Say a small company just earned an ISO 27001 accreditation. What happens if during one of the audits it is found that the company didn't follow the ISMS? Is there a certain warning process that company has to go through? I basically want to know if there are instances when an ISO 27001 accreditation gets retracted and how?


I could not find anything about this particular ISO 97001 on the ISO website or any other related sites. But I saw you placed a tag ISO 27000 and that you mentioned ISMS, so I suppose you are talking about ISO 27001 which is Information Security Management System.

Normally, with all ISO certification, once you are accredited the certificate, scheduled surveillance audits will have to take place. Should you have major deficiency, the auditor will give you a certain amount of time to take corrective actions. If, after the given time, you have not successfully implemented those corrective actions or adjusted your processes, a certificate revocation will/can be issued.

The main reason you implement the ISO 27001 is to cover business risks. If you see that you have the ISO 27001 but that you actually don't bother using the controls defined in the framework except when there's an audit, then you have a serious security mentality issue within your company. Also note that if there is a serious incident and it is shown that controls defined in the framework were not followed, you are not covered by the framework/certificate anymore.

  • Oh dear. I have written that question late in the evening. Thank you for your answer. – obsessiveCookie Sep 10 '13 at 14:55
  • Also, can you please give me an example to demonstrate what you meant by a serious incident? By "not covered" do you mean the certificate get revoked? – obsessiveCookie Sep 11 '13 at 9:23
  • 1
    By not covered I mean legally liable. A serious incident would be that you are using other processes defined as in your ISO 27001. Let's say one day you find out your client database is on the internet, a hacker had intruded your network, which was segmented and had access to your database because your password was not set and thus not compliant with your policy and controls. Then this would be a serious incident. – Lucas Kauffman Sep 11 '13 at 11:00

Well, not all non conformities should be treated alike and this is why I think that the information security standard is subjective.

Speaking of the scenarios that may (not necessarily limited) apply here:

  1. a need improvement is raised rather than a non conformity and a follow-up surveillance audit (different than the yearly one) is required.
  2. a non conformity is given and the certification is taken away. In this case a full certification engagement need to take place in order to attain the certification again


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.