Can an ISO 27001 audit be done remotely?
Certification bodies can conduct parts of an ISO 27001 audit remotely, under the ICT rules in Global ACI-TECH-3-003 and ISO/IEC 27006-1:2024, but the audit report must state how far remote methods were used and how effective they were. If a customer or contract asks for certification while your team is distributed or your physical footprint is small, that disclosure is the first thing to understand, because it will appear in the report and can shape how your customers read the result. The answer depends on your sites, the activities being tested and the auditor's documented justification for each method. ISO does not certify organizations, so only the accredited certification body decides the audit method, and it must record its reasoning. DeployOpen prepares systems, controls and evidence so that either approach is workable, but it does not issue audit reports or certificates.
Start by mapping where information is actually processed. Cloud platforms, hosted tools and remote endpoints are easier to evidence remotely than a server room or a restricted secure area, which generally still needs direct observation. Ask your certification body in writing which clauses and Annex A controls it proposes to test remotely, what tools it will use for screen sharing or document review, and how it will confirm the evidence is genuine. Also ask whether the certificate and report will carry the statement that activities are conducted remotely, which ISO/IEC 27006-1:2024 requires for clients with few or no relevant physical sites. Your team should confirm that remote sessions, record retention and access to systems are covered by an agreed plan before the audit date.
Plan for the limits of remote work. Under ISO/IEC 17021-1, every surveillance audit must include continuing operational control, so it cannot be limited to reviewing documents and records of the management system. A.6.7 Remote working also means your own controls for staff working outside the office must be running and evidenced, since the auditor will test them. Expect the certification body to ask for more evidence than an on-site visit would produce, such as logs, device records and recorded reviews. Budget internal time for those requests, and confirm with the certification body how remote auditing will affect the audit time it calculates for your organization.
Which audit activities can be remote and which need a visit
This table compares common ISO 27001 audit activities and the conditions under which a remote method fits or an on-site check is the safer choice. Read each row as a question the certification body must answer for your organization, because the body decides case by case and must record its reasoning. The main takeaway is that remote methods suit documents and interviews far better than physical controls and sampling of work locations.
| Audit activity | When remote methods fit | When an on-site check is the safer choice |
|---|---|---|
| Document and policy review | Policies, the Statement of Applicability, risk registers and procedures are version-controlled and can be shared securely with the auditor | Records exist only on paper or in a controlled room, or the auditor cannot confirm that the files shown are the controlled versions |
| Interviews with staff and managers | Roles are clearly defined, participants can connect reliably and the auditor can confirm who is speaking | Interviews touch on sensitive operations, or the auditor needs to see how people actually handle information at their workstations |
| Records review and evidence sampling | Logs, tickets, training records and access reviews are exported from systems the auditor can trust, with the export method recorded | Records can be altered, the auditor cannot verify their completeness, or the system holding them is only reachable inside a secured site |
| Observation of operational controls | Screen sharing or a live system demonstration shows the control working and the auditor can ask follow-up questions | The control depends on physical handling, such as change windows, backup restores or hardware checks that need to be watched in person |
| Physical security checks | Rarely a good fit; photos or video may support a desk review but usually cannot replace inspection of entry points, secure areas and equipment storage | Access control, cabling, visitor handling, secure areas and environmental safeguards need to be inspected in person at each relevant location |
| Sampling of remote working | Remote workstations, VPN configuration and device management can be checked through the organization's central tools and session evidence | The auditor needs to assess a home or field setup directly, or the organization cannot show central evidence for remote devices |
| Review of multi-site or third-party locations | Sites with few or no physical operations may be covered remotely, with the certificate and report stating that activities are conducted remotely | Sites with physical processing, hosting or staff presence need a visit to confirm the controls operate where the work happens |
What Global ACI-TECH-3-003 and ISO/IEC 27006-1:2024 require
Remote auditing is governed by two layers of rules: the Global ACI document on the use of ICT in conformity assessment, and the ISO/IEC 27006-1:2024 requirements that accredited certification bodies must apply to ISO 27001 clients. Global ACI-TECH-3-003 governs the use of information and communication technology, including remote auditing, in certification audits, and it is implemented from 28 August 2026. ISO/IEC 27006-1:2024 added its own remote audit requirements on top of that, so a certification body cannot treat remote work as a informal convenience. It has to follow a documented method for deciding when remote techniques are used and how they are checked.
ISO/IEC 27006-1:2024 also changes what the paperwork says. The audit report must state how far remote auditing was used and how effective it was, so the report cannot simply be silent on the method. For a client with few or no relevant physical sites, the certificate and the audit report must state that its activities are conducted remotely. A customer reading that certificate will see the remote nature of the operation, which matters if the customer expected a site visit. Before you accept a remote-only plan, ask the certification body to show you where the remote-audit wording appears in your draft report and certificate.
The Global ACI document and the ISO/IEC 27006-1:2024 text are not the whole picture for your certification body, because the rules apply through its accreditation. Ask the certification body for its current ICT procedure, confirm the version it applies, and check that this version matches the accreditation scope it holds. Ask which ISO/IEC 27001 activities it considers suitable for remote audit, how it verifies the information it receives remotely, and what it does if the remote evidence is insufficient. Get those answers in writing before stage 1 is scheduled.
How remote auditing differs by client situation
An organization whose staff, systems and data sit entirely in cloud accounts or with providers, and that has no office or data center in scope, is the case where remote auditing reaches furthest. The certification body can review most of the management system through secure screen sharing, document exchange and interviews. Because the client has few or no relevant physical sites, the certificate and audit report must state that the activities are conducted remotely.
- Testable remotely: policies, the risk assessment, the Statement of Applicability, access reviews, and logs and configurations pulled from cloud consoles.
- Still needs live evidence: surveillance audits must include continuing operational control, so the auditor will look at current configurations and records, not only documents.
- Remote working: control A.6.7 Remote working applies to where staff work, so the auditor will test how endpoints, home networks and remote access are secured.
- Report wording: the audit report must state how far remote auditing was used and how effective it was.
Ask the certification body in writing which evidence it will review live, and how it will record the extent of remote auditing before stage 1 is scheduled.
An organization with a few offices and a distributed workforce sits between the two extremes. Policy, governance and most technical controls can be reviewed remotely, but the physical controls at each office usually need a visit or a live walkthrough that the certification body has accepted in advance. The auditor decides which locations are visited, based on the risk and the scope, and the report records which sites were covered in person.
- Testable remotely: policies, HR records for screening and training, supplier reviews, incident and change records, and most technical configurations.
- Needs a visit: office perimeter, reception and visitor handling, secure areas and equipment storage at each location, unless the body accepts a video tour it has approved.
- Remote staff: the auditor samples device management and remote access for people working from home or travelling, as A.6.7 Remote working requires.
- Counting people: on-site audit time is generally based on everyone doing work under the organization's control, wherever they are located, so remote staff still count toward the total.
- Report wording: the audit report states the extent and effectiveness of remote auditing and identifies the sites that were visited.
Ask for a site-by-site plan that shows which locations will be visited and which controls will be sampled remotely.
An organization that runs data centers, plants or other critical operational sites has the most physical controls in scope. Environmental protection, power, cooling, entry control and equipment handling are tested by looking at the place itself. Remote methods can support the audit, and the certification body decides how much they can carry. Technical controls on hosted infrastructure are often sampled remotely, which reduces the time spent on site without removing the need for it.
- Usually needs a visit: perimeter, entry and access points, secure areas, environmental supports such as power and cooling, and the disposal of storage media.
- Testable remotely: monitoring and alarm configurations, access lists, change tickets, backup and recovery records, and logs, subject to the body's method for using ICT.
- Operational exercises: continuity and incident exercises can be observed live or reviewed as records, depending on what the body accepts.
- Certificate scope: each physical site is named in the scope, and a remote review of one site generally does not stand in for an on-site review of another.
- Report wording: the report states which sites or controls were covered remotely and how effective the remote method proved to be.
Ask the certification body which controls it will verify on site, which live remote evidence it will accept, and how it records that choice in the report.
Where remote audits get challenged or delayed
Remote audit time is rarely refused outright. Most delays come from a handful of gaps: surveillance audits that rely on paper, tools the auditor cannot reach, unclear remote working evidence, scope that hides sites, and controls the auditor cannot see operating. Each card names the gap and the check to run before the auditor arrives.
Documents alone for surveillance
A surveillance audit must include continuing operational control, not only a review of the management system documents and records. European Accreditation FAQ 44.2 cites clause 9.6.2.2 of ISO/IEC 17021-1 for this point. Before the audit, prepare live walkthroughs of access reviews, change approvals and incident handling so the auditor can see controls running, not just read about them.
Unclear ICT tools and access
Remote audits depend on the auditor reaching the right systems, screens and people. Agree in writing with the certification body which video platform, document sharing and read-only system access will be used, and who will host each session. Test the access with the auditor in advance so that time on the day is spent on evidence, not on connection problems.
Missing A.6.7 remote working evidence
Control A.6.7 Remote working asks the organization to show security measures for information accessed, processed or stored outside its premises. Auditors will ask for the policy, device management records, VPN or zero trust access logs and the rules for home networks. If staff work remotely and these records are missing, expect a finding or a request for more evidence before the audit closes.
Scope that hides relevant sites
A remote-only certificate is only appropriate when the client has few or no relevant physical sites. If a hosting location, office or support center is inside the ISMS but left out of the scope statement, the auditor may treat the scope as misleading. Review the clause 4.3 scope against the asset inventory and data flows, and confirm with the certification body which sites require an on-site visit.
Operational controls the auditor cannot test
Some controls need physical presence or direct observation, such as data center access, equipment disposal or secure areas. A remote audit that cannot observe these controls may be extended or require a site visit. Map each Annex A control to how it will be shown, then flag any control that needs a camera walkthrough, a site visit or a sample taken on site, and agree that approach before stage 2.
How to prepare for a remote audit, step by step
This sequence takes a remote ISO 27001 audit from an agreed method with the certification body to a documented record of how much of the audit ran remotely and how well it worked. Each step closes with an artifact the team can show the auditor and keep for its own records.
Agree the audit method with the certification body
Before any audit planning starts, the compliance lead asks the certification body in writing which parts it will perform remotely, which need a site visit, and which ICT tools it uses. Under Global ACI-TECH-3-003, the use of ICT in certification audits must be justified and agreed, so the body should state its approach early. The step is done when the team holds a written statement of the agreed method, including any sessions the body has ruled out for remote delivery.
Confirm the ICT platform and access
The IT or platform engineering lead selects the video conferencing and file-sharing tools the certification body accepts, then runs a test session with the auditor's team using the same accounts, browsers and network paths planned for the audit. The team checks screen sharing, document access, read-only system views and any evidence the auditor must see live, and records who can grant access and how it is revoked. The step closes with a tested setup and a short access log that names each account and its purpose.
Build the evidence index in advance
The compliance lead and control owners prepare an evidence index that maps each clause and Annex A control in scope to the document, log extract, configuration export or record that supports it. Each entry names the owner, the date range covered and the storage location, and sensitive material is redacted or provided through controlled access rather than general email. The index is complete when every in-scope item has an entry and no entry points to a file the team cannot produce on request.
Share evidence and agree the audit plan
The team sends the evidence index and supporting files to the auditor through the agreed channel, then the lead and the auditor agree a session schedule that shows which topics are covered remotely and which are tied to a site or system walkthrough. The schedule states the time each control owner is expected and how the auditor will request additional samples. The step is done when the auditor has confirmed receipt of the index and the audit plan is accepted in writing.
Run remote sessions with live system evidence
Control owners attend their sessions with the tested setup, showing live configurations, access reviews, logs and monitoring dashboards where the auditor asks for them. The auditor must still assess continuing operational control, so the team should expect questions on how processes operate day to day, not only on documents. A named coordinator tracks requests raised during each session and logs each one with a due point in the plan. The step closes when every planned session has run or has been rescheduled in writing.
Handle connection failures and sample requests
When a connection drops, a file cannot be opened or an auditor asks for an unplanned sample, the coordinator records the event, the time it affected and the workaround agreed with the auditor. Where a session cannot be completed remotely, the team asks the certification body whether it will reschedule, extend the remote session or add an on-site element. The output is a running issues log that the team can later use to explain how remote auditing affected the audit.
Record the extent and effectiveness of remote use
After the audit, the compliance lead asks the certification body to show, in its audit report, how far remote auditing was used and how effective it was, as ISO/IEC 27006-1:2024 requires. The team reviews the issues log and the session record against the report and confirms the figures match what happened. The step is done when the organization holds the signed report, the agreed audit method and the issues log together in its audit file.
Who owns the remote audit evidence
The organization remains the owner of its information security management system. Its own staff decide the scope, the risk treatment choices, the Statement of Applicability and the policies, and they run the controls day to day. When an auditor reviews remote work, a cloud configuration or a supplier record, the organization is the party that must be able to explain it, show it working and produce the records behind it.
- Controls and decisions: Management sets the scope, accepts risks and signs the Statement of Applicability.
- Operational records: Access reviews, change approvals, training completions and incident tickets are created by the team doing the work, as they happen.
- Staff availability: Named people must be ready to join video sessions, walk the auditor through systems and answer questions about their own duties.
- Remote working evidence: The organization shows how security applies to personnel working outside its premises, which links to Annex A control A.6.7.
- Conflict checks: Staff confirm that they have no conflicts with the auditor they meet.
Before accepting a remote method, ask the certification body in writing which evidence it will sample and how it will view live operation.
An implementation partner such as DeployOpen can prepare the systems, access paths and evidence that a remote audit will examine. Its work sits inside the organization's own cloud accounts, data centers or networks, and it should be documented so the organization can run it without the partner. The partner does not decide the audit method, does not sample records for the auditor and does not issue any finding.
- System preparation: Configure logging, access controls and backups in the organization's environment so that records can be exported and shown.
- Evidence packaging: Organize screenshots, exports and configuration files into a repository that the organization controls.
- Access for the auditor: Set up read-only, time-limited accounts or screen-sharing arrangements only if the certification body has agreed the method.
- Documentation and training: Write runbooks and brief the organization's staff on what the auditor is likely to ask.
- Independence boundary: The partner must not perform the certification audit, select the sample, or act as the auditor's assessor on the same engagement.
Ask the partner to state in its written scope which deliverables are evidence preparation and which, if any, would fall on the auditor's side of the line.
The certification body is the only party that decides whether an audit can be conducted remotely and issues the audit report and certificate. Under ISO/IEC 27006-1:2024 and the Global ACI rules on the use of ICT in conformity assessment, the body must plan how remote methods will be used, justify them and report in the audit report how far remote auditing was used and how effective it was. The body is accountable for the audit conclusions, not the organization or its partner.
- Method decision: The body decides which activities can be done remotely and which need a site visit.
- Sampling and testing: The auditor chooses samples, observes live operation and tests whether controls work.
- Reporting: The audit report states the extent and effectiveness of remote auditing, and the certificate records remote operation where the rules require it.
- Impartiality: The body must avoid conflicts of interest, including consultancy by the same firm in the same scope.
- Accreditation: Verify that the body is accredited for ISMS certification, using IAF CertSearch.
Before engaging a body, ask for its written policy on remote audits and confirm how it applies Global ACI-TECH-3-003 to your environment.
What must be ready before the remote audit starts
A remote ISO 27001 audit only works when the certification body, the auditor and the organization agree on the method before the first session. The six items below are what needs to be settled, and each one can be checked with a named person before the audit window opens.
Confirmed audit method and ICT plan
Ask the certification body in writing which parts of the audit will be remote, which tools will carry video, document sharing and screen sharing, and how the auditor will verify identity. Under Global ACI-TECH-3-003, the use of ICT in certification audits must be planned and justified, so the plan should name each session, its purpose and the fallback if a link fails. Check that the plan matches the stage 1 or surveillance scope you agreed.
Access to records and systems
Before the first session, confirm which folders, ticketing exports, logs and admin consoles the auditor will see, and who will open them. Test read-only access with a named account, not a shared administrator login, and check that the auditor can view evidence without changing it. Records that sit behind a single person's laptop are a common cause of lost audit time.
Current scope statement and site list
Prepare the clause 4.3 scope statement and a list of every location, hosted environment and remote workplace inside it. For organizations with few or no physical sites, the certificate and audit report must say that activities are conducted remotely, so the list should state that clearly. Check that the Statement of Applicability refers to the same scope, since an auditor will compare the two first.
Evidence of remote working controls
Gather the evidence for the Annex A control A.6.7 Remote working: the policy, device management settings, VPN or zero-trust access records, and the approval trail for staff who work outside the premises. Confirm that the evidence covers the people who actually work remotely, because the auditor will sample from the staff list rather than the policy. Gaps here often lead to a nonconformity that could have been avoided.
Operational controls shown live
Remote audits depend on the auditor seeing controls operate, not only reading about them. Prepare a short demonstration for each key control, such as an access review, a backup restore log or a change approval, and rehearse it on a screen the auditor can see. Confirm that the recording or live view meets the continuing operational control expected in surveillance audits, since a document-only review is not enough.
Named technical contact
Name one person on the organization side who can fix connection problems, share a file or reopen a session during the audit days, and agree how that person is reached if the main line fails. Give the auditor a second contact and a written fallback, such as a call-in number, for the case where video drops during a closing meeting. Ask the certification body how it records interruptions, because they affect the report's statement of how far remote auditing was used.
Questions buyers ask about remote ISO 27001 audits
Can an ISO 27001 stage 2 audit be fully remote?
A stage 2 audit can include remote methods, but whether it can be fully remote depends on the certification body's justification and the organization's setup. The auditor must test whether the management system works in practice, and that includes continuing operational control at the places where information is processed. The Global ACI document on the use of ICT for conformity assessment governs remote methods in certification audits, and ISO/IEC 27006-1:2024 requires the body to justify the choice. Ask the certification body, before contracting, which parts of stage 2 it proposes to run remotely, what it needs from you to do so, and what would trigger an on-site visit. Expect it to refuse remote methods where it cannot observe controls or sample evidence with confidence.
Can ISO 27001 surveillance audits be done remotely?
Surveillance audits can use remote methods in part, but they cannot be limited to reviewing documents. Under the European Accreditation guidance on surveillance audits, each one must include continuing operational control, which is the auditor's check that controls work as designed in day-to-day operations. A surveillance audit built only from policies, records and a file share does not meet that expectation. The practical question is how the body will observe live controls, such as access reviews, change records, incident handling or backup restores, from a distance. Confirm with your certification body which sampled controls it will observe in real time, whether it needs screen sharing or system access, and how it will record the extent of remote work in its report.
What must an ISO 27001 certificate say when the organization has no physical sites?
When a client has few or no relevant physical sites, ISO/IEC 27006-1:2024 requires the certificate and the audit report to state that its activities are conducted remotely. This matters for customers who check certificates in IAF CertSearch and read the scope and wording closely. The scope in clause 4.3 must still describe the services, systems and locations actually covered, including cloud regions or contractor-operated environments where relevant. Ask the certification body to show you draft certificate wording before the audit, and check that the scope does not imply a physical office that does not exist. Also confirm how the wording will be handled if you add a site later.
What does an ISO 27001 audit report have to disclose about remote auditing?
The audit report must state how far remote auditing was used and how effective it was. ISO/IEC 27006-1:2024 added this requirement alongside its remote audit provisions, and IAF MD 29:2024 records it as a transition expectation. In practice, expect the report to list which activities took place remotely, which took place on site, what technology was used, and whether the auditor judged the remote methods adequate for the evidence reviewed. Read this section before accepting the report, because a customer or regulator may ask why certain controls were not observed in person. If a remote method turned out to be weak, the report should say so, and the auditor may require an on-site visit to close the gap.
Does a remote ISO 27001 audit cost less?
A remote audit can reduce travel and some on-site time, but it does not reduce the audit scope, and the certification body still prices the work it must perform. Audit time under ISO/IEC 27006-1 is driven mainly by the number of people doing work under the organization's control, the complexity of the scope, the number of sites and the risk profile. Remote methods may change how that time is spent, not the total the auditor needs to justify. Ask the certification body for a quote that separates on-site days, remote days and any travel expenses, and ask how remote time is counted. Also ask whether any remote work will be followed by an on-site visit, because that would add cost. Your own costs for screen-sharing setup and staff time during the audit also belong in the comparison.
How long does it take to prepare for a remote ISO 27001 audit?
Preparation time depends mainly on how mature the management system already is and how many systems you must demonstrate live. Preparing for a remote audit adds work beyond the usual audit readiness: you need evidence that can be shared securely, system walkthroughs that work over video, a named person who can operate tools during the audit, and a clear map of where each control is run. Organizations that already keep evidence in centralized, access-controlled tools usually have less to arrange than those relying on screenshots and email. No timeline is fixed by the standard, so ask your certification body what it needs from you and when, and agree that schedule in writing before the audit is booked.
What does the team need to provide for a remote ISO 27001 audit?
The team needs to provide secure access to evidence, reliable video and screen sharing, and people who can demonstrate controls live. Typical requirements include:
- A secure document portal or read-only access to records, with an agreed method for handling personal data in those records.
- Read-only access or live walkthroughs for systems such as identity, logging, change management and backup consoles.
- A named contact who can arrange interviews, retrieve evidence quickly and explain where each control is performed.
- A list of any locations, cloud regions or contractors the auditor will not reach remotely, so the body can decide whether on-site work is needed.
Confirm the tools the certification body accepts, its information security rules for remote access, and what it will record. Also confirm your own obligations for staff working remotely under the control on remote working, which applies to your people even when the audit itself is remote.
Can we run a remote ISO 27001 audit without outside help?
Yes, the organization can prepare its own systems and evidence for a remote audit, but it cannot have the same person prepare and judge the result. An implementation partner can help set up secure evidence access, build demonstration environments, and rehearse walkthroughs, but it cannot issue the audit report or the certificate. Only the independent certification body does that. Keep the roles separate in your contracts: you own the controls, the partner prepares systems and evidence, and the certification body audits. Ask any partner to confirm it has no role in the auditor's decisions and that it will not sign off the readiness of the organization in the body's place.
How DeployOpen prepares systems and evidence for a remote audit
Certification bodies decide how much of an ISO 27001 audit can run remotely, and they must report how far remote methods were used. DeployOpen prepares the self-hosted systems, controls and evidence so that whatever the certification body accepts remotely can be shown clearly, while the organization keeps ownership of its controls.
How we scope
- Agree in writing which systems, sites and people fall inside the ISMS scope before work starts
- Map which evidence the certification body can review remotely and which items may need an on-site or live check
- Confirm with the certification body in advance how it will run remote audit sessions and what it needs to see
How we build
- Deploy and configure self-hosted open-source platforms inside the client's own cloud, data center or air-gapped network
- Set up logging, access records and change history so operational control can be demonstrated during a remote session
- Arrange screen-shareable dashboards and exportable records for the controls that the agreed scope relies on
How we hand over
- Document each system, control owner and evidence source in a handover pack the organization can keep
- Record which evidence was produced remotely, so the organization can state the extent of remote auditing in its planning
- Provide a walkthrough of remote access paths, data locations and known limits the auditor may ask about
How we support
- Offer ongoing support, upgrades and continuous testing through a retainer after the audit
- Help prepare responses when the certification body asks for evidence during surveillance audits
- Confirm with the organization's auditor and certification body which evidence and methods they accept before each audit cycle
