%20(12)%20(1).avif)
Key takeaways:
- ISO 27001 surveillance audits are part of the three-year certification cycle and are used by certification bodies to verify that your ISMS continues to operate effectively after initial certification.
- They are usually narrower than the initial certification audit and commonly cost around 30-50% of the initial certification audit fee, depending on the certification body, organization size, scope, and complexity.
- Auditors commonly review management review, internal audit, corrective actions, risk updates, and evidence that recurring controls are operating as described.
- Serious or unresolved nonconformities can put certification at risk and may ultimately lead to suspension or withdrawal, depending on the certification body's process and the severity of the issue.
- The easiest surveillance audits are the ones prepared for all year. Continuous evidence, current risks, completed internal audits, and documented management review reduce the last-minute scramble.
The work does not stop after you get your ISO 27001 certification.
Most companies think ISO 27001 is a one-time project. That you build the ISMS, pass Stage 1 and Stage 2 audits, hang the certificate on the wall, and you’re done for three years.
That’s not how it works.
Your certificate is valid for three years, but you don’t get to coast for the next 35 months. You have surveillance audits in Years 2 and 3: annual check-ins where auditors verify if your ISMS is still operational.
If you miss a surveillance audit, your certificate will be suspended. If you fail one, the certificate will be withdrawn.
This post explains what surveillance audits are, when they happen, what auditors check, how much they cost, and how to stay audit-ready without burning out your team.
If you are still in Stage 1 or 2, check this post first.
What Is a Surveillance Audit?
A surveillance audit is a periodic audit performed by your certification body after initial ISO 27001 certification. Its purpose is to confirm that the ISMS remains implemented, maintained, and effective throughout the certification cycle.
Surveillance is not a repeat of the full initial certification audit. The auditor samples selected parts of the ISMS, follows up on previous findings, and checks mandatory management-system activities such as internal audit and management review.
When Do ISO 27001 Surveillance Audits Happen?
The exact schedule is agreed with your certification body, but the cycle is easier to understand when you anchor it to the certification decision rather than calendar-year labels.
Surveillance Audit vs. Initial Certification Audit
The initial certification process provides a broader assessment of the ISMS and the applicable controls defined in your Statement of Applicability. Surveillance audits are narrower: the auditor samples selected areas of the system across the certification cycle while still checking whether the management system remains effective.
That makes surveillance audits shorter in many cases, but not less important. A narrow scope does not mean low scrutiny: the auditor is looking for evidence that the ISMS continued to operate between external audits.
How Much Does an ISO 27001 Surveillance Audit Cost?
The Surveillance Audit costs around 30-50% of what you paid for initial certification.
It is important to remember you’ll have to do this twice, in Years 2 and 3, so budget accordingly.
If you want a full breakdown on how much ISO 27001 costs each year, check this post.
What Do Auditors Check During ISO 27001 Surveillance Audits?
The exact sample changes from audit to audit, but several areas consistently matter because they show whether the ISMS is being maintained rather than only documented.
ISO 27001 Surveillance Audit Checklist
- Confirm that previous audit findings and corrective actions have been addressed and evidence is available.
- Check that the risk register and risk treatment plan reflect material changes in products, vendors, systems, personnel, and business context.
- Confirm that the internal audit programme has been completed as planned and that findings were tracked to closure.
- Make sure management review has occurred according to your ISMS schedule and that decisions and follow-up actions are documented.
- Verify that recurring controls such as access reviews, awareness training, vulnerability management, backups, and incident processes have evidence.
- Review policies and procedures for gaps between what the document says and what teams actually do.
- Prepare evidence of significant security events, incidents, changes, and remediation since the previous audit.
- Check the Statement of Applicability and ISMS scope if the business, products, locations, or risk environment have changed.
Common Surveillance Audit Findings and How to Avoid Them
The most common problems are usually not exotic technical failures. They are signs that the ISMS stopped being maintained between audits.
Management review is late or poorly evidenced: Schedule it according to the cadence defined in your ISMS and document inputs, decisions, actions, and owners. Many startups use at least an annual cadence, but the standard itself requires review at planned intervals.
Internal audit is incomplete or poorly documented: Maintain an audit programme, preserve objective evidence, track findings, and make sure auditor objectivity and impartiality are protected.
Risk information is stale: Review risks whenever significant changes occur and use a recurring review cadence appropriate to the business. SecureLeap commonly recommends scheduled reviews during the year rather than waiting for surveillance.
Controls do not match policy: If a policy says access is reviewed quarterly, the evidence should support that. Otherwise, either perform the control as stated or update the policy through the proper governance process.
Incident and resilience processes were never tested: Run practical exercises and tests at a cadence that matches your risk profile, document outcomes, and turn lessons learned into corrective actions.
How to Stay Surveillance-Ready Year-Round
The simplest way to prepare for surveillance is to stop treating ISO 27001 as an annual audit project. The cadence below is a practical operating model for many startups: adapt it to your risks, policies, certification-body expectations, and actual control frequencies.
Monthly
- Update incident records when relevant.
- Track onboarding/security-awareness completion.
- Spot-check critical access and open remediation items.
Quarterly
- Review access where your policy requires it.
- Review asset and vendor changes.
- Review vulnerability and remediation status.
- Check whether major business changes require risk or scope updates.
At planned intervals / at least annually for many startups
- Complete the internal audit programme.
- Conduct management review.
- Review the risk assessment and treatment plan.
- Review policies and the Statement of Applicability.
- Test incident response and resilience procedures as appropriate.
Tools and Ownership: Staying Audit-Ready Between Audits
Compliance platforms such as Vanta, Drata, and Secureframe can reduce manual work by collecting recurring evidence and tracking control status. They do not replace ownership: someone still has to decide what matters, follow up on exceptions, keep risks current, coordinate audits, and make sure control owners do their part.
For some startups, that owner is internal. For example, a security lead, CTO, or experienced compliance owner with enough authority and capacity. For others, a vCISO can provide ongoing oversight when the company needs security leadership but not a full-time CISO.
Surveillance Audit vs. Recertification Audit
Surveillance Audits Test Whether Your ISMS Still Works in Practice
Certification shows that your ISMS met the requirements at the point of certification, while surveillance checks whether the system continued to operate after the audit team left.
If risks are current, internal audits happen as planned, management reviews produce decisions, findings are closed, and recurring controls leave evidence, surveillance should feel like verification of normal operations, not reconstruction work.
The important question is not whether every startup needs a vCISO. It is whether someone clearly owns the maintenance of the ISMS. If that ownership already exists internally, keep it there. If it does not, that is a separate leadership problem for you to solve.
How SecureLeap Can Help
If you’re approaching your first surveillance audit and aren’t sure what to expect, or if you’ve realised you’ve let things slide since certification, we can help.
At SecureLeap, our vCISO services help startups prepare for surveillance audits by:
- Helping you find gaps before auditors do
- Running your internal audit and management review
- Updating your risk assessment and closing previous findings
- Ensuring you pass the first time with zero major findings
Through our vCISO and ISO 27001 consulting programs, I’ve guided dozens of startups to certification and surveillance audits, with a 100% success rate.
If you want to stay compliant all year and be easily approved on surveillance audits, click here to book a free consultation call.
Frequently Asked Questions on ISO 27001 Surveillance Audits
What is a surveillance audit in ISO 27001?
A surveillance audit is a periodic audit by the certification body during the certification cycle. It verifies that the ISMS continues to operate effectively after initial certification.
When does the first ISO 27001 surveillance audit happen?
The first surveillance audit is typically scheduled within the first year after certification. The exact date and subsequent audit programme are set by the certification body.
How much does an ISO 27001 surveillance audit cost?
SecureLeap considers a benchmark of about 30-50% of the initial certification audit fee, although actual cost depends on certification-body rates, company size, scope, locations, and complexity.
What happens if there are nonconformities during surveillance?
The certification body will require corrective action according to the severity and its certification procedures. Serious or unresolved issues can lead to suspension or, ultimately, withdrawal of certification.
Can you skip a surveillance audit?
No. Surveillance is part of maintaining accredited certification during the certification cycle. Work with your certification body on the required audit programme and timing.
What documents and evidence are reviewed during a surveillance audit?
Common areas include management review, internal audit, corrective actions, risk information, recurring-control evidence, incident records, and evidence that the ISMS has been updated as the organization changes.
What is the difference between surveillance and recertification?
Surveillance audits are narrower periodic checks during the certification cycle. Recertification is a broader reassessment performed before the certificate expires to renew the certification cycle.
%20(60).png)
%20(35)%20(1).avif)
%20(22)%20(1).avif)