# Certification Cycle Plan: [Organization name] > Plan for the three-year ISO/IEC 27001:2022 + Amd 1:2024 certification > cycle: initial certification (Stage 1 and Stage 2), surveillance audits > in the following years, and recertification before the certificate > expires. It follows the audit programme rules that certification bodies > (CBs) apply under ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024, and > supports clauses 9.2 (internal audit), 9.3 (management review) and 10 > (improvement) by putting the internal cycle and the external cycle on > one timeline. Replace every `[bracketed]` value and every row marked > *Example*. ## Document control | Field | Value | |---|---| | Document ID | DOC-ISMS-094 | | Version | [1.0] | | Status | [Draft / Approved / Superseded] | | Owner | [@isms-manager] | | Approvers/reviewers | [@ceo or top management sponsor], [@ciso], [@finance-lead] | | Last updated | YYYY-MM-DD | | Classification | [Internal] | | Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024; CB rules per ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024 | | Certification body | [CB name], accredited by [accreditation body] (signatory of the Global ACI MRA, formerly the IAF MLA), accreditation number [n] | | Certificate number | [n] | | Certification decision date | YYYY-MM-DD | | Certificate expiry date | YYYY-MM-DD | | Certified scope (as printed) | [scope wording], DOC-ISMS-002 [version] | | SoA version on certificate | DOC-ISMS-011 [version] | | Sites on certificate | [list or "single site plus remote workers"] | | Next scheduled review | [After each CB audit and at least once a year] | ### Approvals | Role | Name | Decision | Date | |---|---|---|---| | ISMS manager | [@isms-manager] | [Prepared] | YYYY-MM-DD | | Finance | [@finance-lead] | [Budget confirmed for the cycle] | YYYY-MM-DD | | Top management | [@ceo] | [Approved] | YYYY-MM-DD | ### Revision history | Version | Date | Author | Change | |---|---|---|---| | 1.0 *(Example)* | 2027-06-20 | [@isms-manager] | First plan after the initial certification decision on 2027-06-15 | | 1.1 *(Example)* | 2028-06-01 | [@isms-manager] | Surveillance 1 result added; surveillance 2 dates confirmed by the CB | | [x.y] | YYYY-MM-DD | [@author] | [Change] | ## Contents 1. Purpose and scope 2. The cycle at a glance and timing rules 3. Cycle timeline 4. What each audit covers 5. Preparing each audit 6. Changes to notify to the certification body 7. Keeping the certificate valid 8. Suspension, withdrawal, reduction and expiry 9. Recertification 10. Changing certification body 11. Budget and resources across the cycle 12. Size tiers 13. Records and evidence 14. References ## 1. Purpose and scope This plan keeps the ISO/IEC 27001 certificate of [Organization name] valid for its three-year cycle and makes sure the ISMS is ready for each CB audit. It aligns the external audit dates with the internal ISMS activities that the CB will check: internal audits, management review, risk assessment updates, corrective actions and measurement. The certificate is a commitment to customers and partners. In the *Example*, Quillmere Analytics Ltd has 12 customer contracts that require a valid ISO/IEC 27001 certificate, so a lapse would put those contracts in breach. List your own dependencies here: | Dependency | What it requires | Contact | Impact if the certificate lapses | |---|---|---|---| | Customer contracts *(Example)* | Valid certificate covering the SaaS platform | Account management | Contract breach notice, renewal at risk | | Public tenders *(Example)* | Certificate number and scope in bids | Sales operations | Bids rejected | | Cyber insurance *(Example)* | Declared certification status | Finance | Premium review | | [dependency] | [requirement] | [@contact] | [impact] | ## 2. The cycle at a glance and timing rules | Phase | Purpose | When | |---|---|---| | Stage 1 | CB reviews ISMS documentation, scope, readiness and plans Stage 2 | Before Stage 2; the gap is agreed with the CB | | Stage 2 | CB evaluates implementation and effectiveness of the ISMS | After Stage 1 concerns are resolved | | Certification decision | CB decides after reviewing the audit report and accepted responses to findings | After all nonconformity responses are accepted and majors verified | | Surveillance 1 | Confirms the ISMS still conforms and operates effectively | No later than 12 months after the certification decision date | | Surveillance 2 | Same purpose, covering further parts of the ISMS | In the next calendar year | | Recertification | Confirms continued conformity and effectiveness over the whole cycle | Planned and completed, with the decision made, before the certificate expires | Timing rules to plan around: 1. The certificate cycle is three years from the certification decision. 2. Surveillance audits take place at least once each calendar year, except in recertification years. 3. The first surveillance after initial certification takes place no later than 12 months from the certification decision date. 4. The recertification audit is planned and carried out in time for the CB to make its decision before the expiry date. Plan for the audit several months before expiry so that findings can be closed. 5. Audit time for each audit is set by the CB under ISO/IEC 27006-1:2024 from the number of persons doing work under the organization's control and complexity factors. Days in this plan are *Example* values. 6. Multi-site sampling, where it applies, follows ISO/IEC 27006-1:2024 and the multi-site requirements of the accreditation system (IAF MD 1:2023, now re-issued by Global ACI as Global ACI-TECH-3-001; check the current issue). ## 3. Cycle timeline *Example* for Quillmere Analytics Ltd: internal audit IA-2027-01 from 2027-03-15 to 2027-03-17, management review on 2027-04-06, Stage 1 on 2027-04-12 and 2027-04-13 (1.5 audit days), Stage 2 from 2027-05-10 to 2027-05-12 (3.5 audit days), certification decision on 2027-06-15, certificate expiry on 2030-06-14. ```mermaid gantt title Certification cycle, Quillmere Analytics Ltd (Example) dateFormat YYYY-MM-DD section Initial certification Internal audit IA-2027-01 :ia0, 2027-03-15, 3d Management review :mr0, 2027-04-06, 1d Stage 1 audit :s1a, 2027-04-12, 2d Stage 2 audit :s2a, 2027-05-10, 3d Findings response :fr0, 2027-05-13, 30d Certification decision :milestone, cd0, 2027-06-15, 0d section Year 1 Internal audit cycle 1 :ia1, 2028-02-01, 20d Management review :mr1, 2028-03-20, 1d Surveillance 1 audit :sv1, 2028-05-15, 2d section Year 2 Internal audit cycle 2 :ia2, 2029-02-01, 20d Management review :mr2, 2029-03-19, 1d Surveillance 2 audit :sv2, 2029-05-14, 2d section Recertification Internal audit full scope :ia3, 2029-11-05, 20d Management review :mr3, 2030-01-21, 1d Recertification audit :rc, 2030-03-11, 3d Recertification decision target :milestone, rcd, 2030-04-30, 0d Certificate expiry :milestone, exp, 2030-06-14, 0d ``` | Event | Planned date *(Example)* | Rule check | |---|---|---| | Internal audit IA-2027-01 | 2027-03-15 to 2027-03-17 | Before the management review and Stage 1 | | Management review | 2027-04-06 | After the internal audit report (2027-03-29), before Stage 1 | | Stage 1 | 2027-04-12 to 2027-04-13 | 1.5 audit days | | Stage 2 | 2027-05-10 to 2027-05-12 | 3.5 audit days; findings CBF-2027-01 and CBF-2027-02 among those raised | | Certification decision | 2027-06-15 | Start of cycle | | Surveillance 1 | 2028-05-15 to 2028-05-16 | Before 2028-06-15 (12 months from decision): meets rule 3 | | Surveillance 2 | 2029-05-14 to 2029-05-15 | Calendar year 2029: meets rule 2 | | Recertification audit | 2030-03-11 to 2030-03-13 | About 3 months before expiry, time to close findings | | Recertification decision target | 2030-04-30 | Before expiry on 2030-06-14: meets rule 4 | | New certificate expiry | [as set by the CB, often 2033-06-14 when recertification is completed on time] | Confirm with the CB | Gantt bars show calendar days on site; the audit days that drive fees (section 11) can differ, for example 1.5 audit days spread over two calendar days, or 3.5 audit days over three calendar days when a second auditor joins for half a day. ## 4. What each audit covers ### 4.1 Items reviewed at every surveillance CBs check a standing set of topics at each surveillance (ISO/IEC 17021-1:2015 sets these for all management system audits; this is a paraphrase, not the standard's text): | Standing topic | What to have ready | Template | |---|---|---| | Internal audit and management review since the last audit | Audit reports, management review minutes and decisions | `isms/isms-internal-audit-report`, `compliance/management-review` | | Actions on findings from the previous audit | Status and evidence for each nonconformity | `isms/certification-findings-action-plan` | | Handling of complaints | Complaint log and responses relating to information security | `isms/audit-findings-register` | | Effectiveness against objectives | Objectives status and measurement results | `compliance/objectives-register`, `isms/isms-performance-report` | | Progress of continual improvement | Improvement register entries and outcomes | `isms/continual-improvement-register` | | Continuing operational control | Records showing controls operate | `isms/control-evidence-matrix` | | Changes since the last audit | Change log for scope, organization, systems, risks | `isms/isms-change-plan` | | Use of the certificate and marks | Examples of how the certification is referenced | `isms/certification-mark-usage` | ### 4.2 Coverage across the cycle *Example* coverage plan for Quillmere Analytics Ltd. Each X means the area is planned for detailed audit; standing topics in 4.1 are covered every time. | Area | Stage 2 (2027) | Surveillance 1 (2028) | Surveillance 2 (2029) | Recertification (2030) | |---|---|---|---|---| | Clause 4 context and scope | X | | | X | | Clause 5 leadership and policy | X | X | | X | | Clause 6 risk assessment, treatment, SoA, objectives | X | X | X | X | | Clause 7 support (competence, awareness, documented information) | X | | X | X | | Clause 8 operation | X | X | X | X | | Clause 9 performance evaluation | X | X | X | X | | Clause 10 improvement | X | X | X | X | | A.5 organizational controls | Sample | Access, suppliers, incidents | Cloud, continuity, legal | Sample across theme | | A.6 people controls | Sample | Screening, awareness | Remote working, reporting | Sample across theme | | A.7 physical controls | Office | Equipment, disposal | Office | Sample across theme | | A.8 technological controls | Sample | Endpoint, vulnerabilities, logging | Development, backup, network | Sample across theme | Clause 6, 8, 9 and 10 appear in every audit because risk, operation, evaluation and improvement are where the CB sees whether the ISMS is alive. Over the cycle, every applicable control in the SoA should have been sampled at least once; ask the CB for its audit programme to confirm. ### 4.3 Audit-type comparison | Aspect | Stage 1 | Stage 2 | Surveillance | Recertification | |---|---|---|---|---| | Main question | Is the ISMS ready to be audited? | Does it conform and work? | Does it still conform and work? | Has it worked over three years and will it continue? | | Evidence period | Documents and plans | Records since the ISMS started operating | Records since the last audit | Records over the whole cycle | | Typical location | On site or remote, per CB | On site, with remote parts where allowed | On site or remote, per CB | On site, with remote parts where allowed | | Example duration *(Example)* | 1.5 days | 3.5 days | 1.5 days | 2.5 days | | Output | Stage 1 report and concerns | Report, findings, recommendation | Report, findings, continuation | Report, findings, recertification recommendation | ## 5. Preparing each audit | Weeks before audit | Activity | Owner | Output | |---|---|---|---| | 16 | Confirm audit dates and auditor with the CB; report any changes (section 6) | ISMS manager | CB confirmation | | 12 | Run the surveillance readiness health check | ISMS manager | `isms/surveillance-readiness-health-check` report | | 10 | Complete internal audit cycle for the period | Internal audit lead | Internal audit reports | | 8 | Hold management review with all required inputs | Top management | Minutes and decisions | | 6 | Close or progress open corrective actions; update risk register and SoA | Process owners | Updated records | | 4 | Receive the CB audit plan; book interviewees and rooms or remote sessions | ISMS manager | Interview schedule | | 2 | Refresh the evidence index and test remote access for the auditor | ISMS manager | Evidence index | | 0 | Opening meeting, audit, closing meeting | All | Audit report | | +1 to +4 | Respond to findings by the CB deadline | ISMS manager | `isms/certification-findings-action-plan` | For remote audit parts, agree in advance the tools, screen sharing rules, what may be recorded, and how confidential evidence is shown without handing over copies. IAF MD 4 (now re-issued by Global ACI as Global ACI-TECH-3-003) covers the use of information and communication technology in audits; check the current issue. ## 6. Changes to notify to the certification body | Change | Example | Notify within *(Example)* | Who | |---|---|---|---| | Legal entity, ownership or name | Acquisition, merger, rename | As set in the certification agreement (*Example*: 30 days) | Top management | | Scope (services, products, processes) | New product line in scope, a service removed | Before the change takes effect | ISMS manager | | Sites | New office, closed site, new data centre or cloud region | Before the change takes effect | ISMS manager | | Number of persons in scope | Headcount up or down significantly, affecting audit time | At the next audit planning, or sooner if large | HR and ISMS manager | | Key personnel | New ISMS manager or CISO, top management change | Promptly | ISMS manager | | Major incident or legal action | Significant breach, regulator investigation | As set by the CB (*Example*: promptly after containment) | CISO | | Major change to the ISMS or controls | Outsourcing of operations, new cloud provider | Before the change takes effect | ISMS manager | A scope extension or new site may need a special audit. Plan these in `isms/scope-extension-multisite-plan` (DOC-ISMS-095). ## 7. Keeping the certificate valid | Obligation | How it is met | Owner | Evidence | |---|---|---|---| | Allow audits at the required frequency | Dates in section 3 confirmed with the CB each year | ISMS manager | CB audit programme | | Pay fees on time | Fees in the annual budget (section 11) | Finance | Invoices paid | | Keep the ISMS conforming between audits | Internal audits, management review, corrective actions | ISMS manager | Records in section 13 | | Use certificate and marks only as permitted | Approval workflow in `isms/certification-mark-usage` | Marketing and ISMS manager | Approval log | | Keep records of complaints and actions | Complaint log linked to the findings register | ISMS manager | Complaint log | | Notify changes | Triggers in section 6 | ISMS manager | Notification log | | Accept short-notice audits when the CB needs them | Contact list kept current | ISMS manager | CB contact record | | Make claims only within scope | Scope wording checked before publication | ISMS manager | Approval log | ## 8. Suspension, withdrawal, reduction and expiry ```mermaid stateDiagram-v2 [*] --> Valid : certification decision Valid --> Suspended : missed audit, unresolved major, misuse of marks Suspended --> Valid : issue resolved within the CB period Suspended --> Withdrawn : not resolved within the CB period Valid --> Reduced : part of scope no longer conforms Reduced --> Valid : scope extension audit passed Valid --> Expired : recertification not completed before expiry Expired --> Valid : restored by the CB under its rules Valid --> Withdrawn : client request or serious breach Withdrawn --> [*] ``` | Risk | Common trigger | Prevention | |---|---|---| | Suspension | Surveillance not held in time; a major nonconformity not resolved by the CB deadline; serious misuse of the certificate or marks; client asks for a temporary suspension | Dates confirmed 16 weeks ahead, findings plan with owners, mark approval workflow | | Withdrawal | Suspension not resolved within the period the CB sets (*Example*: 6 months, per CB rules); repeated serious breaches of the agreement | Escalate any suspension to top management at once | | Scope reduction | Part of the scope persistently fails to meet requirements | Treat site or process weaknesses before they reach the CB | | Expiry | Recertification audit or decision not completed before the expiry date | Recertification audit about 3 months before expiry | During suspension the certificate is temporarily invalid: stop all claims of certification and use of marks, and inform the customers whose contracts require it if the contracts say so. ISO/IEC 17021-1:2015 allows a CB to restore a certificate that expired because recertification was not finished in time: within six months of expiry, provided the outstanding recertification activities are completed; after that, at least a Stage 2 audit is needed. The certificate is not valid in the gap between expiry and the new decision; the CB sets the dates on the restored certificate, commonly an effective date on or after the recertification decision and an expiry date that follows the previous cycle (as explained in European co-operation for Accreditation guidance on the standard; confirm the period and conditions with your CB). Do not plan to rely on this. ## 9. Recertification Before the recertification audit: 1. Review context, interested parties and scope (DOC-ISMS-003, DOC-ISMS-002): has the business changed enough to change the scope? 2. Refresh the risk assessment in full and update the SoA (DOC-ISMS-017, DOC-ISMS-011). 3. Complete a full-scope internal audit cycle covering all clauses and all applicable controls. 4. Hold a management review that looks at performance over the whole cycle: objectives trend, incidents, audit results, improvement. 5. Check that every nonconformity from the cycle is closed and its effectiveness reviewed. 6. Confirm with the CB the audit plan, duration (*Example*: 2.5 days) and any sites to visit. The CB reviews the performance of the ISMS over the cycle, including previous surveillance reports, before it decides. Nonconformities found at recertification must be resolved in the time the CB sets and before expiry. If they cannot be, the certificate lapses at expiry. ## 10. Changing certification body A valid, accredited certificate (issued under accreditation by a signatory of the Global ACI MRA, formerly the IAF MLA) can usually be transferred to another accredited CB without restarting the cycle. The receiving CB carries out a pre-transfer review of the current certificate, the last audit reports, open nonconformities, complaints and the reason for the change, under IAF MD 2 on transfer of accredited certification (now re-issued by Global ACI as Global ACI-TECH-3-002; check the current issue). Open major nonconformities usually block a transfer until closed. Plan transfers away from audit dates and keep copies of all reports from the previous CB. Use `isms/certification-body-selection` to choose the new CB. ## 11. Budget and resources across the cycle *Example* CB fees for Quillmere Analytics Ltd at a day rate of USD 1,500 (an *Example* rate; ask your CB for its quote) and an annual certificate and administration fee of USD 600: | Year | Audits | Audit days *(Example)* | Day fees (USD) | Admin fee (USD) | Total (USD) | |---|---|---|---|---|---| | 2027 | Stage 1, Stage 2 | 5.0 | 7,500 | 600 | 8,100 | | 2028 | Surveillance 1 | 1.5 | 2,250 | 600 | 2,850 | | 2029 | Surveillance 2 | 1.5 | 2,250 | 600 | 2,850 | | 2030 | Recertification | 2.5 | 3,750 | 600 | 4,350 | | **Total** | | **10.5** | **15,750** | **2,400** | **18,150** | Add internal effort: the ISMS manager's time for preparation and response, interviewees' time on audit days, internal audit time, and travel for auditors if the CB charges it. Record the full plan in `isms/isms-budget-resource-plan` (DOC-ISMS-031). ## 12. Size tiers | Aspect | Small: Quillmere Analytics Ltd | Medium: Quillmere Health Systems | Large or multi-site: Quillmere Group | |---|---|---|---| | Profile | 46 staff, one office plus remote staff, one cloud provider in two regions | 320 staff, two offices, one colocation suite | 2,400 staff, 6 sites in 4 countries, OT and IT | | Cycle plan owner | Part-time ISMS manager (0.5 FTE) | Full-time ISMS manager | CISO office with site coordinators | | Audit time | Set by the CB from 46 persons in scope and complexity (*Example* total 10.5 days over the cycle) | Set by the CB from 320 persons, two offices and the colocation suite | Set by the CB per site and phase, with sampling under ISO/IEC 27006-1 and IAF MD 1 (Global ACI-TECH-3-001) | | Surveillance focus | Same small team interviewed each time; rotate controls | Rotate offices and the colocation suite across surveillances | Rotate sampled sites; central functions every audit | | Integration | Stand-alone ISMS cycle | 27001 cycle now; a PIMS certificate under ISO/IEC 27701:2025 planned the year after, possibly aligned dates | Integrated audits with ISO 9001 and ISO 22301 where the CB offers them (IAF MD 11, now Global ACI-TECH-3-008); phased site additions through scope extensions | | Main risk | One person away at audit time | Two cycles drifting apart if 27701 is added later | A site added late misses its sampled audit | ## 13. Records and evidence | Record | Owner | Location | Retention *(Example)* | |---|---|---|---| | Certificate and certification decision letter | ISMS manager | Evidence library, certification folder | Life of certificate plus one cycle | | CB audit programme and audit plans | ISMS manager | Certification folder | Current and previous cycle | | CB audit reports | ISMS manager | Certification folder | Current and previous cycle | | Findings action plans | ISMS manager | DOC-ISMS-093 per audit | Current and previous cycle | | Change notifications to the CB | ISMS manager | Notification log in this plan | Current and previous cycle | | Internal audit reports and management review minutes | Internal audit lead, top management | DOC-ISMS-084, DOC-ISMS-085 | Per DOC-ISMS-028 | | Mark usage approvals | Marketing | DOC-ISMS-097 approval log | Current and previous cycle | | Invoices and certification agreement | Finance | Finance system | Per finance retention rules | Map these records in `isms/control-evidence-matrix` (DOC-ISMS-033) under clauses 9.2, 9.3 and 10.2. They also feed the ISMS annual calendar (`isms/isms-annual-calendar`, DOC-ISMS-032). ## 14. References | Reference | Edition | Use | |---|---|---| | ISO/IEC 27001:2022 + Amd 1:2024 | https://www.iso.org/standard/82875.html ; Amd 1: https://www.iso.org/standard/88435.html | Requirements audited in every audit | | ISO/IEC 17021-1:2015 | https://www.iso.org/standard/61651.html | Certification cycle, surveillance, recertification, suspension, withdrawal | | ISO/IEC 27006-1:2024 | https://www.iso.org/standard/82908.html | ISMS audit time, multi-site sampling, auditor competence | | ISO/IEC 27007:2020 | https://www.iso.org/standard/77802.html | ISMS auditing guidance (under revision; check for a newer edition) | | IAF MD 1, MD 2, MD 4, MD 11, re-issued as Global ACI-TECH-3-001, -002, -003 and -008 | Global ACI v1.0 issued 2026-07-10, in force 2026-08-28; check the current issue | Multi-site, transfer, ICT in audits, integrated audits. IAF and ILAC ceased operations on 1 January 2026 and their work passed to Global Accreditation Cooperation Incorporated (Global ACI); the IAF MLA became the Global ACI MRA | | Your CB's certification rules and agreement | Current version | Binding dates, periods and obligations | Related templates: `isms/certification-body-selection` (DOC-ISMS-090), `isms/stage-1-readiness-pack` (DOC-ISMS-091), `isms/stage-2-audit-evidence-index` (DOC-ISMS-092), `isms/certification-findings-action-plan` (DOC-ISMS-093), `isms/scope-extension-multisite-plan` (DOC-ISMS-095), `isms/surveillance-readiness-health-check` (DOC-ISMS-096), `isms/certification-mark-usage` (DOC-ISMS-097), `compliance/internal-audit-program` (DOC-ISMS-082). ## Standard and licence note Structure aligned with the certification cycle described in ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024 for ISO/IEC 27001:2022 + Amd 1:2024 certification. The text, tables, timeline and examples are original. No ISO or IEC text is reproduced; read the official standards (purchase or licensed access from ISO, IEC or your national standards body) and your certification body's rules before relying on any period or rule stated here. Check the current edition of each standard and the current accreditation documents before use. Audit days and fees are Example values; audit time is set by the certification body, and certification decisions are made only by the accredited certification body. This is a documentation format, not certification or legal advice. Template licence: MIT.