How Long Does ISO 27001 Certification Take? A Realistic Timeline
Cybergen InsightsCREST-certified security team
|
|
9 min read
A customer has asked for your ISO 27001 certificate, a tender closes in six months, or the board wants a date it can plan around. Whatever the trigger, the question is the same: how long will this take?
Most organisations take between three and twelve months to go from first planning to an issued certificate. That is a wide range, and where you land in it depends on things you can largely control. This article sets out a realistic timeline phase by phase, explains what speeds a project up and what slows it down, and shows how to plan backwards from a deadline. If you already have a date in mind, our ISO 27001 certification team can tell you whether it is achievable.
The Short Answer
Independent guidance is consistent. UK focused analysis puts most certifications at three to nine months from planning to certificate, and broader industry guidance puts the range at three to twelve months. Small organisations with good existing controls sit at the short end. Larger organisations, multi-site scopes and those starting with little documentation sit at the long end.
The audits themselves are short. What takes the time is building an information security management system that works and generating the evidence to prove it. That is good news, because it means the timeline is mostly in your hands.
A Realistic Timeline, Phase by Phase
The table below shows a typical project for a small to mid-sized organisation with some security foundations already in place. Several phases overlap in practice.
| Phase | Typical duration | What happens |
|---|---|---|
| 1. Gap analysis and scoping | 2 to 4 weeks | Compare current practice with every clause and Annex A control, agree the scope and build the plan |
| 2. Risk assessment | 2 to 6 weeks | Define the method, identify assets and risks, decide treatments and draft the Statement of Applicability |
| 3. Build and remediate | 6 to 16 weeks | Write policies and procedures, close control gaps, run awareness training and start collecting evidence |
| 4. Operate and evidence | 4 to 12 weeks | Let the processes run so there are real records: access reviews, incidents, supplier checks, metrics |
| 5. Internal audit and management review | 2 to 4 weeks | An independent internal audit, a minuted management review and corrective actions |
| 6. Stage 1 audit | 1 to 3 days on site or remote | The certification body reviews documentation and confirms readiness for Stage 2 |
| 7. Stage 2 audit | 2 to 5 days, usually a few weeks after Stage 1 | The auditor tests that the ISMS works in practice through interviews and evidence sampling |
| 8. Certificate issued | 2 to 6 weeks after Stage 2 | Any nonconformities are closed and the certification decision is made |
How Your Starting Point Changes the Timeline
The biggest variable is not your size. It is how much already exists. Here is how three common starting points tend to play out.
Well prepared: 3 to 4 months
- Cyber Essentials Plus or similar in place
- Clear, small scope
- Named owner with time to give
Typical: 5 to 8 months
- Some policies and controls, few records
- Moderate scope, one or two sites
- Expert support alongside the team
Starting fresh: 9 to 12+ months
- Little documentation or evidence
- Large or multi-site scope
- Significant technical gaps to close
If you are not sure where you sit, the readiness checklist in our ISO 27001 requirements guide gives a quick indication in a few minutes.
What Slows ISO 27001 Projects Down
In our experience, delays rarely come from the standard itself. They come from a small number of predictable problems.
- No one owns it. ISO 27001 run as a side project by someone with a full time day job drifts. A named owner with protected time is the single best predictor of a fast project.
- Scope creep. A scope that keeps growing keeps resetting the risk assessment and documentation.
- Waiting for evidence. Auditors want to see controls operating. If you only start keeping records a fortnight before Stage 2, there is not much to sample.
- Technical gaps found late. Discovering at the internal audit that logging or vulnerability management does not work adds weeks. Find these at the gap analysis instead.
- Certification body availability. Good auditors book up. Contact certification bodies early and pencil in Stage 1 and Stage 2 dates as soon as you have a plan.
- Findings at Stage 1. Stage 1 issues have to be fixed before Stage 2 can go ahead. Remember that if too long passes between the two stages, typically more than six months, Stage 1 may need repeating.
What Speeds It Up
- A tight, agreed scope. Certify what customers need and extend later if you want to.
- Starting the evidence clock early. Turn on the processes you already run, such as access reviews and incident logs, from week one.
- Parallel workstreams. Documentation, training and technical remediation can run alongside each other once the risk assessment is done.
- Reusing existing work. Cyber Essentials Plus, SOC 2 controls and existing policies all shorten the build.
- Experienced help. Knowing exactly what an auditor will ask for removes rework, which is where most time is lost.
Planning Backwards From a Deadline
If a contract or tender has set your date, plan backwards rather than forwards. Work from the date the certificate needs to be in hand, allow time for the certification decision after Stage 2, then the Stage 2 audit itself, Stage 1 a few weeks before that, and your internal audit and management review before Stage 1. Whatever time is left is your build window.
Certificate needed in six months
Achievable for a prepared organisation with a clear scope and dedicated resource. Tighter than this needs strong foundations already in place.
If the window is genuinely too short, say so early. Many buyers will accept evidence of a booked certification audit and a credible plan in the meantime. A clear plan and a Stage 1 report can carry more weight in a tender than a rushed project that fails.
Who Needs to Be Involved, and When
A realistic timeline is also a question of people. ISO 27001 is not an IT project, and the organisations that certify fastest are the ones that bring the right people in at the right moment rather than all at once or too late.
| Who | When they are needed most | What they contribute |
|---|---|---|
| Executive sponsor | Kick off, scope sign off and management review | Sets objectives, commits resources and answers leadership questions at audit |
| ISMS owner | Throughout | Runs the plan, owns the risk register and the Statement of Applicability |
| IT and engineering | Gap analysis and remediation | Fixes technical gaps and produces evidence such as configurations, logs and scan results |
| HR | Build phase | Screening, contracts, joiners and leavers, and training records |
| Procurement and legal | Build phase | Supplier security, contracts and legal and regulatory requirements |
| Process owners | Risk assessment and Stage 2 | Describe how work really happens and talk to the auditor about it |
As a rule of thumb, the ISMS owner needs a meaningful part of their week for the length of the project, while most other people need a few focused sessions at the points shown above. Book that time at the start. A calendar full of other priorities is one of the quietest and most common causes of slipping dates.
It also helps to agree early who will speak to the auditor. Auditors interview people across the business during Stage 2, not just the ISMS owner. A short briefing for anyone likely to be interviewed, explaining what the auditor is looking for and reassuring them that "I would check the procedure" is a perfectly good answer, removes a lot of anxiety and keeps the audit on schedule.
Running ISO 27001 Alongside Other Work
Few organisations can pause everything else for an ISO 27001 project. Cloud migrations, new product launches and audits for other frameworks all compete for the same people. That is manageable, and sometimes helpful, if you plan for it.
- Use change as evidence. A migration or new system is a chance to show clause 6.3 and change management working in practice, with risk assessment built in from the start.
- Align with other audits. If you are also working towards Cyber Essentials Plus, SOC 2 or ISO 22301, map shared controls once and collect evidence once.
- Avoid audit dates in peak periods. Year end, major releases and holiday seasons make it hard to get people in front of an auditor.
- Protect the owner's time. If the ISMS owner is also leading another major project, one of them will slip. Decide which in advance.
After Certification
Certification is the start of a three year cycle, not the finish line. Surveillance audits follow in years two and three, then a recertification audit before the certificate expires. Each surveillance audit is shorter than the initial audit, but the auditor will expect to see that your ISMS has kept running: risks reviewed, internal audits done, management reviews held and improvements made.
Planning for this from the start keeps the effort steady instead of turning every audit into a scramble. It also helps your budget. Our guide to ISO 27001 certification costs breaks down what to expect across all three years.
How Cybergen Can Help
We run ISO 27001 programmes to a plan with dates you can hold us to. Our ISO 27001 certification service starts with a gap analysis and scoping workshop, builds your risk assessment, documents and Statement of Applicability, delivers technical remediation through our CREST-certified team, and supports you through the internal audit, Stage 1 and Stage 2. Where you need more than one standard, such as ISO 22301 for business continuity, our ISO consultancy runs them together.
Have a deadline? Talk to our team and we will tell you honestly whether it is achievable and what it will take.
Timelines are typical ranges based on published guidance and project experience as of November 2026. Your timeline will depend on scope, maturity and resourcing.
Frequently Asked Questions
How long does ISO 27001 certification take?
Most organisations take between three and twelve months from planning to an issued certificate. Small, well prepared organisations with a clear scope can certify in around three to four months. Larger or less mature organisations often take nine to twelve months or more.
How long are the Stage 1 and Stage 2 audits?
A Stage 1 audit typically lasts one to three days and focuses on documentation and readiness. A Stage 2 audit usually lasts two to five days for small and mid-sized scopes and tests whether the ISMS works in practice. Larger scopes need more audit days.
How much time is needed between Stage 1 and Stage 2?
Usually a few weeks, to allow any Stage 1 findings to be fixed. The gap should not be too long. If more than around six months passes, the certification body may require Stage 1 to be repeated.
Can ISO 27001 be done in three months?
Yes, for a small organisation with a clear scope, good existing controls and a dedicated owner. It is ambitious for organisations starting with little documentation or significant technical gaps.
Does ISO 27001 need a minimum period of evidence?
The standard does not set a fixed observation period, unlike some SOC 2 reports. However, the auditor needs to see your processes operating, including at least one internal audit and management review, so allow time for real records to build up.
How long is an ISO 27001 certificate valid?
Three years, subject to passing a surveillance audit in each of years two and three. A recertification audit before expiry renews it for another three years.
Sources
CREST-certified consultants with over 100 years of combined experience in threat intelligence, penetration testing, MDR and compliance.
