No. Once you are certified, your audit programme can split the standard across the three years of the certificate cycle.
A common split for a small company:
- Every year: clauses 4 to 10, the management system requirements such as risk assessment, objectives, internal audit and management review.
- Year by year: a third of the applicable Annex A controls, for example the organisational controls in one year, the technological controls in the next, and the people and physical controls in the third.
Good programmes adjust the split for risk and change. A company that moved to a new cloud provider this year should audit its cloud and access controls this year, whatever the original plan said. Last year's findings belong in every audit, to confirm they stayed closed.
By recertification, every clause and every applicable control has to have been audited at least once. The surveillance auditor reads the programme to check that the plan adds up, so write the split down in it.