ISO 27001 certification is valid for three years, with annual surveillance audits required to ensure ongoing compliance. A full re-certification audit is needed at the end of the three-year period.