Maintaining ISO 27001 after certification
You have your ISO 27001 certificate. But that is really only the start. The certificate is valid for 3 years, with annual surveillance audits in which an accredited body checks whether your ISMS still works. Clause 10 of the NEN version of the standard sets out the requirement for continual improvement. Without active maintenance, you risk losing your certificate.
Most organisations spend 10 to 20% of the time they put into the initial implementation on annual maintenance after certification. That is considerably less, but it is not zero.
The 3-year ISO 27001 certification cycle
| Year | Type of audit | What is assessed | Cost (indication) |
|---|---|---|---|
| 1 | Certification audit (stages 1 and 2) | Complete ISMS | €8k-€25k |
| 2 | Surveillance audit | Selection of ISMS components | €4k-€12k |
| 3 | Surveillance audit | A different selection of components | €4k-€12k |
| 4 | Recertification audit | Complete ISMS again | €6k-€20k |
Over 3 years the auditor must have seen all parts of your ISMS. At each surveillance the auditor chooses a different selection. More on costs: costs and timeline.
What must you do every year for ISO 27001?
Mandatory activities
| Activity | Frequency | Estimated time |
|---|---|---|
| Internal audit | At least once a year | 3-10 days (depending on scope) |
| Management review | At least once a year | 1 day of preparation plus meeting |
| Update the risk assessment | Yearly, and after major changes | 2-5 days |
| Review the Statement of Applicability (SoA) | Yearly | 1-2 days |
| Review policies and procedures | Yearly | 2-5 days |
| Record and follow up incidents | Ongoing | 1-4 hours per incident |
| Staff awareness training | Yearly | 1-2 days for the organisation |
| Supplier assessment | Yearly | 1-3 days |
Internal audit
The internal audit is your own check before the external auditor arrives. You check whether procedures are followed, whether measures work, and whether the ISMS is up to date.
Who carries it out?
- A trained internal auditor (who may not audit their own work)
- Or an external party that carries out your internal audit
What do you check?
- Are the 93 Annex A controls you selected being followed?
- Are procedures up to date and followed?
- Are risk assessments up to date?
- Are incidents reported and handled?
- Is there evidence of continual improvement?
Management review
The board reviews the status of the ISMS at least once a year. Standing agenda items:
- Status of actions from the previous review
- Changes in threats and risks
- Results of internal audits
- Incidents and how they were handled
- Performance of the ISMS (KPIs)
- Opportunities for improvement
- Are the policy and objectives still current?
Output: Decisions and actions, recorded in the minutes. The auditor always asks for these minutes.
Keeping your ISO 27001 ISMS up to date as things change
Your ISMS must keep pace with your organisation. When these changes happen, you must update your ISMS:
| Change | Impact on the ISMS |
|---|---|
| New cloud supplier or SaaS tool | Update the risk assessment, apply the supplier policy |
| Takeover or merger | Review the scope, bring new systems and data into scope |
| Working from home / hybrid working | Policy for remote access, physical security of home workplaces |
| New legislation (for example NIS2) | Update compliance requirements, adjust measures |
| Major security incident | Root cause analysis, adjust measures, communication |
| New service or product | Risk assessment, privacy impact assessment if needed |
| Staff changes (CISO leaves) | Update roles and responsibilities, safeguard knowledge |
The most common reason for problems at surveillance audits: the ISMS has not kept up with the organisation. You have new systems, new people and new processes, but the ISMS still describes the situation from two years ago.
Common mistakes after ISO 27001 certification
Putting the ISMS in a drawer
After the intensive certification period, it is tempting to relax. But if you do nothing for 11 months and then have to catch up on everything in month 12 for the surveillance audit, it becomes stressful and superficial.
Solution: Schedule fixed moments (monthly or quarterly) for ISMS maintenance. Agree this with the team and put it in the diary.
Treating the internal audit as a formality
An internal audit that consists of “everything is in order, no findings” is a red flag for the auditor. A well-functioning ISMS always finds points for improvement.
Solution: Take the internal audit seriously. Have it carried out by someone who is willing to look critically. External help is an option.
Forgetting awareness training
During implementation you train everyone. But new employees do not get training, and existing employees forget after a year.
Solution: Build security awareness into the onboarding process. Plan a yearly refresher course or a phishing simulation.
Not recording incidents
Small incidents (an email sent to the wrong person, a lost USB stick) are not recorded because they seem “not serious enough”. But the auditor expects an incident log with trend analysis.
Solution: Make reporting easy. Record every incident, however small. Analyse trends every quarter.
Not updating the risk assessment
The risk assessment from year 1 still describes an on-premise server environment, even though you have since moved fully to the cloud.
Solution: Review the risk assessment at least once a year and after every significant change.
What does ISO 27001 maintenance cost per year?
| Cost item | Small (10-50 FTE) | Medium-sized (50-250 FTE) | Large (250+ FTE) |
|---|---|---|---|
| Internal time (yearly) | 80-150 hours | 150-300 hours | 300-600 hours |
| External audit (surveillance) | €4k-€8k | €6k-€12k | €10k-€20k |
| External support | €2k-€5k | €5k-€15k | €10k-€30k |
| Tools and software | €1k-€5k | €3k-€10k | €5k-€20k |
| Total per year | €8k-€20k | €15k-€40k | €30k-€80k |
FTE stands for full-time equivalent, the number of full-time staff in your organisation. More on costs: costs and timeline.
More information
- The audit process: what to expect at surveillance and recertification
- Internal audit: how do you plan and carry out the yearly internal audit?
- The ISMS explained: the system you maintain
- Risk assessment: how to keep risks up to date
- Annex A controls: the 93 controls
- Costs and timeline: full cost estimate
- Requirements of ISO 27001: all requirements per clause