There is no globally fixed look-back period for ISO 27001 audits. How far back an auditor goes depends on your own retention rules, legal and contractual requirements, and the auditor’s approach. That said, there are common patterns.
Typical look-back ranges by evidence type
In practice, many auditors work within these ranges, then go further back if they see risk or inconsistencies:
- Operational controls (logs, tickets, monitoring, backups, access reviews): Often the last 3 to 12 months to confirm the ISMS is actively operating and controls are sustainable.
- Internal audits and management reviews: Typically 1 to 3 years, because these are periodic and show your ISMS cycle over time.
- Risk assessment & risk treatment plan: Current versions plus previous iterations, often covering 1 to 3 years, to show that risks are reviewed and updated.
- Training and awareness records: Commonly 1 to 3 years to demonstrate ongoing competency, including onboarding and periodic refreshers.
- Incident & problem handling records: At least the last 12 months, and sometimes further (2–3 years) if there were major incidents, recurring issues, or complex root causes.
- Change management & configuration control: Usually the last 12 months of changes, but key system or policy changes may be traced several years back, especially in long-lifecycle plants.
What actually constrains the look-back period
How far back an ISO 27001 auditor can realistically go is driven by:
- Your documented retention rules: If your policy and risk assessment justify 12 months of log retention and that is implemented and validated, auditors normally align to that. If you keep more, they may use it.
- Legal, regulatory, and contractual obligations: Export controls, defense contracts, and sector-specific privacy/security rules may require multi-year retention. Auditors may expect your evidence retention to reflect those obligations.
- Certification cycle and surveillance history: On a recertification (3-year cycle), auditors may look further back than on a first surveillance visit to see how issues have evolved.
- Nonconformities and incidents: For serious findings, they may ask for several years of related records to understand recurrence and effectiveness of corrective actions.
Typical patterns in regulated industrial environments
In regulated, long-lifecycle manufacturing environments, auditors often expect:
- Multi-year traceability for key assets and systems: Access control, change history, and incident records for critical OT/IT systems may be expected for 3+ years, sometimes much longer, even if ISO 27001 itself does not fix a period.
- Alignment with existing quality and document control practices: If your QMS retains production and quality records for 5–10 years, auditors may challenge very short security-related retention for the same systems unless clearly risk-justified.
- Evidence across system transitions: When you replace or upgrade MES, historians, log platforms, or ticketing tools, auditors may still ask to see older evidence from legacy systems to cover the full period since the last audit or major incident.
Brownfield and legacy system considerations
In brownfield environments with mixed vendors and legacy systems, the main issues are usually:
- Incomplete historical logs: Older PLCs, HMIs, or proprietary control systems may not support long-term logging. Auditors will expect this limitation to be known, risk-assessed, and mitigated (e.g., central log collection, network monitoring, physical controls).
- System replacements and migrations: If SIEM, ticketing, or GRC tools changed in the last 1–3 years, you must show how historical records were preserved, migrated, or decommissioned under change control, or justify any gaps.
- Validation and change control: For GxP or aerospace-grade contexts, aggressive system replacement to “improve retention” can backfire because of validation overhead, downtime risk, and integration complexity. Auditors will focus on whether your current approach is documented, risk-based, and consistently followed, not on having the newest tooling.
Practical planning guidance
To avoid surprises during ISO 27001 audits in an industrial setting:
- Define retention periods for logs, tickets, access reviews, and key records in policy and tie them explicitly to risk assessments and any external obligations.
- Ensure your monitoring, logging, and document control systems can actually meet those retention periods, given storage and performance constraints.
- During system changes or decommissioning, include data retention, export, or archival as part of the change plan, and document any loss of historic data with a risk-based rationale.
- For management reviews, internal audits, risk assessments, and major incidents, aim to keep at least 3 years of records in practice, unless strong reasons exist not to.
In summary, auditors often focus on the most recent 3–12 months to confirm that the ISMS is functioning, but may look back 1–3 years or more for governance activities, major changes, and incidents. The definitive limit is whatever you have justified in your risk assessment and retention policies and can demonstrate in your existing systems.