What ISO directive requires surveillance audit?

Certification bodies for ISO 27001 Information Security Management Systems standard are required to be certified by an accreditation body against ISO/IEC 27006, and this standard defines surveillance audits as part of the certification process of an organization (section 9.6 Maintaining certification).

You can have an overview of this standard here: https://www.iso.org/obp/ui/#iso:std:iso-iec:27006:ed-3:v1:en

This article will provide you a further explanation about accreditation and certification:

• Accreditation vs. certification vs. registration in the ISO world https://advisera.com/articles/accreditation-vs-certification-vs-registration-in-the-iso-world/