ISO/IEC 27001 timeline: how long certification really takes, stage by stage

The short answer, and why it is months rather than weeks

Plan on four to eight months. Programmes finish near four when policies and security tooling mostly exist and leadership settles scope and risk criteria in the first fortnight; they run towards eight when access management, logging, backup or supplier assurance must be designed and adopted first. Several sites, or a programme timed to a SOC 2 examination, take longer again.

Drafting speed hardly matters, because an accredited certification body tests operation: risk assessments carried out, access reviewed, incidents or exercises handled, an internal audit and management review already held. None of that can be produced in advance, so a certificate offered within days is not accredited certification; How to verify an ISO/IEC 27001 certificate, and spot a fake one explains the checks.

ISO/IEC 27001 timeline by stage

The stages follow the four phases on our main ISO/IEC 27001 page, with the certification body's part split into three waits. They overlap, which is how seven stages fit into four to eight months.

What moves each stage

• Scope, systems and sites. Every product, cloud account, environment and team inside the boundary adds assets to assess and evidence to collect, and each extra location adds internal audit and certification-body audit time. An unsettled scope costs most: while leadership debates whether client-dedicated environments or an offshore support team are in, the risk assessment waits. See ISO/IEC 27001 scope: boundaries, interfaces and the mistakes that cost you.
• Risk assessment maturity. With a working method, agreed criteria and appointed owners, the assessment takes a few weeks. From a standing start, agreeing the criteria with leadership is the slow step; ISO/IEC 27001 risk assessment and treatment, step by step sets out the method.
• Control implementation. A policy can be approved in days; a control takes weeks to operate, built by people who also keep production running. The long items are usually centralised logging with alerts someone reviews, single sign-on with same-day leaver removal, restore-tested backups, vulnerability scanning with fix deadlines and supplier reviews.
• Evidence accumulation. A control switched on last week has no history to sample. Periodic controls need one completed cycle on record before Stage 2; frequent ones such as log reviews, leaver processing and change approvals need several weeks of entries.

What runs in parallel, and what has to wait

Good programmes save time through overlap, not haste. Alongside the build you can write policies as their controls are configured, train everyone in scope once those policies are approved, prepare your internal auditors, collect quotations and reserve audit dates, and run the vulnerability assessment early enough for remediation and a retest to be on record before Stage 2.

The Statement of Applicability records treatment decisions, so it follows them; the internal audit needs weeks of operation to sample; and the management review takes audit results among its inputs, so it follows the audit.

ISO/IEC 27001 sets no minimum operating period. ISO/IEC 17021-1 frames readiness as evidence: at Stage 1 the certification body evaluates your preparedness for Stage 2 and whether internal audits and management reviews are being planned and performed. Some bodies state their own expectation, so ask when you apply. Our working rule is eight to twelve weeks of records between the last significant control going live and Stage 2, with the internal audit and management review finished before Stage 1.

The certification body's lead times

Allow a week or two for comparable quotations. Stage 1 is typically scheduled four to eight weeks after the application is accepted, later before year-end or when your scope needs particular technical or language competence. Stage 2 takes a few working days, sized by the audit time the body calculates under ISO/IEC 27006-1, explained in ISO/IEC 27001 certification cost: what moves the price.

ISO/IEC 17021-1 fixes no gap between the stages; the body must allow time for you to resolve the concerns Stage 1 raises. After Stage 2 you answer any nonconformities, and people outside the audit team decide. A major nonconformity needs its correction and corrective action verified first; if that cannot happen within six months of the last day of Stage 2, Stage 2 is conducted again. See ISO/IEC 27001 nonconformities: major, minor and how to close them and, for selection, Choosing an ISO/IEC 27001 certification body: accreditation, scope and quotes.

A worked calendar: 120-person SaaS company on public cloud

The company has one office and runs its platform on one public cloud provider. Consoles use multi-factor authentication and most tools single sign-on, but logs are not centralised or reviewed, access has never been reviewed, backups have never been test-restored, suppliers are unassessed and there is no risk register.

Thirty weeks is roughly seven months, with Stage 2 ten weeks after the last significant control went live. With logging and single sign-on already complete, the audit dates could move several weeks earlier; a second product on separate infrastructure, a support centre abroad or a SOC 2 Type 2 period to align would push the plan to eight months or beyond. ISO/IEC 27001 implementation plan: phases, owners and deliverables turns such a calendar into a project plan.

ISO/IEC 27001 timeline: questions buyers ask