A first ISO 27001 certificate usually takes six to twelve months from the decision to start to the certificate in hand, with nine to twelve common from a standing start and longer for a large or complex scope. Most of that time goes on building the management system: scope, risk assessment, the Statement of Applicability, policies and the controls your risks call for, then an internal audit and a management review. The certification audit itself is two stages a few weeks apart: Stage 1 checks the documentation and readiness, Stage 2 tests the system in operation. Add a few weeks after Stage 2 for closing findings and the certification body's decision. The certificate then runs for three years, with surveillance audits in years one and two.
"How long does ISO 27001 take?" has two honest answers. The audit part is predictable: two stages, set by ISO/IEC 17021-1 and planned by the certification body with audit days that follow IAF MD 5. The preparation part depends on where you start: a company with a security programme, an asset inventory and written policies has months less to do than one starting from a blank page.
The phases and how long each takes
| Phase | What happens | Typical length | What moves it |
|---|---|---|---|
| Scoping and kickoff | Define the ISMS scope (clause 4.3), get leadership commitment and name an owner; shortlist certification bodies | Two to four weeks | How clearly the product, the teams and the systems in scope are defined |
| Gap analysis | Compare current practice with clauses 4 to 10 and the Annex A controls | One to three weeks | Whether an inventory of systems, policies and controls already exists |
| Risk assessment and Statement of Applicability | Set risk criteria, assess risks, decide treatments, select controls and justify every inclusion and exclusion | Three to eight weeks | The size of the asset inventory and how many people have to agree on risk decisions |
| Implementation | Write and approve policies, put the selected controls in place, train people, start collecting evidence | Two to six months | How many controls are missing, engineering capacity and whether evidence is collected automatically |
| Operating period | Controls run and produce records the auditor can sample | Commonly two to three months before Stage 2 | When the controls actually started, not when the policy was signed |
| Internal audit and management review | Audit the ISMS against the standard, close nonconformities, hold and minute the management review | Two to four weeks | Auditor independence and how quickly findings are fixed |
| Stage 1 audit | The certification body reviews documentation and readiness and lists areas of concern | One to two audit days, then a few weeks to resolve concerns | Whether the mandatory documented information is complete |
| Stage 2 audit and decision | The certification body tests the ISMS in operation, you close any findings, an independent reviewer decides | Audit days set by headcount and complexity, then two to six weeks to the decision | The number and severity of nonconformities |
Three example schedules
- Starting from little, small scope: about four months of implementation, two months of operation and internal audit, then Stage 1 and Stage 2 roughly a month apart. Around eight to nine months to the certificate.
- An established security programme: gap analysis and the risk assessment take most of the preparation, implementation is a matter of closing gaps and documenting what already runs, and the audits can follow within five to seven months.
- A large or multi-site scope: the risk assessment and implementation stretch because more people own more systems, Stage 2 takes more audit days and may be split across sites, and twelve months or more is normal.
The implementation guide walks through each of these phases in order, and the risk assessment guide covers the phase that most often runs long.
What has to be true before Stage 2
ISO/IEC 17021-1 requires the certification body to confirm at Stage 1 that the internal audit and the management review have been planned and performed, and Stage 2 tests their results. The standard sets no minimum operating period, but the Stage 2 auditor samples records of controls in operation: access reviews that ran, incidents that were handled, backups that were tested. In practice certification bodies expect the ISMS to have run for a few months, and a schedule that puts Stage 2 immediately after implementation usually slips.
What slows certification down
- A scope that keeps changing, so the risk assessment and the Statement of Applicability have to be redone.
- A risk assessment done after the controls were chosen, which leaves the Statement of Applicability unable to explain why each control is there.
- Evidence gathered by hand before the audit instead of as the controls run, which turns Stage 2 preparation into a project of its own.
- An internal audit done by the person who built the ISMS, which the certification body will not accept as independent.
- Booking the certification body late: audit dates are often set two to three months ahead.
- Open major nonconformities after Stage 2, each of which has to be corrected and verified before the certificate can be issued.
After the certificate
Certification is granted for three years from the decision date. The certification body comes back for a surveillance audit within twelve months and again the year after, then a recertification audit before the certificate expires. The surveillance and recertification guide covers what each visit samples and what can suspend a certificate. From the first surveillance on, the timeline is a yearly rhythm rather than a project, and the work moves from building the ISMS to proving it still runs.
Primary sources
- ISO/IEC 27001:2022 — information security management systems, ISO
- ISO/IEC 17021-1:2015 — requirements for bodies providing audit and certification of management systems, ISO
- IAF MD 5 — determination of audit time of quality, environmental and occupational health and safety management systems, International Accreditation Forum