Maintaining ISO 27001 After Certification: The 12-Month Operating Cycle

Why Maintenance Is Where Most ISMS Programs Fail

Getting certified is the easy part. Staying certified is where most ISMS programs quietly decay. Certification bodies run a surveillance audit every year and a full recertification audit every three years. They are specifically looking for whether the system you described in year one is still running in year two.

The pattern is predictable: the implementation team disbands after certification, the risk register stops being updated, internal audits get skipped, and the next surveillance audit surfaces five or six minor nonconformities at once. Fixing those under audit pressure is far more expensive than running the cycle properly.

The 12-Month Operating Cycle

ISO 27001 expects a continuous PDCA (Plan-Do-Check-Act) loop. In practice, that translates into a 12-month calendar with a handful of fixed events:

If you only remember one thing: the annual block (risk reassessment + internal audit + management review) must happen before each surveillance audit, with documented outputs. That trio is the first thing every auditor opens.

What Surveillance Auditors Actually Check

Year 2 and Year 3 surveillance audits are lighter than the original certification audit, but they zero in on the same evidence each time:

1. Risk register: updated within the last 12 months, with treatment decisions and owners.
2. Statement of Applicability: matches current controls, justifications still valid.
3. Internal audit report: covered the ISMS, identified findings, has corrective action progress.
4. Management review minutes: shows leadership reviewed performance, risks, incidents, and resourcing.
5. Incident log: incidents logged, classified, post-mortems for the significant ones.
6. Corrective actions: open items from the last audit closed with evidence.
7. Training records: awareness training completed by current staff (not just last year's hires).
8. Access reviews: documented evidence of user access being reviewed and pruned.
9. Supplier evaluations: critical suppliers reassessed.
10. Document control: policies reviewed and reapproved within the last year.

Miss any of these and you get a finding. Miss two or three and you get a major nonconformity, which suspends your certificate until cleared.

The 90-Day Pre-Surveillance Checklist

The cleanest way to pass surveillance is to start preparing 90 days out:

• T-90 days: full internal audit covering all in-scope controls.
• T-75 days: open corrective actions for every internal-audit finding.
• T-60 days: refresh the risk assessment, update the risk register, regenerate the SoA where controls changed.
• T-45 days: management review meeting. Document inputs (audit results, risks, incidents, KPIs) and outputs (decisions, resource allocations).
• T-30 days: close out corrective actions, refresh training records, run access reviews.
• T-7 days: rehearse the audit. Walk the lead implementer through the evidence folder structure so they can produce documents instantly.

Most surveillance failures trace back to skipping the T-90 internal audit and trying to compress everything into the last two weeks.

Where Tools Actually Help

The maintenance workload is where spreadsheets break down. A few specific tools cut the time dramatically:

• A risk register that supports continuous updates rather than annual rewrites. The Risk Copilot is built around the monthly review cadence and tracks overdue and due-soon items automatically.
• An internal audit tool with the Annex A control set pre-loaded so the auditor doesn't rebuild the checklist each year. See the Internal Audit Checklist.
• A document control system that flags policies past their review date. Even a simple review-date column in a tracked register works.
• An incident log that captures severity, owner, root cause, and closure - not just a Slack channel scroll.

The goal is not more software. It is removing the per-cycle setup tax so the team can focus on actual review work.

The Three-Year Recertification Audit

Every three years the certification body re-runs a full audit instead of the lighter surveillance check. The scope is broader and the document review is deeper. Two things matter most:

1. Evidence of trend, not just snapshot: auditors want to see three years of risk register updates, three years of management review minutes, three years of incident logs. If the records jump from year one to recertification with nothing in between, that is itself a finding.
2. Defensible change management: scope changes, new products, new locations, acquisitions, and major tech migrations should all show up in the risk register and SoA with rationale.

Treat recertification as the cumulative test the surveillance audits hint at. If you ran the 12-month cycle properly each year, recertification is a paperwork exercise rather than a project.

Common Maintenance Mistakes

• The annual risk reassessment that just re-saves last year's file. Auditors check for actual changes - new threats, retired systems, new suppliers.
• Internal audit run by the same person who wrote the policy. Independence is required; either rotate auditors or use an external one.
• Management review treated as a calendar formality. It must have documented inputs and outputs, with leadership decisions visible.
• Closing corrective actions without evidence. A status of "done" with no artifact will be reopened during surveillance.
• Stale SoA. New SaaS tools, new offices, new product lines mean control applicability changes - update the SoA when they do, not at audit time.

Cost of Maintenance

For a typical SMB, ongoing ISO 27001 maintenance costs roughly:

• Internal time: 0.25 to 0.5 FTE spread across the year.
• Surveillance audit fee: $3,000 to $8,000 per year.
• Tooling: $0 to $5,000 per year depending on what's already in the stack.
• Recertification (every 3rd year): $8,000 to $20,000.

Skipping maintenance and rebuilding the system before each surveillance audit usually costs 3 to 5 times more in consultant fees plus the risk of a suspended certificate.

The Continuous-Improvement Habit

The standard's Clause 10.1 is short but it's the one most often missed: continual improvement. Auditors want to see that the ISMS gets better over time. Concretely:

• KPIs or metrics that track ISMS performance (incident rate, training completion, mean time to remediate findings).
• Trend data showing improvement or, where things got worse, a documented response.
• New controls or process changes driven by lessons learned.

An ISMS that looks identical year over year is a warning sign to auditors, even if every individual control is in place.

Putting It Together

The teams that maintain ISO 27001 cheaply share three habits:

1. A fixed annual calendar with the audit, risk reassessment, and management review locked in.
2. One person owns the ISMS day to day, even if they have other responsibilities.
3. Tools chosen for ongoing operation, not for the first certification push.

If you want to operationalize this:

• Use the Risk Copilot for the monthly risk and review cadence.
• Use the Internal Audit Checklist for the T-90 audit.
• Use the Document Pack for annual policy refreshes that don't require rewriting from scratch.

Certification gets you the badge. The 12-month cycle keeps it.