Yes, ISO 27001 certification can be lost after it is granted. Certification is not a one-time achievement: it requires ongoing compliance, regular surveillance audits, and a recertification cycle every three years. If your organisation fails to meet these requirements, your certification body can suspend or fully withdraw your certificate.<\/p>\n
This applies to organisations of all sizes, including small businesses. The good news is that losing certification is rarely sudden. There are clear warning signs, defined processes, and real opportunities to recover. The sections below walk through the most common scenarios and what they mean in practice.<\/p>\n
Failing an ISO 27001 surveillance audit does not automatically mean you lose your certification, but it triggers a formal corrective action process. Your certification body will identify nonconformities, classify them as minor or major, and give you a defined timeframe to resolve them. If major issues remain unresolved within that window, suspension follows.<\/p>\n
There are two types of nonconformities that auditors can raise. Minor nonconformities point to gaps that do not fundamentally break your information security management system (ISMS). You will typically have a few months to address these with documented corrective actions. Major nonconformities are more serious. They indicate a significant failure in your ISMS, such as missing risk assessments, undocumented controls, or a complete breakdown in a critical process.<\/p>\n
If you accumulate multiple minor nonconformities without resolving them, they can collectively be treated as a major finding. The key takeaway: act on audit findings quickly and document everything. Certification bodies want to see evidence of improvement, not just promises.<\/p>\n
The most common reasons ISO 27001 certification is suspended include failing to schedule or complete required surveillance audits, leaving major nonconformities unresolved past the agreed deadline, and significant changes to the organisation that were not reported to the certification body. In practice, most suspensions are avoidable with basic calendar management and prompt follow-through.<\/p>\n
Here are the situations that most frequently lead to suspension:<\/p>\n
For small businesses in particular, the risk often comes down to bandwidth. When the person responsible for ISO 27001 compliance leaves the company or takes on other responsibilities, maintenance tasks slip through the cracks.<\/p>\n
Suspension is temporary. Withdrawal is permanent. When a certification is suspended, the organisation can no longer claim certified status, but the certification body has not yet closed the case. The organisation has a defined period, usually up to six months, to resolve the underlying issues and restore the certificate. Withdrawal means the certification has been formally cancelled and the organisation must start the full certification process again from scratch.<\/p>\n
Think of suspension as a yellow card and withdrawal as a red card. Suspension signals that something is wrong and action is required. Withdrawal happens when the problems are not fixed in time, or when the organisation voluntarily gives up the certificate.<\/p>\n
During a suspension period, you should stop displaying the certification mark on your website, proposals, and marketing materials. Using a suspended certificate as if it were valid is a serious compliance breach and can damage your credibility with clients far more than the suspension itself.<\/p>\n
ISO 27001 certification follows a three-year cycle. After the initial certification audit, you must complete a surveillance audit in year one and another in year two. At the end of year three, a full recertification audit is required to renew the certificate for another three-year cycle. Missing any of these audits puts your certification at risk.<\/p>\n
The surveillance audits are lighter than the initial certification audit. They focus on whether your ISMS is still functioning, whether internal audits and management reviews are happening, and whether any significant changes have been managed properly. The recertification audit at year three is more comprehensive and covers the full scope of your ISMS again.<\/p>\n