Search every question across sub-FAQs

ISO/IEC 27001 requires planned intervals but does not prescribe a universal annual, quarterly, or monthly cadence. Set a cadence that gives top management timely oversight of the scoped ISMS and document it in the management-system schedule.

Material incidents, acquisitions, scope changes, important supplier changes, repeated nonconformities, failed objectives, or major risk changes can justify an additional review or an earlier decision forum even when the next planned review is not due.

Clause 6.1.2 requires the risk-assessment process to establish and maintain risk acceptance criteria. The organization identifies risks associated with loss of confidentiality, integrity, and availability within the ISMS scope, identifies risk owners, analyses consequence and realistic likelihood, determines risk levels, compares the results with its criteria, and prioritizes risks for treatment.

Clause 6.1.3 then requires appropriate treatment options, all necessary controls, comparison with Annex A, a Statement of Applicability, and a treatment plan. The risk owners approve that plan and accept the residual information security risks. The standard does not prescribe one scoring scale, approval form, or universal monetary threshold.

ISO/IEC 27001 requires documented information about the risk-assessment and risk-treatment processes and their results, but it does not prescribe a risk-acceptance form. The record should let another reviewer understand the scoped risk scenario, affected information or process, confidentiality-integrity-availability impact, criteria used, likelihood and consequence rationale, current controls, chosen treatment, residual-risk result, and owner approval.

Link the accepted residual risk to the risk-treatment plan and the Statement of Applicability where controls are involved. An acceptance entry that conflicts with an SoA implementation status or an overdue treatment needs correction or explicit reconciliation.

ISO/IEC 27001 assigns approval of the risk-treatment plan and acceptance of residual information security risk to risk owners. Security or compliance teams may coordinate the assessment, challenge the evidence, and administer the register, but they should not approve risk on behalf of an unnamed business owner.

The organization should define authority levels for different risk levels. That governance model is an organizational design choice; the standard's fixed point is that the risk owner is identified and provides the required approval and acceptance. A committee may supply escalation or collective governance, but the record should still show the identified risk owner and the authority used for the decision.

Clause 8.2 requires information security risk assessments at planned intervals and when significant changes are proposed or occur. Apply that rule to accepted risks rather than treating the approval as permanent.

A significant incident, threat change, control failure, new vulnerability, supplier change, scope change, or changed legal or contractual requirement may invalidate the earlier decision. Whether a change is significant depends on the organization's maintained criteria and the facts; record that assessment rather than treating every change as an automatic new acceptance.

Start with the risk-treatment process, not the Annex A table. Clause 6.1.3 requires the organization to determine every control necessary for its chosen treatments, compare those controls with Annex A to verify that none were overlooked, and then explain any Annex A exclusions in the Statement of Applicability.

An excluded Annex A control is defensible when the organization can show why that reference control is not necessary in the scoped ISMS. The reason may follow from scope, technology, locations, information handled, interfaces, dependencies, assessed risks, or applicable requirements. Another control may contribute to the explanation, but naming an alternative alone does not show that the Annex A control is unnecessary.

The exclusion should trace back to the documented ISMS scope, risk-assessment results, selected treatment options, necessary-control determination, and the comparison with Annex A. A short rationale can be sufficient when that chain is clear; a generic 'not applicable' label is not self-explanatory.

Keep evidence proportionate to the decision. For example, an organization that does not operate its own data centre should not automatically exclude every physical control: its scope and supplier interfaces must still show which physical risks and responsibilities remain with the organization and which are handled through the provider. A supplier performing the activity can change the implementation method without making the control unnecessary.

ISO/IEC 27001 explicitly requires risk-owner approval of the risk-treatment plan and acceptance of residual risks. It does not prescribe a universal job title that signs the SoA. The organization should define SoA approval so control selection, exclusions, treatment decisions, and residual-risk approvals remain consistent.

A practical review includes the ISMS owner, relevant risk owners, and control or service owners; legal, privacy, supplier, resilience, or technical specialists should be involved when their requirements or dependencies affect the rationale. This is governance guidance, not a certification rule that creates a mandatory committee.

Review exclusions when the underlying risk assessment or treatment changes. Clause 8.2 requires reassessment at planned intervals and when significant changes are proposed or occur, so the SoA should not remain frozen while scope, systems, suppliers, threats, contracts, or legal requirements change.

Also review an exclusion when audit evidence, an incident, a failed dependency, or a new service shows that the earlier applicability assumptions were incomplete. The result may be a revised rationale, a newly necessary control, or a changed implementation status.

A surveillance audit is performed by the certification body during the certification cycle to assess continuing conformity and maintenance of the certified ISMS. It is external certification activity, not the internal audit required by Clause 9.2 and not a substitute for management review under Clause 9.3.

The organization must keep operating the whole management system between external audits. Passing the original certification audit does not freeze the scope, risk register, SoA, controls, or evidence. Certification concerns conformity of the scoped management system; it is not a guarantee that every system is secure or that no incident will occur.

Prepare the current scope, risk assessment and treatment records, SoA, objective and performance results, internal-audit programme and reports, management-review decisions, prior external-audit actions, nonconformities, corrective actions, and operating samples for selected controls.

Follow the certification body's audit plan for the actual sample and evidence period. Be ready to explain material changes and show both normal operation and how the ISMS responded to incidents, failed controls, missed objectives, supplier changes, or other deviations. The audit may select evidence outside a prepared index when it is relevant to the scope and criteria.

The certification body plans and performs the external audit and makes certification decisions under its scheme. ISO/IEC 27006-1 addresses the competence, consistency, and impartiality of bodies that audit and certify ISMSs.

The organization remains responsible for the ISMS: top management, risk owners, control owners, internal auditors, and corrective-action owners must be able to explain and evidence their own decisions. The external auditor does not assume those roles.

ISO/IEC 27001 sets the organization's ISMS requirements but does not itself state the surveillance dates for a particular certificate. The certification process is governed by ISO/IEC 17021-1, supplemented for ISMS certification by ISO/IEC 27006-1. Under ISO/IEC 17021-1, surveillance audits occur at least once in each calendar year except a recertification year, and the first surveillance audit after initial certification must be no more than 12 months after the certification decision. Use the certification agreement and audit programme for the actual dates, scope, duration, and remote or on-site arrangements.

Do not wait for the scheduled audit when a material change could affect certified scope or the validity of the claim. Follow the certification arrangement's notification process and update the ISMS records as the change occurs.