What must be ready before an ISO 27001 stage 1 audit?
Before a certification body starts stage 1, the ISMS must already have run its performance evaluation activities and hold a Statement of Applicability. The performance evaluation covers monitoring, measurement, analysis and evaluation under clause 9.1, internal audit under clause 9.2, management review under clause 9.3, and nonconformity and corrective action under clause 10.2. The Statement of Applicability is required by clause 6.1.3 d) of ISO/IEC 27001:2022, which sits within the risk treatment process. If a customer or contract deadline is driving the timeline, work backward from these two items, because a stage 1 review that finds they have not operated will delay the whole certification.
The certification body, not DeployOpen or any consultant, sets the audit programme, the audit plan and the final certification decision. Ask your chosen body for its written audit programme and plan before stage 1 so you know what will be examined and when. No fixed number of days or weeks between stage 1 and stage 2 is supplied for this page: the body must judge whether the stage 1 findings are still valid, especially after significant changes, so confirm the gap in writing with the body rather than planning around a figure from a third party.
The checklist differs by organization. The four variables that change it most are the scope of the ISMS, the number of sites, the maturity of existing records such as risk assessments, internal audit reports and management review minutes, and whether any clause or Annex A control is still unimplemented. A small team with one site and mature records may need a short list of confirmations. A multi-site organization with thin evidence will need a longer preparation period, and any clause still in progress should be disclosed to the body early, since stage 1 is where it will be identified.
Which records and documents should you check before booking the audit?
Stage 1 starts with the documents an auditor reads first, and each one has to agree with the others. Clause 1 of ISO/IEC 27001:2022 means no clause from 4 to 10 can be excluded, so every record below will be examined, not just the Annex A controls.
Clause 4.3 scope statement
The scope defines which products, services, sites and business units the ISMS covers, and it must match the Statement of Applicability, the asset register and the network diagrams. Check that the scope is written in plain terms, that it names the boundaries and any exclusions with reasons, and that every system it mentions appears in the risk assessment. A scope that describes a smaller or larger organization than the one actually operating is among the most common early problems.
Risk assessment and treatment records
Clauses 6.1.2 and 6.1.3 require a documented information security risk assessment and a risk treatment process. Check that each risk has an identified owner, a likelihood and impact rating, a stated method, and a treatment decision with a named person accountable for it. Records that list risks without owners or dates, or that were never updated after a significant change, signal that the process is not operating.
Statement of Applicability and justifications
The Statement of Applicability records, under clause 6.1.3 d), which Annex A controls apply, which do not, and why, and how each applicable control is implemented. Check that every one of the 93 Annex A controls is addressed, that each exclusion has a justification tied to the risk assessment, and that each inclusion points to a real owner, procedure or system. An SoA that marks every control as applicable without evidence is a frequent finding during stage 1.
Documented information and version control
The standard requires documented information for the ISMS, including policies, procedures and records the organization decides are needed for effectiveness. Check that each document has an owner, a version, an approval date and a review date, that the current version is the one people use, and that superseded versions are retired. Auditors often sample a few procedures and then trace them into operation, so consistency across documents matters more than volume.
Internal audit and management review evidence
Clauses 9.2 and 9.3 require the organization to audit its own ISMS at planned intervals and to have top management review it. Check that the internal audit program covers the whole scope, that auditors were independent of what they reviewed, and that findings and management review minutes record the date, attendees, decisions and follow-up actions. Minutes that restate a template without discussing real results are a weak point in an assessment.
Nonconformity and corrective action log
Clause 10.2 requires the organization to react to nonconformities, correct them, deal with consequences and act to prevent recurrence. Check that the log records each finding with a date, source, root cause analysis, corrective action, owner and closure evidence. An empty log is not automatically a good sign: auditors will ask how internal audits and incidents feed into it, so the log should show that the process runs in practice.
How do performance evaluation records show the ISMS is running?
A certification audit looks for evidence that the ISMS has operated, not only that it has been written down. Before stage 2 the auditor expects to see a trail of dated, repeated activity under clauses 9.1, 9.2 and 9.3 and corrective action under clause 10.2. A policy that has never produced a measurement, an internal audit or a management review will read as a document set rather than a running system. Confirm each expectation below with your certification body and with the text of the standard, since the body decides how much evidence it needs for your scope and risk profile.
For clause 9.1, the records that usually matter are the defined metrics, the results collected against them, the analysis of those results and the evaluation of whether the ISMS is meeting its objectives. A useful check is whether each metric traces back to a risk in the risk treatment plan or to an objective set in clause 6.2, and whether someone recorded what they did when a result fell outside the expected range. For clause 9.2, look for an internal audit programme that covers the whole scope over time, a documented selection of auditors that shows they were not auditing their own work, and findings that each lead to a tracked action with a named owner. For clause 9.3, management review minutes should record the inputs the standard lists, such as status of actions from earlier reviews, changes in issues, nonconformities and monitoring results, and the decisions taken, with the people present.
Clause 10.2 corrective action records are where auditors look hardest at follow-through. Each nonconformity should have a recorded root cause analysis, a corrective action that addresses that cause, evidence that the action was implemented and a check that it worked. Ask yourself whether a reviewer could pick any finding from your internal audit and trace it to a closed action without help from the author. Treat these records as your own evidence of operation. They are not the certification body's conclusion that your ISMS is adequate, and the stage 1 and stage 2 reports are where that judgment appears.
What happens from the stage 1 review to the certification decision?
The two-stage initial audit moves from a documentary readiness review to a test of how the ISMS works in practice, and each step ends with a written output that tells the organization what it must still fix before the certification body can decide.
Certification body issues the audit programme and plan
Before stage 1, the certification body prepares an audit programme and an audit plan so the organization knows what will be audited and when. The organization confirms the dates, the sites and the people who will be interviewed, and checks that the planned scope matches the scope it intends to certify. The output is an agreed plan. If the scope or the sites on the plan do not match the ISMS as it actually runs, correct that now, because the plan defines what stage 1 and stage 2 will examine.
Stage 1 reviews documentation and readiness
Stage 1 is a review of documented information and of whether the ISMS is ready for a full test. The auditor checks the scope, the policies, the risk assessment and risk treatment, the Statement of Applicability, and evidence that the performance evaluation activities in clauses 9.1, 9.2 and 9.3 and the nonconformity process in clause 10.2 have run. The auditor also checks whether the organization understands its own context and the requirements of interested parties. The output is a documented stage 1 conclusion on readiness for stage 2, which is communicated to the client and lists any areas of concern that could be classified as a nonconformity during stage 2.
Resolve stage 1 concerns during the interval
The organization uses the interval between the two stages to fix the concerns raised in the stage 1 conclusions. The standard does not set a maximum length, so the certification body decides whether the stage 1 result is still valid, particularly if significant changes have happened to the ISMS, its scope or its risk picture in the meantime. Typical work includes correcting the Statement of Applicability, completing missing risk assessment records, and running an internal audit or management review that was skipped. The output is evidence, held by the organization, that each concern has been resolved. A pre-audit run in this interval does not replace the stage 1 review, and it does not count as stage 1.
Stage 2 tests implementation and effectiveness
Stage 2 tests whether the ISMS is implemented and effective. Clauses 4 to 10 are audited in full, and the Annex A controls selected in the Statement of Applicability are tested through operating evidence, not only through policy text. Auditors sample people, systems and records across the scope, and they test continuing operational control, for example whether access reviews, logs, backups and supplier checks actually happen as the documents say. Stage 2 closes with an opening and closing meeting. The output is an audit report that records conformity, observations and any nonconformities, graded as major or minor.
Close nonconformities and verify corrections
The organization responds to each nonconformity with a root cause analysis and a corrective action plan under clause 10.2, and submits the evidence to the certification body. For each major nonconformity, the certification body must verify that the correction and corrective action are complete within 6 months after the last day of stage 2. If it cannot, it must conduct another stage 2 before it can recommend certification. Minor nonconformities are handled through the corrective action process. The output is an accepted corrective action record for every finding.
Certification body makes the certification decision
The certification body reviews the stage 2 report, the corrective action evidence and the nonconformity closure, and then decides whether to grant certification. The decision is taken by people who did not carry out the audit, which is part of the certification body's impartiality controls. The output is either a certificate, issued by the certification body with its scope, dates and accreditation status, or a documented decision that certification cannot yet be granted. Confirm with the certification body before the audit how it will communicate the decision and the timeline for the certificate.
Why can a pre-audit not replace stage 1?
A pre-audit is allowed before stage 1, but it cannot be used as the stage 1 audit. European Accreditation FAQ 48.11 (September 2024) records IAF Technical Committee consensus that pre-audits before stage 1 are acceptable if impartiality is not compromised, and that no pre-audit may sit between stage 1 and stage 2. The difference matters because stage 1 is the certification body's own formal readiness review. It ends with documented conclusions on readiness for stage 2, including areas of concern that could become a nonconformity, and the client must receive those conclusions. A consultant's readiness review or a pre-audit by another party produces none of that, so it cannot stand in for the certification body's review or the conclusions that follow from it.
Use a pre-audit for what it does well. A readiness review by an independent party can test whether the performance evaluation records under clauses 9.1 to 9.3 exist and are current, whether the Statement of Applicability matches the risk treatment decisions under clause 6.1.3, and whether the organization can show a complete internal audit and corrective action trail under clause 10.2. It can also surface gaps while the organization still has time to close them. It cannot promise an outcome, and it cannot tell the organization whether the certification body will accept its scope or its evidence. The organization owns the decision to book stage 1, sets the date and chooses who prepares the evidence. Keep the pre-audit provider separate from the body that will certify you, because a provider that is also the certifier risks an impartiality conflict.
Before you book, ask the certification body in writing what it will and will not count. Confirm whether it accepts an earlier readiness review as evidence, whether it needs its own stage 1 scheduled regardless of any pre-audit, and how long it expects between stage 1 and stage 2. European Accreditation FAQ 49.3 (March 2025) sets no maximum interval, so the body must judge whether the stage 1 result still holds, especially after significant changes. If a pre-audit reveals large changes, ask whether the stage 1 conclusions remain valid. Keep the written answers with your audit file so the planning decision is documented.
What does stage 2 test in the management system and the Annex A controls?
Clause 1 of ISO/IEC 27001:2022 states that an organization claiming conformity may not exclude any requirement in clauses 4 to 10, so the assessor audits every one of them. These clauses cover the context of the organization, leadership and commitment, planning, support, operation, performance evaluation and improvement. Stage 2 is where the assessor confirms that the management system is implemented and running, not just described in a manual.
- Context and scope (clauses 4.1 to 4.4): Records showing how the organization determined its internal and external issues, interested parties and the boundary of the ISMS.
- Leadership (clause 5): Evidence that top management approved the policy, assigned roles and responsibilities, and acted on the results of management review.
- Planning and support (clauses 6 and 7): Risk assessment and risk treatment records, objectives with plans to meet them, competence records and documented information control.
- Operation and performance evaluation (clauses 8 and 9): Records of risk assessments run as planned, monitoring results, internal audit reports and management review minutes.
- Improvement (clause 10): Nonconformity records, root cause analysis and corrective actions closed with evidence of effectiveness.
Check that each clause has a named owner and at least one record from the period you are asking the assessor to sample.
Annex A is normative and lists 93 controls, but the standard does not require every one of them to be implemented in every organization. Controls are handled through risk treatment (clause 6.1.3), and the Statement of Applicability records which controls the organization selected, why, and where each one is implemented. The assessor tests the SoA first: whether each control's inclusion or exclusion is justified by the risk assessment, and whether the included controls match what actually runs. ISO/IEC 27002:2022 gives guidance on each Annex A control, but it is guidance only, and no organization can be certified to it.
- Selection logic: Justifications for included and excluded controls that trace back to the risk treatment plan.
- Implementation statements: A description for each included control that names the system, process or role that delivers it.
- Control owners: Named people who can explain how the control runs day to day, not only the policy that describes it.
- Exclusions: Reasons for each excluded control, with the risk that makes it unnecessary.
- Consistency: Matching between the SoA, the risk register and the control evidence the assessor is shown.
Before stage 2, reconcile the SoA against the risk treatment plan and confirm that every owner named in it can walk through their control.
Stage 2 assesses whether the management system works over time, so the assessor looks for records that are dated across the audit period rather than a single snapshot prepared for the audit. Evidence is expected to show the control operating, including its exceptions and how those exceptions were handled. Sampling choices belong to the certification body and its audit plan, so ask the body how it selects records rather than assuming a number.
- Access reviews: Dated review records with the reviewer, the population reviewed and the follow-up for removed or changed access.
- Logs and monitoring: Samples of security logs, alerts and their triage, showing that someone reviewed them.
- Tickets and changes: Change requests, approvals and incident or problem tickets that show a process being followed.
- Training and awareness: Completion records linked to the people in scope and dated within the period.
- Continuing operation: Evidence that controls operated in the period before stage 2, because later surveillance audits must include continuing operational control.
Ask each control owner to show one recent record and one from earlier in the period, so you know the control ran continuously.
Which readiness route fits your organization?
This table compares three ways to prepare before a certification audit: an internal self-check, an independent readiness review, and a formal pre-audit by a certification body. Read each row against your own records and deadline, and note that none of the three replaces the stage 1 audit.
| Option | What it covers | Who owns the output | When it fits |
|---|---|---|---|
| Internal self-check | Clause-by-clause walk through clauses 4 to 10, the Statement of Applicability against the risk treatment decisions, and records from the clause 9 and 10.2 activities | The organization, which decides what to fix and keeps the record | A mature ISMS with recent internal audits and management review minutes, where the team can test its own records honestly |
| Independent readiness review | Sample testing of evidence for each clause and selected Annex A controls, a gap list, and advice on how the records will be read at audit | The organization owns the findings and fixes. The reviewer owns only its own report and must stay independent of the certification body | A first certification with unclear records, or a team that has never been audited against clauses 4 to 10 |
| Formal pre-audit by a certification body | A preliminary visit the certification body may offer, limited to what it can accept under its impartiality rules | The certification body issues its own notes, but the output is not a stage 1 result and cannot count as one | Only where the body offers it and the organization wants early feedback. Confirm its fee and terms in writing |
| What none of the three replaces | Stage 1 documented review of readiness and the stage 2 test of operation | The certification body alone decides readiness for stage 2 and issues the certificate | Plan the stage 1 audit in every case, with an interval to resolve concerns |
| Questions to ask each provider | Ask what evidence the output includes: sampled records, dated findings, owner for each action, and whether it can be shown to the certification body | Confirm in writing who keeps the report and whether it can be shared | Ask before booking so the chosen route matches your records and deadline |
Who prepares the evidence and who issues the decision?
Your organization owns the information security management system and everything the certification body will test. The people accountable for the ISMS must make the decisions that the audit examines: which risks matter, which treatment options are chosen, and whether the Statement of Applicability reflects reality. Nobody else can sign those decisions on your behalf, and an auditor will ask who made them and when.
- Risk decisions: Management approves the risk assessment method, accepts residual risk and decides which Annex A controls apply and why.
- Statement of Applicability approval: A named owner approves the document under clause 6.1.3 and keeps it current as controls change.
- Management review: Leadership holds and records the review that clause 9.3 requires, with actions and decisions written down.
- Control operators: Staff who run each control, such as access reviews or backups, produce the records that prove the control operated.
- Corrective action: Your team investigates findings and closes nonconformities under clause 10.2.
Ask yourself whether each control has a named owner who can explain it to an auditor without a consultant in the room.
An implementation partner such as DeployOpen prepares the systems, documentation and evidence that your team and auditor will review. Within a written scope, this can include configuring self-hosted tools, drafting procedures, collecting records and supporting internal audits. The partner works for you, and the work product belongs to your organization. It does not change the fact that the controls and decisions remain yours.
- Systems and configuration: The partner can set up logging, access tooling and backups so the records exist when the auditor asks for them.
- Documentation drafts: Policies and procedures are drafted for your approval, not adopted as final without your management sign-off.
- Evidence collection: Records are gathered and organized so your staff can show operating evidence over time.
- Internal audit support: The partner can help prepare the internal audit under clause 9.2 within the agreed scope.
- Independence boundary: The partner must not make the certification decision, issue reports or certificates, or act as the certification body's auditor for the same client.
Confirm the scope, deliverables and who signs each document in writing before work begins.
The certification body is the only party that can decide whether your ISMS meets ISO/IEC 27001 and issue the certificate. ISO does not certify organizations, and accredited certification bodies work to ISO/IEC 17021-1 together with ISO/IEC 27006-1:2024. Its auditors are independent of the team that prepared your evidence, which protects the value of the certificate for your customers.
- Audit programme and plan: The body prepares the audit programme and plan before stage 1, so you know what will be audited and when.
- Stage 1 review: The body reviews documentation, judges readiness for stage 2 and reports areas of concern in writing.
- Stage 2 testing: The body tests whether the ISMS is implemented and operating, including continuing operational control.
- Nonconformity grading: The body classifies findings and decides whether corrections are verified within the required limits.
- Certification decision: The body decides on certification and issues the certificate.
Ask the body for its written audit plan and its stage 1 report format before you schedule anything.
The three roles meet at the audit evidence. Your team decides, the partner prepares, and the certification body judges. Confusion between these roles is a common source of audit problems, so it helps to write the split down before stage 1 begins. The table below summarizes it for your steering group.
- Decisions: Your leadership decides risk treatment and the Statement of Applicability, never the partner or the body.
- Preparation: The partner can draft and configure, but your owners review and approve.
- Judgment: The certification body alone grades findings and recommends or refuses certification.
- Pre-audit limits: A pre-audit by a consultant cannot replace stage 1, and a pre-audit between stage 1 and stage 2 is not permitted under the Forum's consensus.
- Records: Keep a RACI chart showing who approved each document, control and decision.
Check that your consultant contract states they will not perform the certification audit for you.
What usually delays stage 1 or sends the project back to stage 2?
Most stage 1 and stage 2 setbacks trace back to records that do not match what is running in the organization. The cards below cover the pitfalls auditors meet most often and the checks that catch them before the audit team arrives.
Statement of Applicability without justifications
The Statement of Applicability under clause 6.1.3 d) must list every Annex A control, state whether it applies, and give reasons for inclusion and exclusion. A list of ticked controls with no justification forces the auditor to reopen the risk treatment decisions behind it. Before stage 1, check that each control row links to a risk treatment decision and a named owner, and that exclusions cite the risk assessment rather than convenience.
Scope that does not match reality
The clause 4.3 scope statement must describe the sites, systems, services and people the ISMS actually covers. Scopes drawn from an old org chart or a marketing description often omit a data center, a cloud account or a contractor team that processes customer data. Walk the proposed boundary against the asset inventory and network diagrams, and confirm that every excluded location or service has a documented reason.
Internal audit and management review not recorded
Clauses 9.2 and 9.3 require internal audits and management reviews to take place, and the auditor will ask for records of both. Reviews held in meetings with no minutes, agendas, attendees or decisions are treated as if they did not happen. Schedule the internal audit before stage 1, hold a management review that covers the required inputs, and keep signed minutes that record actions and owners.
Controls on paper without operating evidence
A policy that exists but has no trace of use fails the stage 2 test, because stage 2 checks whether controls operate in practice. Examples include access reviews never performed, backups never restored, or vulnerability scans with no follow-up tickets. For each control in the Statement of Applicability, collect a dated record from the period before the audit, such as a review sign-off, a log extract, a ticket or a test result.
Open majors that cannot be closed in time
Under ISO/IEC 17021-1, if the certification body cannot verify corrections and corrective actions for every major nonconformity within 6 months after the last day of stage 2, it must conduct another stage 2 before recommending certification. Treat any major finding as a deadline with an owner, a root cause analysis and verification evidence. Plan the corrective action work so that verification can happen inside that window.
Significant changes between stages 1 and 2
The interval between stage 1 and stage 2 exists so the organization can resolve stage 1 concerns, and the certification body must judge whether the stage 1 result still holds after significant changes. A new cloud provider, a reorganized team, or a merged business unit can make the stage 1 review out of date. Log every change in that period, record its effect on scope and risk assessment, and tell the certification body early so it can decide whether stage 1 needs repeating.
What do buyers ask before stage 1 and stage 2?
How long must the gap between stage 1 and stage 2 be?
No maximum is set. ISO/IEC 17021-1 requires an interval between the two stages so the client can resolve the concerns raised in stage 1, but the certification body decides whether that interval is long enough. European Accreditation FAQ 49.3 (March 2025) says the body must judge whether the stage 1 result is still valid, especially after significant changes to the ISMS or the organization. Ask the body in writing how it will assess the gap, which stage 1 findings it expects you to close first, and whether it will need a repeat of stage 1 if your changes are large. Plan the interval around closing concerns, not around a calendar target.
Can a consultant prepare us without the certification body being involved?
Yes. Preparation is the organization's work, and an outside consultant or implementation partner can help build the ISMS, the Statement of Applicability, the risk treatment records and the evidence, without any involvement from the certification body. The audit itself stays separate. The body plans and conducts the audit, and only it issues the certificate. Keep the preparer independent of the audit decisions: the people who designed the controls should not also be the people who certify that they work. Confirm with the body what it accepts about pre-audit preparation and who may attend the audit.
Can a pre-audit replace stage 1?
No. A pre-audit is an optional review before stage 1 and cannot be used as the stage 1 audit. European Accreditation FAQ 48.11 (September 2024) records the IAF Technical Committee consensus that pre-audits before stage 1 are acceptable if impartiality is not compromised, but that they are not acceptable between stage 1 and stage 2. Stage 1 is the formal review of your documented ISMS and readiness for stage 2, and it produces documented conclusions the body must communicate to you. A pre-audit can help you find gaps early, but the certification body still has to run its own stage 1.
What must we provide during stage 2?
Stage 2 tests whether the ISMS is implemented and operating, so the organization must make people, records and systems available. Typically this includes:
- Staff and control owners who can explain their processes and show the evidence for their controls.
- Operational records such as access reviews, change logs, incident tickets, training records and supplier reviews.
- Read access to the systems that hold the evidence, such as logging, ticketing or configuration tools, with accounts set up in advance.
- Management review and internal audit records, and the register of nonconformities and corrective actions.
Agree the audit plan and the interviewees with the body beforehand. The exact sampling is decided by the auditor.
What happens if a major nonconformity is still open after stage 2?
The body must verify your corrections and corrective actions for every major nonconformity within 6 months after the last day of stage 2. If it cannot verify them in that window, it must conduct another stage 2 before it can recommend certification. European Accreditation FAQ 36.14 cites this rule from ISO/IEC 17021-1. Minor nonconformities follow a separate path, so check with the body how it will handle them. Treat the 6-month limit as a hard deadline in your plan, and schedule the corrective action work so the evidence exists and can be checked before it runs out.
Can we run the readiness work entirely in-house?
Yes, if your team has the capacity and the skills to run the performance evaluation activities, maintain the Statement of Applicability and collect evidence, and if the people doing that work are independent of the audit decisions. Many organizations split the work: internal staff own the controls and records, while an outside party reviews the ISMS and helps prepare the evidence. The main in-house risks are time, lack of an internal auditor who understands clause 9.2, and self-review blind spots. Estimate the internal effort with your own plan, and ask any outside partner for a written scope that lists what they deliver and what stays with your staff.
Do we have to show every clause and every Annex A control at stage 2?
Every clause from 4 to 10 is audited, because clause 1 of ISO/IEC 27001:2022 does not allow an organization claiming conformity to exclude any of them. The Annex A controls are handled differently: you decide which apply through risk treatment and record the decisions in the Statement of Applicability under clause 6.1.3. Auditors check that your selection follows from the risk assessment and that the controls you claim are implemented and working. Excluded controls need a reason in the Statement of Applicability, and the auditor will test that reason too.
How DeployOpen prepares systems and evidence for stage 1 and stage 2
DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, so the systems and records an auditor samples already exist and are current before stage 1. We prepare the evidence and the readiness material, while your organization owns its controls and an independent certification body performs both audit stages.
How we scope
- Engagements are fixed-scope, with the ISMS boundary, sites, systems and deliverables agreed in writing before work starts.
- We confirm which Statement of Applicability entries map to platforms we will build, and which remain with your teams.
- We agree the evidence list for performance evaluation records and the stage 1 document pack with you in advance.
How we build
- We configure the self-hosted platforms in your cloud accounts or data centers so that access, logging and backup records are produced automatically.
- We run internal audit and management review inputs as dated, reviewable records, so clauses 9.2 and 9.3 have real history behind them.
- We test the technical controls named in your Statement of Applicability and record the results, including gaps and the corrective actions raised.
How we hand over
- You receive documented procedures, configuration records and an evidence index that maps each control to where its proof is stored.
- We prepare a readiness walkthrough so your staff can explain each control and show its evidence during stage 2 sampling.
- Our written handover lists open nonconformity risks and corrective actions so you can close them within the interval before stage 2.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial scope is delivered.
- Support can cover evidence collection for surveillance audits, which must include continuing operational control, not only documents.
- Certification decisions, audit reports and certificates always come from your independent certification body, not from DeployOpen.
