How Long Does ISO 27001
Certification Last?

An ISO 27001 certificate is valid for three years — but only if you keep earning it. Certification bodies run surveillance audits in years one and two, and a full recertification audit before the three-year mark. Miss or fail those, and the certificate can be suspended or withdrawn early. The three-year term is not a commercial choice by individual certification bodies: it is the standard cycle under the accreditation rules (ISO/IEC 17021-1) that govern how accredited CBs operate, which is why the pattern looks the same whichever accredited body issues your certificate. What varies is execution — when the audits land, how the sampling is planned, and how firmly deadlines are enforced. If you are still working toward the initial Stage 1 and Stage 2 audits, this page shows what the commitment looks like after the certificate arrives — because certification is less a finish line than a subscription your ISMS renews by staying in operation.

• Initial certification — a Stage 1 audit (documentation and readiness) followed by a Stage 2 audit (implementation and effectiveness). Pass both and the certification body issues a certificate with a three-year term.
• First surveillance audit — around the twelve-month mark. A lighter-touch visit confirming the ISMS is still operating, with a sample of clauses and controls plus a set of mandatory checks.
• Second surveillance audit — around the twenty-four-month mark. Same format, usually a different sample, so that most of the system gets touched at least once across the cycle.
• Recertification audit — in year three, scheduled so that the audit and the closure of any findings complete before the expiry date printed on the certificate.
• New certificate, new cycle — a successful recertification resets the three-year clock, and the pattern of two surveillance audits plus a recertification repeats for as long as you stay certified.

Worked example: a certificate issued on 15 March 2026 typically expires 14 March 2029. The first surveillance audit lands around March 2027, the second around March 2028, and the recertification audit should be booked for late 2028 — early enough that the audit, any corrective actions, and the certification decision all land before the March 2029 expiry. Surveillance audits are anchored to the certification date, so a delayed first audit does not push the expiry date back; it just compresses everything that follows.

One timing rule is worth knowing by name: under the accreditation requirements, the first surveillance audit must take place within twelve months of the certification decision — it is not a courtesy visit the certification body can wave through or postpone indefinitely. That is also why the certificate is issued by a decision, not by the audit itself: the auditor recommends, a separate reviewer inside the certification body decides, and the same decision step applies again at each recertification.

• Unresolved major nonconformities — a major finding raised at surveillance or recertification that is not corrected within the deadline the certification body sets.
• Refusing or repeatedly deferring surveillance audits — no surveillance, no certificate. Accreditation rules do not let a certification body keep a certificate alive without conducting the audits behind it.
• Misusing the certification mark — claiming certification for services, locations, or products outside the certified scope, or using the mark and certificate in misleading ways, and not correcting it when challenged.
• Major scope failures — the certified system stops operating in practice: key processes dismantled, the ISMS abandoned, or the organization no longer able to demonstrate the scope it certified.

Suspension is a formal state, not a warning letter: while suspended, the certification is temporarily invalid and you cannot present yourself as certified. The certification body sets a deadline to resolve the underlying issue. Fix it in time — usually evidenced through a follow-up or special audit — and the certificate is reinstated for the remainder of its cycle. Miss the deadline and the certificate is withdrawn, at which point there is no reinstatement path: the route back is a fresh initial certification, Stage 1 and Stage 2 included.

There is also a middle path: scope reduction. If one part of the certified scope persistently fails the requirements — a product line, a location, a service — the certification body can carve that part out of the certificate rather than suspend the whole thing. The certificate survives, but narrower. For anyone relying on the certificate, this is precisely why the scope statement deserves a careful read: a certificate can be entirely valid and still no longer cover the thing you buy.

A certificate is issued against a specific edition of the standard, and when a new edition is published, a coordinated transition window applies across accredited certification bodies. The recent example: certificates against ISO/IEC 27001:2013 had to migrate to the 2022 edition by 31 October 2025. That deadline has passed — every valid accredited certificate today is against ISO/IEC 27001:2022, and a certificate still citing 2013 has lapsed no matter what its printed expiry date says.

In practice, transitions are folded into the cycle rather than bolted on: most organizations migrate at a scheduled surveillance or recertification audit inside the window, with the auditor adding time to verify the new and changed requirements. The lesson for the next edition is the same as for this one — transition early in the window, when auditor capacity is plentiful, rather than in the final months when everyone else is booking the same audits.