Organization A has a service that is ISO 27001 certified. It is acquired by Organization B which does not have any certification.
What are the formal impacts of the acquisition on the ISO 27001 certification?
I am interested in two cases:
Right after the acquisition when nothing changed yet in Organization A.
→ My understanding is that the certification is intact as
- The scope has not changed; and
- The means to handle the requirements (patch management for instance) has not changed either.
Organization B integrates Organization A and the means to handle the requirements have changed. To take the patch management example above, it is now ad-hoc, uncontrolled, in one word not suitable for ISO 27001 requirements.
→ Does the ISO certification still hold?
Another way of looking at it is whether the certification is a snapshot checked every year (with the hope that things are correct over the year), or whether any negative change over that year automatically invalidates it.
If the latter, how does this invalidation happen?