ISO/IEC 27001 certification process, step by step: from scope to certificate

Who does what, and under which rules

Your organisation owns the information security management system (ISMS): top management approves the policy, risk owners accept residual risk and your people run the controls. A consultancy such as Sterling helps build and prepare it but has no say in certification. The certification body audits and decides, and its competence is assessed by an accreditation body recognised through the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA on 1 January 2026.

Three documents apply. ISO/IEC 27001:2022, with Amendment 1:2024, is the standard your ISMS must meet. ISO/IEC 17021-1 governs accredited management system certification, including the two audit stages and the independent decision. ISO/IEC 27006-1:2024, which replaced ISO/IEC 27006:2015 in March 2024, complements it with rules specific to ISMS certification, so make sure a body's accreditation names ISMS certification expressly.

Steps 1 to 5: build an ISMS that can be audited

Step 1: scope and purpose

Name the services, locations, systems, cloud platforms and teams inside the ISMS, and the clients, suppliers or group functions it depends on. The scope is printed on the certificate and sets the audit days, so agree it at board level along with the reason for certifying, whether a client questionnaire, a tender or a regulator.

Step 2: gap analysis

The opening stage of a Sterling engagement compares how you work today with the 2022 edition and Annex A, shows what can stay and schedules what must change. It is far more thorough than the free online readiness check and precedes the certification body's Stage 1 readiness review by months.

Step 3: risks, controls and the Statement of Applicability

Clause 6.1.2 requires risk criteria and a repeatable assessment of risks to confidentiality, integrity and availability. Clause 6.1.3 turns the results into treatment decisions and controls, checked against Annex A and recorded in the Statement of Applicability, with a treatment plan that risk owners approve. See ISO/IEC 27001 risk assessment and treatment, step by step and The Statement of Applicability: how to write one that survives the audit.

Step 4: operate the controls

Let controls run long enough to leave a trail: access reviews, removed leavers, tested restores, reviewed logs, incidents with causes, supplier checks, training records, and a vulnerability assessment with its remediation. Evidence manufactured in the final week rarely matches the surrounding tickets and system dates.

Step 5: internal audit and management review

Clause 9 requires both, and certification bodies expect one full round before Stage 2: an internal audit of the clauses and applicable controls by people independent of the work, then a review in which top management takes recorded decisions. See ISO/IEC 27001 internal audit: planning, conduct and reporting.

Step 6: choose the certification body and apply

Apply before implementation ends; auditor calendars fill well in advance. The body's application review sets the audit programme, with auditor days for every stage and surveillance visit calculated under ISO/IEC 27006-1 from headcount in scope, locations and ISMS complexity. Confirm its accreditation in the accreditation body's directory, not from a logo. Quotations and warning signs are compared in Choosing an ISO/IEC 27001 certification body: accreditation, scope and quotes.

Steps 7 and 8: Stage 1 and Stage 2

Stage 1, the readiness review, reads the ISMS on paper: scope, risk method and results, Statement of Applicability, treatment plan, and evidence that internal audit and management review are under way. Resolve every concern it raises before Stage 2.

Stage 2 establishes whether the ISMS is implemented and effective across the scope. Auditors interview leaders, risk owners and control operators, sample records against the Statement of Applicability, inspect configurations beside your administrators and trace real events, such as a leaver or an incident. Above all they test agreement: each control marked implemented should trace to a risk or requirement, operate and leave records. The closing meeting delivers findings and a recommendation, not the decision. Detail is in ISO/IEC 27001 Stage 1 and Stage 2 audits: what auditors check.

Steps 9 and 10: findings and the certification decision

Findings are major or minor nonconformities, or opportunities for improvement. Each nonconformity needs a correction, root cause and corrective action by the body's deadline. A major one blocks certification until the body verifies your response, occasionally on site; for a minor one it usually accepts your plan and checks it later. See ISO/IEC 27001 nonconformities: major, minor and how to close them.

Someone at the certification body who took no part in the audit then decides. Your certificate identifies the organisation, scope, sites, edition, validity dates and accreditation, and many ISMS certificates also cite the audited Statement of Applicability version, so keep it version-controlled. The three-year cycle starts from the decision.

Step 11: surveillance and recertification

Surveillance comes at least once each calendar year except in recertification years, the first no later than twelve months after the decision. Each visit samples the ISMS yet always covers internal audit, management review, corrective actions, changes and use of the certificate. A recertification audit of the whole ISMS renews the certificate before expiry. Report changes to scope, sites, legal entity or headcount promptly. See ISO/IEC 27001 surveillance and recertification: the three-year cycle.

How long it takes, and where it stalls

A single-site organisation with a capable IT function typically goes from kick-off to decision in four to eight months: quicker where policies and technical safeguards already exist, slower where identity management, monitoring or backup must first be introduced and run. More sites, or a parallel SOC 2 examination, add time; see ISO/IEC 27001 timeline: how long certification takes, stage by stage. Three sequencing errors cause most delays:

• Applying last. The body's booking lead time lands at the end instead of running in parallel.
• Moving the scope after Stage 1. Late additions change audit days and may force part of Stage 1 to be repeated.
• Auditing internally in the final week. Findings raised days before Stage 2 cannot be closed with evidence.

ISO/IEC 27001 certification process: questions buyers ask