ISO 27001 certification is valid for three years, during which regular surveillance audits are conducted to ensure ongoing compliance.