You have done the heavy lifting. The auditor has left, the report is clean, and the certificate lands in your inbox. Now the emails quieten down and project teams disband. This is the point most organisations wobble. Certification is the starting line, not the finish tape.
If you are still getting to grips with ISO 27001 certification, this article picks up from day one after the first audit and focuses on the habits that keep you certified without turning your life into never-ending audit prep.
What happens after certification
Once certified, your certification body sets a surveillance programme. Typically two surveillance audits over the next two years, then a recertification in year three. The scope remains the same unless you change it. What varies is how well you keep the system alive between visits.
In practice, surveillance is lighter than the initial audit, but it is unforgiving on drift. As an auditor, I regularly see good systems weaken because routine controls stop happening, or because nothing is written down when roles change. The fix is dull and effective: make the ISMS part of the calendar and the job descriptions.
Put the ISMS on the calendar
- Set dates for risk reviews, management reviews, internal audits, access recertifications and supplier checks for the next 12 months.
- Align ISMS activities with business rhythms, such as quarterly board meetings and product release cycles.
- Nominate deputies for key tasks so one person’s holiday or resignation does not stall critical controls.
One client in fintech did this well by putting a 30-minute ISMS stand-up in the monthly operations meeting, just to check what is due and what is slipping. It took discipline, not budget, and it kept surprises off the audit table.
Keep risk management alive
Clause 6 is not a one-off exercise. Risks change with new clients, new systems and new regulations. Your Statement of Applicability (SoA) is a living document, not a trophy. The best indicator of a healthy ISMS is that your risk register moves during the year for good reasons, not only when an audit looms.
Triggers that mean you should review risks
- Changes to technology stack, including new cloud services and decommissioning legacy systems.
- New products, features or processing of different categories of personal data.
- Supplier changes, contract renegotiations or service incidents with third parties.
- Organisational changes, such as mergers, restructures or key staff departures.
- Incidents, near misses, customer complaints or audit findings.
When these occur, update the risk entry, review the control set and, if needed, adjust the SoA. I often find the SoA gets dusty because teams are nervous about editing it. Do it. Record the rationale. Auditors prefer a SoA that evolves to match reality over a pristine one that no longer fits how you operate.
Make change management feed the ISMS
- Include an information security impact question in your change request process.
- Route significant changes to the ISMS owner for quick review and a decision on risk treatment.
- Capture accepted risks with an owner, expiry date and review frequency.
It is not about adding bureaucracy. It is about making sure the right eyes see the change in time, so controls keep pace with the business.
Internal audits that actually help
An internal audit is not a rehearsal for the surveillance visit; it is your early warning system. The most useful ones are short, focused and evidence-based. They test what is happening, not what the procedure says should happen. When we audit clients who treat internal audit as a genuine health check, surveillance tends to be a non-event.
Plan the cadence and scope
- Run at least one full cycle annually, sampling across the core clauses and key Annex A controls in your scope.
- Prioritise high-risk areas like access control, logging, backups and supplier management.
- Use different auditors or viewpoints to avoid blind spots and groupthink.
Look at evidence like an external auditor would
- Test a sample of user accounts and confirm evidence of timely access reviews.
- Pick a few suppliers and check their due diligence, contracts and performance monitoring.
- Trace a backup from policy to schedule to a successful restore test record.
- Follow an incident from detection to root cause analysis and verified corrective action.
Where you find gaps, raise nonconformities internally and treat them with the same seriousness you would expect from us. A clean internal audit that found nothing is usually a missed opportunity.
Controls that must keep breathing day to day
Most surveillance findings come from operational routines that quietly stop. It is rarely malice. People change roles, systems get replaced, and spreadsheets vanish in shared drives. The answer is to make critical controls visible and owned.
Five routines that prevent 80% of findings
- Access recertification: Review privileged and high-risk access at least quarterly and document the decisions.
- Asset registers: Keep an up-to-date list of information assets and owners, including SaaS and shadow IT discovered through finance or SSO logs.
- Backup and restore: Test restores to a defined schedule and record outcomes and lessons, not just success or failure.
- Vulnerability management: Track scan coverage, remediation times and exceptions, and align them to risk appetite.
- Supplier monitoring: Check critical suppliers against agreed KPIs and security assurances and record follow-up on shortfalls.
Two common scenarios I see. First, a new head of engineering arrives and consolidates tools, which breaks a scheduled control like a backup verification or a log review. Second, a managed service provider quietly changes their process and a promised report stops arriving. Neither is dramatic, but both show up quickly in surveillance if you do not have someone watching for them.
Make evidence easy to find
- Keep a simple evidence index that points to where records live for each clause and control.
- Use versioned folders or a wiki so staff can find the latest procedure without guesswork.
- Automate where sensible, such as access review reminders and ticketing for recurring tasks.
When evidence is easy to pull, audit stress drops and issues surface early, when they are cheap to fix.
Incidents, improvements and the three-year cycle
Incidents happen in good organisations. What matters is how you respond and what you learn. A minor incident handled well is better than a near miss that never gets recorded. Surveillance auditors look less at the size of the incident and more at the maturity of the response.
Handle incidents with traceable discipline
- Define what counts as an incident and make it easy for staff to report without blame.
- Record triage, containment, root cause and corrective action for every incident you log.
- Close the loop by verifying the fix and checking similar risks elsewhere.
Pair this with management review that is genuinely informative rather than ceremonial. A good review brings together risk, performance and change, and results in decisions you can track.
Make management reviews useful
- Cover risk trends, control performance, incidents, audit outcomes and resourcing.
- Document decisions with owners and due dates and revisit them next time.
- Tie objectives to improvements that matter, such as reducing access approval time or increasing restore test frequency.
As you approach recertification at the end of year three, do not panic-rebuild the ISMS. If you have kept the habits, recertification is a larger but familiar audit. If not, plan a recovery.
A simple timeline for surveillance and recertification prep
- Sixty days out, run a targeted internal audit on areas you know have changed or struggled.
- Thirty days out, tidy the evidence index and close easy corrective actions with real checks.
- Fourteen days out, brief process owners on scope and sampling and confirm availability of records.
This is not about theatre. It is about respecting your own system so that surveillance is a confirmation of what you already know, not a discovery exercise.
None of this requires a vast programme. It requires clarity on who owns what, a steady cadence, and the courage to write down what really happens and fix what does not. That is what maintains certification and, more importantly, keeps information risk at a level the business can live with.
If you would like a pragmatic conversation about maintaining or strengthening your ISMS, our team at UKCTL is here to help. Drop us a line and we will talk through where you are now and what will make the next audit straightforward.