We have a defined and certified scope. If we have a business event that impacts the services or a building that is "in" scope and we have to shut that building down and recover services to another site that does not have an equitable set of physical and logical security controls how does that impact the validity of the certification?

Do we need to notify the auditor? Can we simply work on corrective actions to ensure that at the next audit we are aligned with the standard and control operation? Is there anything else we need to do?

2 Answers 2


27001 certification is about your ISMS, not your controls. If a control stops working, it doesn't impact your certification.

Of course, if a control stops working, and your ISMS doesn't detect and fix that problem, then that impacts your certification....


Your question is targetting two subjects:

First, the use of 'another site that does not have an equitable set of physical and logical security controls' in the case of assets within the scope has to be documented. This is usually done in recovery plans/contingency plans.

Second, you do owe the auditor nothing. However, if you have an incident and you see that this incident makes your break the rules you had certified (example: the servers have to operate in a room controlled by physical access restriction), then you have a "non-conformity". Non conformities are usually qualified as minor or major. The number of these non-conformity raised by an auditor will decide on the renewal of your certification.

Corrective actions are means to correct the non-conformities you raise. Failing to do so will allow the non-conformity to stay and potentially be raised during a future audit. The corrective action should address this by either:

  • create new rules (example: create a document for recovery stating that when this type of incident happens, servers can operate in a degraded environment for some times),
  • modify the rules,
  • or investing in more resources (having a backup server in a proper room with physical access).

If you follow your rules and keep correcting yourself when there is failure to comply, there should be no problem regarding the certification. After all, this is what ISO27k says you have to do.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .