FAQGlobalISO/IEC 27001

ISO/IEC 27001 FAQ Surveillance Audits

How should teams handle Surveillance Audits under ISO/IEC 27001:2022 Information Security Management System?

This guide walks through topic-specific decisions, owners, evidence requirements, review gates, and traceability steps so teams can implement repeatable ISO/IEC 27001 outcomes.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Questions

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

Surveillance audits are the certification body's ongoing checks after ISO/IEC 27001 certification. They are different from internal audits: internal audits are run by the organization at planned intervals, while surveillance audits are used by the certification body to confirm the ISMS still conforms and is being maintained.

Search this module

Find a question or answer quickly

4 of 4 questions

Question 1

How should teams handle Surveillance Audits under ISO/IEC 27001?

Start with the operational decision: define what Surveillance Audits means in your ISO/IEC 27001 scope, who owns it, and what record proves the decision is current.

For ISMS work, keep the traceability chain visible: scope, risk, treatment choice, SoA entry, control owner, evidence sample, exception, corrective action, and management review decision. This keeps the answer useful in audits, customer reviews, incidents, supplier reviews, and management review.

Name the accountable owner and reviewer for Surveillance Audits.
Record the scope, assumptions, decision, approval date, evidence location, exception status, and next review trigger.
Escalate when Surveillance Audits changes risk acceptance, service commitments, customer promises, regulatory duties, or certification evidence.

Citations

ISO/IEC 27001:2022 standard page

Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations.

ISO/IEC 27006-1:2024 standard page

This source states that certification bodies audit and certify ISMS in accordance with ISO/IEC 27001 and supports the certification-body context for surveillance audits.

Question 2

What evidence should prove Surveillance Audits is current under ISO/IEC 27001?

The evidence should show the process operating. For this artifact, the strongest record usually includes ISMS scope, risk assessment, treatment plan, Statement of Applicability, Annex A evidence, internal audits, corrective actions, and management review records.

Avoid evidence that only repeats a requirement. A reviewer should be able to see the actual owner, date, system, supplier, security-critical system, service, incident, risk, or control sample behind the answer.

Use source records from the system of work, not screenshots created only for audit day.
Keep exceptions visible as risk acceptance, corrective action, or management-review input.
Update linked registers when the answer changes an owner, risk, control, service, supplier, or review date.

Citations

ISO/IEC 27002:2022 standard page

This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance.

ISO/IEC 27005:2022 standard page

This source supports risk treatment and monitoring context that informs control decisions and residual risk handling.

Recommended next step

Operationalize ISO/IEC 27001 FAQ: Surveillance Audits

Use this ISO/IEC 27001 guide as the starting point for a tracked workflow: assign owners, request evidence, record decisions, and keep review dates visible instead of leaving the guidance in a document.

Assessment workflow

Open Assessment Autopilot for ISO/IEC 27001

Convert ISO/IEC 27001 FAQ: Surveillance Audits into accountable tasks, evidence requests, and review checkpoints.

Explore next step

Talk to Sorena

Talk through implementation

Review your current scope, evidence gaps, and next implementation steps.

Explore next step

Question 3

Who should approve Surveillance Audits decisions under ISO/IEC 27001?

The person who can fund, operate, and correct the process should own the decision; governance should review consistency and exceptions.

For high-impact changes, approval should include the teams affected by the evidence: security, privacy, resilience, supplier management, security governance, legal, risk, or business service owners as relevant.

Use a named owner, named backup, and named escalation forum.
Separate preparation work from risk acceptance and final approval.
Keep approval records with the evidence rather than in disconnected email threads.

Citations

ISO/IEC 27001:2022 standard page

Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations.

ISO/IEC 27002:2022 standard page

This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance.

Question 4

When should Surveillance Audits be reviewed under ISO/IEC 27001?

Review it at planned intervals and whenever the underlying scope, service, supplier, control, risk, security-critical system, personal data flow, incident process, or customer commitment changes.

A stale record is worse than a short record. If the facts change, update the evidence and mark what changed so the next reviewer can trust the page.

Set a planned review date and a change-trigger rule.
Use findings to update controls, procedures, contracts, risk registers, or training.
Carry unresolved items into management review or risk acceptance.

Citations

ISO/IEC 27001:2022 standard page

Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations.

ISO/IEC 27002:2022 standard page

This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance.

Primary sources

References and citations

ISO/IEC 27001:2022 standard page

iso.org

Referenced sections

Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations.

"Information security management systems - Requirements"

ISO/IEC 27002:2022 standard page

iso.org

Referenced sections

This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance.

"Information security controls"

ISO/IEC 27005:2022 standard page

iso.org

Referenced sections

This source supports risk treatment and monitoring context that informs control decisions and residual risk handling.

"Guidance on managing information security risks"

ISO/IEC 27006-1:2024 standard page

iso.org

Referenced sections

This source states that certification bodies audit and certify ISMS in accordance with ISO/IEC 27001 and supports the certification-body context for surveillance audits.

"specifies the additional requirements for bodies that audit and certify information security management systems (ISMS) in accordance with ISO/IEC 27001"

Related guides