eighteen months ago.
What it involves
Keeping risk assessments current means reviewing your risk register on a set schedule, not just when something goes wrong. Most organisations we work with review it quarterly, with a fuller review ahead of each surveillance audit. This covers reassessing likelihood and impact scores against current threat intelligence, checking that new assets, systems, or third parties have been added, and confirming that your Statement of Applicability still matches the controls you’ve actually implemented.
Why it matters for certification
Assessors routinely ask to see evidence that risk assessments have been reviewed since the last audit, and a static register is one of the most common sources of nonconformities. Certification bodies want proof that risk treatment decisions are being reconsidered as circumstances change, not signed off once and filed away.
A risk register that hasn’t changed in a year isn’t evidence of stability, it’s evidence of neglect.
Outdated risk data also undermines the credibility of your whole ISMS, because every other control, from access management to incident response, is supposed to trace back to a documented risk decision.
How to put it into practice
Build risk review into your operating calendar rather than leaving it to memory:
- Set a fixed review cycle, quarterly at minimum, with an additional check before each surveillance audit.
- Assign risk owners for each entry so accountability doesn’t sit with one overstretched person.
- Log every change, including why a risk score moved and what evidence supports the new rating.
- Cross-check against the Statement of Applicability to confirm controls listed as implemented actually are.
- Involve department heads, since they’ll spot operational changes that IT or compliance staff might miss.
Treat the risk register as a living document and your surveillance audits stop being a scramble to justify old decisions.
4. Run regular internal audits
Internal audits are the mechanism ISO 27001 relies on to catch problems before an external assessor does, yet many organisations run them once a year as a box-ticking exercise rather than a genuine check on how the ISMS is working. Internal audits should test whether your documented controls actually match what happens day to day, not just confirm that a policy exists somewhere on a shared drive. Done properly, they’re one of the most reliable ways to keep your certification because they surface the gaps assessors would otherwise find first.
What it involves
Running internal audits properly means covering the full scope of your ISMS across a rolling programme, rather than auditing the same easy controls every year and avoiding the harder ones. Each audit should have a defined scope, a competent auditor who isn’t reviewing their own work, and a report that records findings, evidence, and agreed corrective actions with owners and deadlines. Most organisations we support run at least one full-scope internal audit annually, supplemented by smaller thematic reviews of higher-risk areas like access control or supplier management.
Why it matters for certification
Certification bodies expect to see a documented internal audit programme with evidence that findings led to real corrective action, not just a completed checklist filed away. Skipping internal audits, or running them superficially, is one of the fastest routes to a nonconformity, because it suggests the ISMS isn’t being tested at all between external visits.
An internal audit that finds nothing wrong usually means it wasn’t looking hard enough.
A well-run internal audit programme also gives you leverage in the actual surveillance audit, since you can point to your own findings and closed actions as proof the ISMS is genuinely self-correcting.
How to put it into practice
Build a programme you can defend to an assessor with confidence:
- Map a rolling audit schedule covering every clause and control area at least once across the certification cycle.
- Use independent auditors, internal or contracted, who aren’t reviewing processes they own.
- Record findings formally, with evidence references, not verbal feedback nobody wrote down.
- Track corrective actions to closure, with named owners and realistic deadlines.
- Feed results into management review, so leadership sees patterns, not isolated incidents.
Treat internal audits as your own early-warning system, and surveillance audits stop feeling like an ambush.
5. Hold consistent management reviews
Management review is where ISO 27001 stops being a compliance exercise and becomes an actual business decision-making process, yet it’s often the first meeting to get cancelled when leadership calendars fill up. A management review brings senior decision-makers face to face with the ISMS: its risks, its audit findings, its resource gaps, and its performance against objectives. Skip these, or reduce them to a rushed ten-minute agenda item, and you lose the one forum where certification maintenance gets proper attention from people who can actually authorise budget and change.
What it involves
Proper management review meetings happen on a fixed schedule, usually quarterly or at minimum twice yearly, with a consistent agenda covering internal audit results, corrective action status, risk register changes, security incidents, and resourcing needs. Attendees should include people with real authority to make decisions, not just whoever from the compliance team was free that afternoon. Minutes need to record what was discussed, what was decided, and who owns each follow-up action, because that written record is exactly what an assessor will ask to see.
Why it matters for certification
Certification bodies treat management review as direct evidence of leadership commitment, one of the clauses assessors check most closely because it demonstrates the ISMS has genuine ownership beyond the compliance team. Reviews held irregularly, or without decisions and actions attached, read as a rubber-stamp exercise rather than active governance.
A management review without decisions attached isn’t a review, it’s a status update nobody acted on.
Consistent reviews also feed every other practice on this list, since risk updates, audit findings, and control testing results all need a forum where leadership can respond with resources or direction.
How to put it into practice
Build management review into your governance calendar rather than treating it as optional:
- Fix the schedule for the year ahead, quarterly at minimum, and protect it against cancellation.
- Standardise the agenda to cover audit results, risk changes, incidents, resourcing, and objectives every time.
- Invite genuine decision-makers, not delegates who can’t authorise action.
- Record minutes properly, capturing decisions and owners, not just attendance.
- Close the loop, checking previous actions before adding new ones.
Get this rhythm right and every audit finding has somewhere proper to land.
6. Monitor and test your security controls
Documenting a control in your Statement of Applicability and actually knowing it works are two different things, and the gap between them is where most surveillance audit findings come from. Security control testing means proving, with evidence, that firewalls block what they should, backups restore cleanly, access reviews actually remove leavers’ accounts, and your incident response plan works under real conditions rather than just on paper. Assessors have seen too many ISMS documents describe controls that quietly stopped functioning months earlier.
What it involves
This practice covers a mix of automated monitoring and scheduled testing across your technical and organisational controls. Vulnerability assessments and penetration testing should run on a regular cycle, not just once before an audit, alongside continuous monitoring through tools like endpoint detection, dark web surveillance, and phishing simulation campaigns that test staff behaviour rather than just system configuration. Backup restoration tests, access reviews, and business continuity exercises all belong on the same calendar, each with a record of what was tested, what was found, and what got fixed.
Why it matters for certification
Certification bodies increasingly ask for test evidence, not just policy statements, particularly around clauses covering operational security and business continuity. A control that exists only in a document, with no test history behind it, is treated as unproven, and unproven controls generate nonconformities just as readily as missing ones. Bodies like the National Cyber Security Centre publish guidance reinforcing why regular testing, rather than one-off assessment, is now the baseline expectation for a functioning ISMS.
A control you haven’t tested recently is a control you’re guessing works.
Regular testing also gives you something internal audits and management reviews can actually discuss, since findings from a penetration test or a failed backup restore are concrete, actionable, and far more convincing to an assessor than a checkbox marked complete.
How to put it into practice
Build testing into a schedule you can show an assessor without hesitation:
- Run vulnerability scans on a fixed cycle, monthly or quarterly depending on your risk profile.
- Commission penetration tests at least annually, or after significant system changes.
- Test backups and recovery on a set schedule, recording restoration times and any failures.
- Run phishing simulations regularly to measure staff behaviour, not just technical defences.
- Log every test outcome, including remediation actions and closure dates.
Treat testing as routine maintenance, not a one-off event, and your evidence trail speaks for itself when the assessor asks.
7. Review vendor and third-party risk regularly
Your ISMS doesn’t stop at your own network boundary, and neither does an assessor’s interest. Third-party risk covers every supplier, cloud provider, and contractor with access to your systems or data, and it’s an area certification bodies scrutinise more each cycle because breaches increasingly start with a compromised supplier rather than a direct attack on the certified organisation itself. If your vendor list has grown since certification, and it almost always has, your risk assessment needs to grow with it.
What it involves
Reviewing vendor risk properly means maintaining a current list of every third party with access to sensitive data or critical systems, then assessing each one against a consistent set of criteria: what data they hold, what access they have, and what their own security posture looks like. This includes chasing up-to-date certifications or audit reports from key suppliers, reviewing contracts for security clauses and breach notification terms, and reassessing risk whenever a supplier relationship changes scope. Cloud providers, payroll processors, and IT support firms all belong on this list, not just the obvious security vendors.
Why it matters for certification
Assessors expect to see a documented supplier risk assessment process, evidence that it’s been applied consistently, and proof that high-risk vendors get closer scrutiny than low-risk ones. A vendor list that hasn’t been touched since implementation is a common nonconformity, because it suggests third-party risk isn’t actually being managed, just recorded once and forgotten.
Your certification is only as strong as the weakest supplier you never checked.
Regulators and standards bodies increasingly frame supply chain risk as a core expectation rather than an afterthought, a point reinforced in guidance from the National Cyber Security Centre on supply chain security.
How to put it into practice
Build vendor review into a schedule rather than a one-off exercise:
- Maintain a master vendor list covering every third party with system or data access.
- Classify vendors by risk tier, based on data sensitivity and access level.
- Request evidence annually from high-risk vendors, including certifications or audit summaries.
- Review contracts for security and breach notification clauses at renewal.
- Reassess immediately whenever a vendor’s scope, ownership, or systems change.
Treat supplier oversight as an extension of your own ISMS, not a separate concern, and third-party risk stops being the gap an assessor finds first.
8. Centralise documentation and train your staff
Scattered policies are one of the quietest ways a certification falls apart. Documentation sprawl happens gradually: a policy lives on someone’s laptop, a procedure gets updated in an email thread, and nobody can say with confidence which version is current. Staff training suffers the same fate, treated as a one-off induction task rather than something that keeps pace with new threats and new starters. Fixing both together is what actually keeps an ISMS usable day to day, not just presentable on audit day.
What it involves
Centralising documentation means putting every policy, procedure, risk record, and audit report into a single controlled system, with version history, approval trails, and clear ownership for each document. Staff awareness training runs alongside this, covering induction training for new joiners, refresher sessions for existing staff, and role-specific training for people handling sensitive data or privileged access. Both need a schedule, not a one-off push before the assessor arrives.
Why it matters for certification
Assessors check document control closely because outdated or conflicting versions suggest the ISMS isn’t managed properly, regardless of how good the underlying controls are. Untrained staff cause the same problem from a different angle: a phishing simulation with a poor pass rate, or a member of staff who can’t describe their role in an incident, tells an assessor the ISMS exists on paper more than in practice.
A policy nobody can find, or nobody understands, isn’t a control, it’s a liability waiting to be discovered.
Certification bodies increasingly treat training records as evidence in their own right, expecting to see attendance logs, completion rates, and follow-up for anyone who’s fallen behind.
How to put it into practice
Build a system that keeps documentation and training visibly current:
- Centralise all ISMS documents in one controlled repository with version control and named owners.
- Review policies annually, or sooner after a significant process or system change.
- Run induction training for every new starter before they get system access.
- Schedule refresher training at least annually, with role-specific sessions for higher-risk positions.
- Track completion rates, chasing gaps rather than letting them slide unnoticed.
Get documentation and training working together, and staff stop being your biggest audit risk and start being your strongest evidence of a genuinely functioning ISMS.
Making ISO 27001 compliance business as usual
None of these eight practices work in isolation. Specialist support, early audit scheduling, live risk registers, internal audits, management reviews, control testing, vendor oversight, and centralised documentation all reinforce each other, and together they turn certification maintenance into routine operational work rather than a periodic scramble. Organisations that keep their certificate without drama treat these as standing commitments, not annual fire drills.
Getting there doesn’t require a bigger team, just clearer ownership and a consistent rhythm built around your audit cycle. If you’re staring down a surveillance audit with gaps you can’t close alone, or you simply want the reassurance of specialists who’ve sat through the process dozens of times, that’s exactly where outside help earns its cost. Talk to TrustedIA about ongoing ISO 27001 support and keep your certification, and your security posture, genuinely fit for purpose year after year.
