Surveillance Readiness Health Check Template (ISO/IEC 27001)

Surveillance Readiness Health Check: [Organization name]

Self-check run before each surveillance or recertification audit of an ISO/IEC 27001:2022 + Amd 1:2024 certified ISMS. It tests whether the ISMS is still conforming and operating since the last certification body (CB) audit: changes, closure of previous findings, currency of required documented information, internal audit (clause 9.2), management review (clause 9.3), measurement (clause 9.1), risk and controls, and the validity of the scope. It is an internal readiness tool, not an audit by the CB and not a substitute for the internal audit programme. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Purpose and when to run
2. Method and rating scale
3. Area A: changes since the last audit
4. Area B: previous findings
5. Area C: required documented information
6. Area D: internal audit and management review
7. Area E: measurement and objectives
8. Area F: risk, SoA and controls in operation
9. Area G: scope, certificate and claims
10. Results summary and action list
11. Size tiers
12. Records and evidence
13. References

1. Purpose and when to run

Between certification audits, an ISMS can drift: owners change, records lapse, new systems arrive outside the risk process. Surveillance audits are shorter than Stage 2, so the CB samples hard where it sees change and weak records. This health check finds those weak points first, while there is time to fix them through the normal ISMS processes.

Run it:

• about 12 weeks before each surveillance and recertification audit (full check);
• about 4 weeks before the audit (follow-up on items not Green);
• after a significant change, such as a reorganization, a new site or a major incident, even if no audit is near.

Participants: the ISMS manager (runs the check), owners of each area, the internal audit lead (to confirm the audit status without auditing their own work), and the top management sponsor (to approve actions). Allow half a day for a small ISMS and one to two days for a large one.

2. Method and rating scale

Each item has an ID (HC-area letter plus number), the question, the evidence to look at, the rating and the record reference. Ratings in the tables below are an Example for Quillmere Analytics Ltd, checked on 2028-02-21 before surveillance 1 on 2028-05-15 to 2028-05-16.

3. Area A: changes since the last audit

Planned changes to the ISMS under clause 6.3 should appear in isms/isms-change-plan (DOC-ISMS-025). Changes that the certification agreement requires you to report are listed in isms/certification-cycle-plan section 6.

4. Area B: previous findings

A corrective action that did not work is a repeat finding waiting to happen. Reopen it in isms/certification-findings-action-plan, repeat the root cause analysis, and be ready to explain it to the CB.

5. Area C: required documented information

Audit programme and results (9.2.2) and management review results (9.3.3) are checked in area D.

6. Area D: internal audit and management review

A quick way to test the minutes against clause 9.3.2: could a reader see what happened to the last review's actions, what has shifted inside and around the organisation (including what customers and other stakeholders now expect or are saying), how security has been performing according to findings, metrics, audits and objectives, where the risk picture and treatment work stand, and what could be done better? Check the minutes against the official list.

7. Area E: measurement and objectives

8. Area F: risk, SoA and controls in operation

Use isms/control-evidence-matrix (DOC-ISMS-033) to choose the records and isms/isms-internal-audit-checklist for deeper testing questions.

9. Area G: scope, certificate and claims

10. Results summary and action list

Example summary, Quillmere Analytics Ltd, 2028-02-21:

Overall readiness rule: ready when no item is Red and every Amber has an action due before the audit. On 2028-02-21 the Example organization is not yet ready (2 Red).

Red items are nonconformities found internally: record them under clause 10.2 in compliance/capa-nonconformity and the audit findings register. Fixing them before the CB arrives, with records, is the ISMS working as intended; do not hide them from the CB if asked about internal findings.

11. Size tiers

12. Records and evidence

Map the health check in isms/control-evidence-matrix (DOC-ISMS-033) as evidence for clause 9.1 (monitoring the ISMS) and clause 10.1 (continual improvement). Trends across checks belong in the performance report (isms/isms-performance-report, DOC-ISMS-081).

13. References

Related templates: isms/certification-cycle-plan (DOC-ISMS-094), isms/certification-findings-action-plan (DOC-ISMS-093), isms/isms-internal-audit-checklist (DOC-ISMS-083), isms/isms-internal-audit-report (DOC-ISMS-084), compliance/management-review (DOC-ISMS-085), isms/isms-measurement-programme (DOC-ISMS-080), isms/certification-mark-usage (DOC-ISMS-097), isms/isms-annual-calendar (DOC-ISMS-032).

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clauses 4 to 10 and with the surveillance topics certification bodies review under ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024. The check items, rating scale, examples and guidance are original. No ISO or IEC text is reproduced, and the list of required documented information is a short paraphrase; read the official standard (purchase or licensed access from ISO, IEC or your national standards body) for the exact requirements. Check the current edition before use. A Green result in this check does not predict the certification body's findings or decision. This is a documentation format, not certification or legal advice. Template licence: MIT.