An ISO 27001 certificate is valid only while the audits keep coming.

The certification guide shows the audit sequence. What matters for validity is timing. The first surveillance audit has to fall within twelve months of the certification decision. The recertification audit has to be completed, and its findings dealt with, before the expiry date, so the body can renew without a gap.

If renewal is missed, the scheme rules allow restoring the certificate only within a limited window after expiry, and only once the outstanding audit work is done. After that, you start again.

• Surveillance on schedule. Agree dates early. A postponed audit can push you past the allowed interval.
• Findings closed. Major nonconformities corrected and verified within the time the body sets.
• The ISMS operating. Internal audits, management reviews and risk updates continue each year.
• Changes reported. Significant changes to scope, ownership, sites or systems told to the body.
• Fees and contract current. The certification agreement with the body remains in force.

Extending scope

Adding products, sites or teams needs an audit of the new part. The certificate is reissued with the wider scope, often at a surveillance visit.

Reducing scope

Removing parts the ISMS no longer covers, or that failed to meet requirements, is done by the body and shown on the certificate.

Transferring bodies

Moving to another accredited body mid-cycle is possible. The new body reviews your certificate, the last audit reports and any open findings before taking over.

IAF guidance on transfers expects the receiving body to accept only a valid, accredited certificate. A suspended certificate, or one with unresolved major findings, cannot simply be moved to escape a problem.

The body decides how long a suspension may last before withdrawal, under its published rules. Ask yours.

Certification bodies are themselves assessed by accreditation bodies, such as the National Accreditation Board for Certification Bodies (NABCB) in India or UKAS in the United Kingdom. For ISO 27001, the body is assessed against ISO/IEC 17021-1 and the ISMS-specific requirements in ISO/IEC 27006-1. Accreditation bodies that are members of the International Accreditation Forum (IAF) recognise each other's work, which is why an accredited certificate travels across borders.

• Get the certificate itself. A copy of the certificate, not a badge or a sentence in a questionnaire.
• Standard and edition. It should name ISO/IEC 27001:2022. Certificates to the 2013 edition are no longer valid.
• Scope wording. Read it. Does it cover the product, site or service you are buying?
• Dates. Issue and expiry dates, and whether you are near the end of the cycle.
• Certification body. Name the body, then check it is accredited for ISO 27001 by an IAF member accreditation body.
• Accreditation mark. An accredited certificate usually carries the accreditation body's mark.
• Independent lookup. Confirm the certificate on the body's register or a public database, not only the PDF you were sent.
• SoA version. Ask which SoA version the certificate refers to, if it shows one, and whether you can see the SoA under NDA.

The IAF runs a public database of accredited certificates, and many certification bodies keep their own registers. Coverage is not complete, so if a certificate does not appear, ask the certification body directly before drawing a conclusion.

Sources: ISO/IEC 17021-1:2015 (certification cycle, surveillance, recertification, suspension and withdrawal); ISO/IEC 27006-1 (requirements for bodies certifying ISMSs); IAF MD 2 (transfer of accredited certification); IAF material on accreditation and the IAF certificate database. Standards described in our own words only.