I’ve taken organisations through ISO 27001 certification and HMG accreditation processes for the better part of two decades, and the most common mistake isn’t technical — it’s treating the certificate or accreditation letter as the finish line rather than a waypoint.
An accreditation is a snapshot: it confirms that, on the day of assessment, your controls met the standard. It says nothing about whether they still will in six months, once new services have been added, staff have changed, and the risk register hasn’t been touched since the audit.
Continuous assurance means building the habits that keep the evidence current — regular internal review of the ISMS, vulnerability scanning that actually gets acted on, and a risk assessment process that’s revisited when the environment changes, not just when the next audit is scheduled.
This matters more, not less, once you’re operating in the cloud. Infrastructure that changes through a pipeline rather than a change board can drift from its accredited state in hours, not years — which is exactly why the automation and security architecture work have to be designed together, not treated as separate disciplines.
The organisations that get the most value from accreditation are the ones that use it as a forcing function to build a genuinely operating security management system, not as a project with a defined end date. That’s the difference between compliance as theatre and compliance as a working control.