ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
An ISO 27001 remote audit is no longer something your certification body has to get special permission for. The rule that forced certification bodies to ask their accreditation body for approval whenever remote work passed 30% of planned on-site audit time was deleted in ISO/IEC 27006-1:2024, and the transition to that edition closed on 31 March 2026. Every accredited ISMS certification body is now working to a rulebook that treats remote auditing as a normal planning choice.
That is good news for cost and calendar. It also carries a consequence most buyers do not see until the certificate arrives: if your organization has few or no physical relevant sites, the standard now requires the certification body to say so on the certificate itself. This guide covers what the rules permit, what they will not let an auditor do from a laptop, and how to prepare so a remote week does not cost you days you did not budget.
Free gap assessment
Where do you actually stand against ISO 27001?
Score every management system clause and all 93 Annex A controls, free, and get a prioritised gap list back.
Run the free ISO 27001 gap assessment → or View premium report sample
Two documents govern an ISO 27001 remote audit. The first is Global ACI-TECH-3-003 (M), the mandatory document on using information and communication technology (ICT) for conformity assessment. It is version 1.0, issued 10 July 2026 with an implementation date of 28 August 2026, and it is a reformatted version of IAF MD 4:2025 with no substantive change to the text. The International Accreditation Forum ceased operations on 1 January 2026 and its mandatory documents now sit with Global Accreditation Cooperation Incorporated, so an auditor still calling it “MD 4” means the same requirements under an old name.
The second is ISO/IEC 27006-1:2024, the accreditation standard for bodies that certify an ISMS. Its foreword states that the entire document was updated for remote audits and for organizations with “few or no physical relevant sites”. It cancels and replaces ISO/IEC 27006:2015 together with Amendment 1:2020.
Neither document makes remote auditing compulsory, and neither makes it a right. The scope statement in TECH-3-003 is precise: using ICT is optional, but once it forms part of the audit method, conforming to the document is mandatory. So your auditor cannot simply decide over email to do the week by video call. The method has to be planned, agreed and recorded.
ICT here is broader than a video call. The document lists electronic meeting systems with audio, video and data sharing; synchronous or asynchronous remote access to documents and records; recordings used as evidence; and visual access to remote or hazardous locations. Drones, wearables and artificial intelligence are named as examples in scope. A site walk-through over a phone camera is an ISO 27001 remote audit activity, with the same requirements attached as a full remote stage 2.
Under the old ISO/IEC 27006:2015 regime, a certification body that wanted remote activity to exceed 30% of the planned on-site audit time had to obtain approval from its accreditation body first. That step is gone. IAF MD 29:2024, the transition document for ISO/IEC 27006-1:2024, lists the removal of that approval requirement as one of the headline changes, alongside new requirements for deploying remote audits in clause 9.1.3.3.
Two other changes in the same list matter more to you than the deletion does:
The transition period ran two years from the last day of the month of publication, putting the deadline at 31 March 2026. Any accredited certificate issued after that date sits under these rules. If a certification body quotes you the 30% limit today, it is quoting a withdrawn requirement — a reasonable signal to check how current the rest of its process is. Our guide to choosing an ISO 27001 certification body covers the other questions worth asking before you sign.
Free ISO 27001 risk assessment
Which of your risks sit above your appetite line?
Set your own risk criteria, pick from 61 information security risk scenarios, rate likelihood and impact, and decide how to treat each one. You get a heat map, a process score and the findings an auditor would raise, free.
Run the free risk assessment → or View premium report sample
ISO/IEC 27001:2022 carries 93 Annex A controls across four themes: 37 organizational, 8 people, 14 physical and 34 technological. That split maps what travels well over a video link and what does not. The management clauses and most technological controls are evidence-based and screen-shareable. The physical theme is the problem in an ISO 27001 remote audit, and so is anything that depends on observing behaviour in a space.
| Audit activity | Remote feasibility | Why |
|---|---|---|
| Stage 1 documentation review, scope and Statement of Applicability | High | Document-based; the SoA is mandatory under clause 6.1.3 and reads the same on screen as on paper |
| Risk assessment, risk treatment plan, management review, internal audit records | High | Records and interviews; no physical observation needed |
| Technological controls (A.8) — access rights, logging, configuration, backup, vulnerability management | High | Screen-shared consoles and live system demonstrations are direct evidence |
| People controls (A.6) — screening, awareness, disciplinary process, remote working | High | Interview and record-based; video interviews are an accepted method |
| Physical controls (A.7) — secure areas, entry controls, equipment siting, clear desk, media handling | Low to moderate | Needs observation of a real space; a camera tour is possible but the auditor controls neither the framing nor what is out of shot |
| Data centre, server room or production floor inspection | Low | Processes executed in a physical environment cannot be treated as a virtual site |
| Culture, housekeeping and the unscheduled observation an auditor makes walking a corridor | Low | No remote equivalent exists |
ISO/IEC TS 17012:2024, published on 9 July 2024 as guidelines for the use of remote auditing methods, puts the principle bluntly: remote methods are not intended to replace on-site methods, they are a tool for conducting the audit effectively and efficiently. Read that as the honest ceiling on an ISO 27001 remote audit. A company whose only office is a cloud tenancy can realistically be audited end to end from a distance. A company with a warehouse, a lab or a manufacturing line cannot, and should not expect to be.
TECH-3-003 defines a virtual site as an online environment where people execute processes regardless of physical location. Two notes attached to that definition do the real work. The first says a virtual site cannot be claimed where processes must be executed in a physical environment, and it names warehousing, manufacturing, physical testing laboratories, and installation or repair of physical products. The second says a virtual site counts as a single site for calculating conformity assessment time.
That second note is worth money to a distributed company. A 60-person software business with staff in nine countries and no office is one site, not nine. It does not fall into site sampling and it does not attract the per-site uplift a genuine multi-site structure does — see our guide to ISO 27001 multi-site certification for how sampling works when you really do have physical locations. Where virtual sites sit inside your certified scope, clause 4.2.7 requires the audit documentation to say so and to identify what is performed there.
This is the part that surprises people. For a client with few or no physical relevant sites, ISO/IEC 27006-1:2024 requires the certification document — the certificate you send to customers — to state that the client’s activities are conducted remotely. It is not a penalty and it is not a lesser certificate. It is a transparency requirement, in force for accredited bodies since the 31 March 2026 transition deadline.
Plan for two downstream effects. First, procurement teams will see that line and some will ask about it, so prepare a one-paragraph answer explaining your operating model and how physical controls are discharged — typically through cloud provider assurance and a documented home-working control set. Second, the audit report separately records the extent of remote working and how effective it was, under clause 9.4.3.2. If your evidence was slow to produce or your screen shares failed, that assessment is written down, and it shapes how the next surveillance visit is planned.
TECH-3-003 puts specific obligations on the certification body, not on you. Knowing them tells you whether the body you hired is running an ISO 27001 remote audit properly.
| Clause | What the certification body must do |
|---|---|
| 4.1.1 | Ensure security, confidentiality and individual privacy for all electronically transmitted information |
| 4.1.2 | Reach mutual agreement with you on the use of ICT, in line with information security and data protection rules, before any ICT is used |
| 4.1.3 and 4.1.4 | Fall back to other methods if those measures are not met or no agreement is reached |
| 4.2.1 | Identify and document the risks and opportunities of using ICT, including the choice of technology, and how they are managed |
| 4.2.2 | Check during application review that every party has the infrastructure to support the proposed ICT |
| 4.2.3 | State in the audit plan how ICT will be used and to what extent |
| 4.2.4 | Use team members competent in the technology, and aware of how it affects the validity and objectivity of evidence |
| 4.2.6 | Record in the report how far ICT was used and how effective it was |
Clause 4.1.2 is your leverage. An ISO 27001 remote audit requires your agreement, and that agreement is supposed to be reached against your own information security and data protection requirements. If a proposed tool, recording practice or screen-sharing arrangement conflicts with your controls, saying no is contemplated by the document: the certification body then has to use another method to meet the audit objectives.
An ISO 27001 remote audit fails differently from an on-site week. Nobody can hand the auditor a folder, so every delay is visible and every gap is logged in writing. Six things make the difference:
Travel and expenses, yes — often materially, and those are usually billed separately from audit days. Audit days themselves, no. Clause 4.2.5 of TECH-3-003 is explicit that using ICT contributes to the total conformity assessment time, because additional planning may be needed and that can affect duration. The document deliberately does not cap the effect in either direction.
Treat remote delivery as a travel-cost saving and a calendar convenience, not a discount on effort. Audit days are still calculated from your effective number of persons and scope complexity under Annex C of ISO/IEC 27006-1:2024, where an audit day is 8 hours of auditor time excluding travel. To sanity-check the number your certification body quoted, our breakdown of ISO 27001 audit days shows how the calculation is built and where most online calculators get it wrong.
Yes, if your operating model justifies it. There is no longer a percentage ceiling requiring accreditation body approval, and ISO/IEC 27006-1:2024 was written with organizations that have few or no physical relevant sites in mind. The limit is evidence, not permission: where a control can only be verified by observing a physical environment, the auditor needs to be there. A cloud-native company with no office can realistically complete stage 2 remotely; one with a warehouse cannot.
It carries the same accredited status. What differs is disclosure — where the client has few or no physical relevant sites, the certificate must state that activities are conducted remotely. Prepare a short explanation for customers who ask, covering how your physical and environmental controls are satisfied without premises of your own.
Yes. Using ICT is not mandatory and requires mutual agreement under clause 4.1.2 of TECH-3-003. If no agreement is reached, the certification body must use other methods to meet the audit objectives. The reverse is also true: you cannot compel a body to run an ISO 27001 remote audit if it judges the evidence cannot be obtained that way.
Yes. The ICT rules apply across conformity assessment activities, so an ISO 27001 remote audit at surveillance or recertification carries the same agreement, planning and reporting obligations. The extent of remote work is assessed in every audit report, so a hybrid pattern can shift between visits.
Global ACI-TECH-3-003 binds certification and accreditation bodies, not you. But ISO/IEC TS 17012:2024 and ISO 19011 give the same guidance for internal audits, and your auditor will look at how your internal audit programme handles remote evidence. Mirroring the external approach — planned ICT use, agreed tools, recorded extent — is the simple answer.
Whether your audit happens over a video call or in a meeting room, the evidence is the same evidence. An ISO 27001 remote audit only makes the state of your documentation more visible, because there is no folder to hand over and no corridor conversation to fill a gap. Getting the mandatory documents, the Statement of Applicability and the records behind your controls into one indexed, linkable set is the preparation step that pays off in either format.
Our ISO 27001 Toolkit provides 165 templates mapped to ISO/IEC 27001:2022, covering every mandatory document plus the policies and records behind all 93 Annex A controls, in editable Microsoft Office format. It is $99 as a one-off purchase and it is built to be tailored rather than filled in from scratch — which is exactly what an auditor wants to see on a shared screen. You can also read the standard’s own scope and status on the ISO catalogue page for ISO/IEC 27001:2022.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026