ISO 27001 / 42001 certification validity with annual surveillance audits; SOC 2 Type II reports typically reissued annually
3 yrobserved
| Value kind | observed — Reported measurements, counts, and specifications keep the precision and scope stated by their source; an exact specification is not treated as a range. |
|---|---|
| Caveat | SOC 2 Type II observation windows typically run 3–12 months, with 3 months common for a first report; the AICPA sets no minimum period, and annual reissue is market practice, not an AICPA rule. |
| As of | 2026-10 |
| Source | ISO; AICPA · Certification-cycle discussion: ISO 42001 follows the same three-year cycle as ISO 27001, with surveillance at 12-month intervals |
| Review | checking…review by 2027-02-06 · slow cadence |
| Recorded changes | last 2026-10-19 · 2 revisions tracked |
| Claim id | iso-27001-42001-certification-validity-with |
Where the guide uses it
← Full numbers register — every date-stamped figure in the guide, with revision history.