Stage 1 is the readiness review: the auditor reads your ISMS documentation, checks the scope, the risk assessment and the Statement of Applicability, confirms that the internal audit and management review are planned or done, and lists areas of concern. Stage 2 is the certification audit: the auditor tests whether the ISMS operates as documented, sampling records and interviewing people across the scope. Both stages are defined by ISO/IEC 17021-1, the standard certification bodies are accredited against, with ISO/IEC 27006-1 adding the ISMS specifics. A major nonconformity found at Stage 2 must be corrected and verified before a certificate is issued; a minor one needs a corrective action plan the certification body accepts.
Every accredited ISO 27001 certification runs as a two-stage initial audit. The split comes from ISO/IEC 17021-1, which sets the rules certification bodies follow for any management system standard, and ISO/IEC 27006-1, which adds what an ISMS audit must cover. Knowing what each stage tests tells you what to prepare, and in which order.
Stage 1 and Stage 2 side by side
| Stage 1 | Stage 2 | |
|---|---|---|
| Purpose | Confirm the ISMS is documented, scoped and ready to be audited | Confirm the ISMS is implemented and effective |
| Where | Often remote or a short visit; the certification body decides | On site, or remote where the body allows it; covers the sites in scope |
| What the auditor looks at | Scope, policy, risk assessment, Statement of Applicability, objectives, internal audit and management review plans, site conditions, legal requirements | Records that controls operated, interviews with control owners, management involvement, measurement, internal audit and management review results |
| Output | A Stage 1 report listing areas of concern and the plan for Stage 2 | Nonconformities, graded major or minor, and a recommendation on certification |
| Typical length | One to two audit days | Several audit days, set by headcount, sites and complexity |
What Stage 1 covers
ISO/IEC 17021-1 lists the objectives of Stage 1. In an ISMS audit they come out as:
- Reviewing the documented information: scope, policy, the risk assessment and treatment processes, the Statement of Applicability, objectives and the mandatory records.
- Evaluating site-specific conditions and discussing with your people how ready you are for Stage 2.
- Checking that you understand the standard's requirements, especially around objectives, risk and the controls you selected.
- Collecting what is needed to plan Stage 2: the scope, processes, locations, the legal and regulatory obligations you listed, and the people the auditor will need.
- Confirming that the internal audit and the management review have been planned and performed.
- Agreeing the allocation of audit days and the Stage 2 plan.
The report that follows names areas of concern. They are not nonconformities, but the certification body expects them to be resolved before Stage 2, and the interval between the stages is set with that in mind.
What Stage 2 covers
- Evidence of conformity with every requirement of ISO 27001, sampled across the scope.
- Performance monitoring and measurement against the security objectives.
- The internal audit and the management review: that they happened, what they found, and what was done about it.
- Management's responsibility for the policy, and the links between the requirements, the policy, the objectives, the risk assessment results and the controls in operation.
- The risk assessment and treatment outputs, and whether the Statement of Applicability matches what is actually implemented.
- Operational control of the selected Annex A controls, through records and interviews with the people who run them.
Nonconformities and the certification decision
A major nonconformity is a failure that puts the ISMS's ability to achieve its intended results in doubt: a mandatory requirement not met, a control in the Statement of Applicability that does not exist, or a pattern of minors in one area. A minor nonconformity is a single lapse that does not undermine the system. The certification body cannot recommend certification while a major is open; you correct it, address the root cause, and the body verifies the fix, by document or by a further visit. For minors, an accepted corrective action plan is enough, and surveillance checks it was done.
The decision itself is taken by people at the certification body who did not take part in the audit, on the basis of the audit report, the nonconformities and your responses. The certificate's effective date is the decision date, and the three-year cycle counts from there. The surveillance and recertification guide covers what happens next.
How to prepare for each stage
- For Stage 1, finish the documentation and the mandatory records, and make sure the internal audit and management review are done or firmly scheduled. The checklist lists what the standard requires in writing.
- For Stage 2, make sure every control marked implemented has records of operation, that control owners can explain their control in their own words, and that the people the auditor will interview know the audit plan.
- Between the stages, close the Stage 1 areas of concern and keep a note of what changed, because the Stage 2 auditor starts from the Stage 1 report.
Primary sources
- ISO/IEC 17021-1:2015 — requirements for bodies providing audit and certification of management systems, ISO
- ISO/IEC 27006-1:2024 — requirements for bodies providing audit and certification of information security management systems, ISO
- ISO/IEC 27001:2022 — information security management systems, ISO