How is ISO 27001 maintained and renewed (recertification)?

ISO 27001 certification is not a one-time achievement. A certificate is valid for three years, but it remains valid only if the organization keeps its Information Security Management System (ISMS) operating effectively and passes scheduled audits throughout that cycle. Maintenance and renewal happen on a fixed three-year rhythm.

The three-year certification cycle

Ongoing maintenance activities (continuous, not just at audit time)

To stay certified between audits, an organization must demonstrate that the ISMS lives in day-to-day operations. Core recurring activities include:

• Internal audits, at least annually, covering the full ISMS over the cycle.
• Management reviews, where leadership formally reviews ISMS performance, objectives, and resources.
• Risk assessment and treatment, where risks are reassessed when assets, threats, or the business change. The Statement of Applicability (SoA) is kept current.
• Continual improvement, where nonconformities are logged, corrective actions tracked to closure, and lessons fed back in.
• Monitoring and measurement, where controls (e.g., access reviews, incident handling, security awareness training) are evidenced on an ongoing basis.
• Documentation upkeep, so policies, records, and evidence stay version-controlled and audit-ready.

Note on the current standard: the active version is ISO/IEC 27001:2022. Organizations certified under the older 2013 version were required to transition by 31 October 2025, so new and renewing certifications now follow the 2022 control set (93 Annex A controls).

How Kertos supports maintenance and recertification

Kertos treats compliance as a continuous outcome rather than a one-off project, which maps directly to the ISO 27001 maintenance cycle. Kertos combines an agentic compliance platform (KAIA) with accredited in-house experts who work alongside your team:

• Always-audit-ready evidence: the platform continuously collects and maps control evidence, so surveillance and recertification audits don't trigger a last-minute scramble.
• Automated risk and SoA management: risk assessments, treatment plans, and the Statement of Applicability stay live and updated as your environment changes.
• Scheduled internal audits and management reviews: Kertos structures and tracks the recurring tasks the standard requires, with reminders and ownership built in.
• Expert-led audit support: Kertos experts (including external CISO mandates) prepare you for surveillance and recertification audits and sit alongside you through them.

This model reflects Kertos's track record: a 100% audit pass rate, roughly 80% less manual compliance effort, and customers like AskUI reaching ISO 27001 certification in 2.5 months, then staying certified through the maintenance cycle without rebuilding their evidence base each year.