Your security and compliance glossary

All the terms you need to know when you’re trying to get compliance audit ready, fast.

Show filters
GLOSSARY
ISO 27001
ISO 27001 Stage 2 Audit

What is the ISO 27001 Stage 2 Audit?

The ISO 27001 Stage 2 Audit—also known as the Main or Certification audit—is the second part of the two-stage external ISO certification process and follows the successful completion of the Stage 1 audit. The Stage 2 Audit consists of the auditor performing tests to ensure an organization’s Information Security Management System (ISMS) was properly designed and implemented and is functioning appropriately. The auditor will also evaluate the fairness and suitability of the organization’s controls to determine if the controls have been implemented and are operating effectively to meet the ISO 27001 standard requirements.


An ISO 27001 certification is valid for three years; however, ISO requires surveillance audits be performed each year to ensure the ISMS and its implemented controls continue to operate effectively. Every 12 months during the three-year cycle, an organization’s ISMS must undergo an external audit, where an auditor will assess portions of the ISMS.

The compliance news you need. Delivered securely to your inbox.

Subject to Vanta's Privacy Policy, you agree to allow Vanta to contact you via the email provided for marketing and other purposes

Everything you need to get compliance audit ready, fast.