Certification Cycle Plan Template (ISO/IEC 27001 3-year cycle)

Certification Cycle Plan: [Organization name]

Plan for the three-year ISO/IEC 27001:2022 + Amd 1:2024 certification cycle: initial certification (Stage 1 and Stage 2), surveillance audits in the following years, and recertification before the certificate expires. It follows the audit programme rules that certification bodies (CBs) apply under ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024, and supports clauses 9.2 (internal audit), 9.3 (management review) and 10 (improvement) by putting the internal cycle and the external cycle on one timeline. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. The cycle at a glance and timing rules
3. Cycle timeline
4. What each audit covers
5. Preparing each audit
6. Changes to notify to the certification body
7. Keeping the certificate valid
8. Suspension, withdrawal, reduction and expiry
9. Recertification
10. Changing certification body
11. Budget and resources across the cycle
12. Size tiers
13. Records and evidence
14. References

1. Purpose and scope

This plan keeps the ISO/IEC 27001 certificate of [Organization name] valid for its three-year cycle and makes sure the ISMS is ready for each CB audit. It aligns the external audit dates with the internal ISMS activities that the CB will check: internal audits, management review, risk assessment updates, corrective actions and measurement.

The certificate is a commitment to customers and partners. In the Example, Quillmere Analytics Ltd has 12 customer contracts that require a valid ISO/IEC 27001 certificate, so a lapse would put those contracts in breach. List your own dependencies here:

2. The cycle at a glance and timing rules

Timing rules to plan around:

1. The certificate cycle is three years from the certification decision.
2. Surveillance audits take place at least once each calendar year, except in recertification years.
3. The first surveillance after initial certification takes place no later than 12 months from the certification decision date.
4. The recertification audit is planned and carried out in time for the CB to make its decision before the expiry date. Plan for the audit several months before expiry so that findings can be closed.
5. Audit time for each audit is set by the CB under ISO/IEC 27006-1:2024 from the number of persons doing work under the organization's control and complexity factors. Days in this plan are Example values.
6. Multi-site sampling, where it applies, follows ISO/IEC 27006-1:2024 and the multi-site requirements of the accreditation system (IAF MD 1:2023, now re-issued by Global ACI as Global ACI-TECH-3-001; check the current issue).

3. Cycle timeline

Example for Quillmere Analytics Ltd: internal audit IA-2027-01 from 2027-03-15 to 2027-03-17, management review on 2027-04-06, Stage 1 on 2027-04-12 and 2027-04-13 (1.5 audit days), Stage 2 from 2027-05-10 to 2027-05-12 (3.5 audit days), certification decision on 2027-06-15, certificate expiry on 2030-06-14.

Gantt bars show calendar days on site; the audit days that drive fees (section 11) can differ, for example 1.5 audit days spread over two calendar days, or 3.5 audit days over three calendar days when a second auditor joins for half a day.

4. What each audit covers

4.1 Items reviewed at every surveillance

CBs check a standing set of topics at each surveillance (ISO/IEC 17021-1:2015 sets these for all management system audits; this is a paraphrase, not the standard's text):

4.2 Coverage across the cycle

Example coverage plan for Quillmere Analytics Ltd. Each X means the area is planned for detailed audit; standing topics in 4.1 are covered every time.

Clause 6, 8, 9 and 10 appear in every audit because risk, operation, evaluation and improvement are where the CB sees whether the ISMS is alive. Over the cycle, every applicable control in the SoA should have been sampled at least once; ask the CB for its audit programme to confirm.

4.3 Audit-type comparison

5. Preparing each audit

For remote audit parts, agree in advance the tools, screen sharing rules, what may be recorded, and how confidential evidence is shown without handing over copies. IAF MD 4 (now re-issued by Global ACI as Global ACI-TECH-3-003) covers the use of information and communication technology in audits; check the current issue.

6. Changes to notify to the certification body

A scope extension or new site may need a special audit. Plan these in isms/scope-extension-multisite-plan (DOC-ISMS-095).

7. Keeping the certificate valid

8. Suspension, withdrawal, reduction and expiry

During suspension the certificate is temporarily invalid: stop all claims of certification and use of marks, and inform the customers whose contracts require it if the contracts say so. ISO/IEC 17021-1:2015 allows a CB to restore a certificate that expired because recertification was not finished in time: within six months of expiry, provided the outstanding recertification activities are completed; after that, at least a Stage 2 audit is needed. The certificate is not valid in the gap between expiry and the new decision; the CB sets the dates on the restored certificate, commonly an effective date on or after the recertification decision and an expiry date that follows the previous cycle (as explained in European co-operation for Accreditation guidance on the standard; confirm the period and conditions with your CB). Do not plan to rely on this.

9. Recertification

Before the recertification audit:

1. Review context, interested parties and scope (DOC-ISMS-003, DOC-ISMS-002): has the business changed enough to change the scope?
2. Refresh the risk assessment in full and update the SoA (DOC-ISMS-017, DOC-ISMS-011).
3. Complete a full-scope internal audit cycle covering all clauses and all applicable controls.
4. Hold a management review that looks at performance over the whole cycle: objectives trend, incidents, audit results, improvement.
5. Check that every nonconformity from the cycle is closed and its effectiveness reviewed.
6. Confirm with the CB the audit plan, duration (Example: 2.5 days) and any sites to visit.

The CB reviews the performance of the ISMS over the cycle, including previous surveillance reports, before it decides. Nonconformities found at recertification must be resolved in the time the CB sets and before expiry. If they cannot be, the certificate lapses at expiry.

10. Changing certification body

A valid, accredited certificate (issued under accreditation by a signatory of the Global ACI MRA, formerly the IAF MLA) can usually be transferred to another accredited CB without restarting the cycle. The receiving CB carries out a pre-transfer review of the current certificate, the last audit reports, open nonconformities, complaints and the reason for the change, under IAF MD 2 on transfer of accredited certification (now re-issued by Global ACI as Global ACI-TECH-3-002; check the current issue). Open major nonconformities usually block a transfer until closed. Plan transfers away from audit dates and keep copies of all reports from the previous CB. Use isms/certification-body-selection to choose the new CB.

11. Budget and resources across the cycle

Example CB fees for Quillmere Analytics Ltd at a day rate of USD 1,500 (an Example rate; ask your CB for its quote) and an annual certificate and administration fee of USD 600:

Add internal effort: the ISMS manager's time for preparation and response, interviewees' time on audit days, internal audit time, and travel for auditors if the CB charges it. Record the full plan in isms/isms-budget-resource-plan (DOC-ISMS-031).

12. Size tiers

13. Records and evidence

Map these records in isms/control-evidence-matrix (DOC-ISMS-033) under clauses 9.2, 9.3 and 10.2. They also feed the ISMS annual calendar (isms/isms-annual-calendar, DOC-ISMS-032).

14. References

Related templates: isms/certification-body-selection (DOC-ISMS-090), isms/stage-1-readiness-pack (DOC-ISMS-091), isms/stage-2-audit-evidence-index (DOC-ISMS-092), isms/certification-findings-action-plan (DOC-ISMS-093), isms/scope-extension-multisite-plan (DOC-ISMS-095), isms/surveillance-readiness-health-check (DOC-ISMS-096), isms/certification-mark-usage (DOC-ISMS-097), compliance/internal-audit-program (DOC-ISMS-082).

Standard and licence note

Structure aligned with the certification cycle described in ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024 for ISO/IEC 27001:2022 + Amd 1:2024 certification. The text, tables, timeline and examples are original. No ISO or IEC text is reproduced; read the official standards (purchase or licensed access from ISO, IEC or your national standards body) and your certification body's rules before relying on any period or rule stated here. Check the current edition of each standard and the current accreditation documents before use. Audit days and fees are Example values; audit time is set by the certification body, and certification decisions are made only by the accredited certification body. This is a documentation format, not certification or legal advice. Template licence: MIT.