The ISO 27001 certificate is valid for three years from the date of issue. During this period, the certification body performs annual surveillance audits.