Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Say a small company just earned an ISO 27001 accreditation. What happens if during one of the audits it is found that the company didn't follow the ISMS? Is there a certain warning process that company has to go through? I basically want to know if there are instances when an ISO 27001 accreditation gets retracted and how?

share|improve this question
up vote 2 down vote accepted

I could not find anything about this particular ISO 97001 on the ISO website or any other related sites. But I saw you placed a tag ISO 27000 and that you mentioned ISMS, so I suppose you are talking about ISO 27001 which is Information Security Management System.

Normally, with all ISO certification, once you are accredited the certificate, scheduled surveillance audits will have to take place. Should you have major deficiency, the auditor will give you a certain amount of time to take corrective actions. If, after the given time, you have not successfully implemented those corrective actions or adjusted your processes, a certificate revocation will/can be issued.

The main reason you implement the ISO 27001 is to cover business risks. If you see that you have the ISO 27001 but that you actually don't bother using the controls defined in the framework except when there's an audit, then you have a serious security mentality issue within your company. Also note that if there is a serious incident and it is shown that controls defined in the framework were not followed, you are not covered by the framework/certificate anymore.

share|improve this answer
Oh dear. I have written that question late in the evening. Thank you for your answer. – obsessiveCookie Sep 10 '13 at 14:55
Also, can you please give me an example to demonstrate what you meant by a serious incident? By "not covered" do you mean the certificate get revoked? – obsessiveCookie Sep 11 '13 at 9:23
By not covered I mean legally liable. A serious incident would be that you are using other processes defined as in your ISO 27001. Let's say one day you find out your client database is on the internet, a hacker had intruded your network, which was segmented and had access to your database because your password was not set and thus not compliant with your policy and controls. Then this would be a serious incident. – Lucas Kauffman Sep 11 '13 at 11:00
I understand it better now. Thanks – obsessiveCookie Sep 11 '13 at 11:29

Well, not all non conformities should be treated alike and this is why I think that the information security standard is subjective.

Speaking of the scenarios that may (not necessarily limited) apply here:

  1. a need improvement is raised rather than a non conformity and a follow-up surveillance audit (different than the yearly one) is required.
  2. a non conformity is given and the certification is taken away. In this case a full certification engagement need to take place in order to attain the certification again


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.