How long does ISO 27001 certification take? The timeline by phase, and what slows it down

A company of 20 to 250 people, starting from a normal unmanaged position with nobody whose job is security, should plan for nine to twelve months to ISO 27001 certification. Most phases can be compressed with money and focus. The evidence period cannot: the management system typically has to run for three months before the Stage 2 audit.

This guide covers each phase, a month-by-month plan, the evidence period, why Stage 2 audits slip, what slows a project, what shortens it, and what compression leaves out.

Phase	Realistic duration
Scoping, risk assessment, Statement of Applicability	4 to 8 weeks
Closing the gaps that matter	2 to 5 months
Running the system to accumulate evidence	3 months minimum, 6 is comfortable
Internal audit and management review	2 to 4 weeks
Stage 1 audit	A few days to two weeks
Gap between Stage 1 and Stage 2	4 to 6 weeks
Stage 2 audit	1 to 2 weeks of calendar time
Certification decision and certificate issued	Up to 3 months

How long does ISO 27001 take from start to certificate?

Added up, the phases look worse than reality, because several of them overlap. Here is the good case for a 40-person software company. It is cloud hosted, and the scope is the product and the teams that build and run it.

Month	What happens
1	Decisions, scope, risk assessment, Statement of Applicability. Evidence generators switched on. Supplier inventory started.
2 to 4	Remediation. Engineering work runs in parallel with documentation. Evidence accumulates.
5	Internal audit, then management review. Fix what the internal audit finds, which is the point of doing it.
6	Stage 1 audit.
7 or 8	Stage 2 audit, four to six weeks after Stage 1.
8 to 10	Certificate issued, allowing for the certification decision.

That assumes real ownership and no surprises. Ten to twelve months is the safer number to say out loud to your board.

If someone quotes you three months, they are either scoping very narrowly or planning to assemble evidence rather than generate it. One of those is a problem you will meet at Stage 2.

What is the minimum time before the Stage 2 audit?

Your management system has to have operated for a minimum period before Stage 2, typically three months. Auditors want to see a history: access reviews with dates, patch records, incident tickets, a management review that actually happened, supplier assessments filed over time.

That is calendar time, not effort. You cannot buy it, parallelise it or work weekends to shorten it. Every other phase is compressible with money and focus. This one is not.

So the clock that matters starts when your evidence starts, not when your documentation is finished. Most projects run in the wrong order. They spend three months perfecting policies and start the evidence clock in month four, which pushes certification out by a full quarter for no gain.

Turn on the boring recurring things in week one: access reviews, patch records, log retention, the first supplier assessments. They can be imperfect. They cannot be missing.

Why do 40% of Stage 2 audits get rescheduled?

Roughly four in ten organisations that go into Stage 1 without a managed security programme have to move their Stage 2. The evidence is not there when the auditor arrives.

The pattern is always the same. Stage 1 is a documentation review, and documentation is what consultants are good at producing, so Stage 1 goes well. Stage 2 asks whether the documented system actually ran. That is where a project that front-loaded paperwork falls over.

The causes, in the order we see them:

• The risk assessment or the Statement of Applicability is incomplete at Stage 1, so the auditor cannot even establish what they are supposed to test.
• Operational records are missing for the three-month window. The controls were designed, but nothing recorded them running.
• Major nonconformities at Stage 2 need remediation before a certificate can be issued. That adds weeks, and sometimes a repeat visit.
• The scope was drawn badly and has to be redrawn, which invalidates part of the work already done. Read scope and Statement of Applicability before you commit to a boundary.

What makes ISO 27001 take longer?

Five things, in order.

Ownership that is not real. The strongest predictor of a project that drifts is that security is nobody’s actual job. The project has energy for six weeks, then the CTO gets a product deadline, and three months evaporate. If you cannot name the person and point at time in their calendar, add a quarter to your estimate.

Decisions left open. Scope, risk appetite, what you will not do this year. Every week one of these stays open is a week of work happening around it that may need redoing. These are covered in the decisions only you can make.

The supplier long tail. Inventorying vendors, classifying them, getting security information back and recording it. The constraint is other people’s response times, which is why it should start in week one. It never does.

Engineering work competing with the roadmap. Configuration management, separation of environments, secure development. Real weeks of real engineering, and the only group where throwing documentation at the problem does nothing.

Certification body scheduling. Book earlier than feels necessary. Audit slots are not always available when you want them, and the gap between Stage 1 and Stage 2 is four to six weeks by design anyway.

How can you shorten the ISO 27001 timeline?

Not by much, and be suspicious of anyone claiming otherwise. Three things are real:

1. Start the evidence clock in week one. It is worth up to a full quarter, and it costs nothing.
2. Scope deliberately rather than broadly. A scope drawn to answer your customer’s actual question is smaller than “the whole company”, and smaller means faster. It also puts fewer controls in play, which shrinks groups 4 and 5 of the control work.
3. Know your gaps before you start. Most of the variance in the two-to-five-month remediation band is simply not knowing what is broken. An independent audit up front turns an unknown into a plan, which is the difference between a project and a drift.

If you are doing NIS2 at the same time, do the work once. The overlap is substantial, as set out in certification standards and ISO 27001 under NIS2. For a first certification with no security team, start with ISO 27001 without a security team, and on the money, is €50k for ISO 27001 worth it. The route is laid out on our ISO 27001 solutions page.

What does a compressed ISO 27001 timeline leave out?

Every compression trick in circulation works. Narrow the scope hard, buy a policy pack, run the evidence period at the minimum, mark generously in the Statement of Applicability, and you can hold a valid certificate in six months. The standard permits all of it.

What you should know is where the time went. Compression never comes out of the documentation, because documentation is what the auditor reads first and it is cheap to produce. It comes out of remediation. The gap list that would have taken four months to close gets triaged down to the items that block the audit. The rest move to a roadmap that quietly stops being reviewed.

So the honest answer is this: certification takes six to twelve months. Becoming defensible takes as long as your gap list takes, and the certificate does not tell you which one you bought.

If the deadline is a customer contract and the certificate genuinely unblocks revenue, compress it. Take the certificate, and keep the untouched half of the gap list somewhere it gets read every quarter. That is a legitimate business decision. The failure mode is not compressing the timeline. It is compressing it and then believing the certificate meant you were finished.

ISO 27001 timeline checklist

• Plan for nine to twelve months from scratch, and say ten to twelve to your board.
• Name the person who owns the project and point at the time in their calendar.
• Close the open decisions first: scope, risk appetite, what you will not do this year.
• Switch on evidence and the supplier inventory in week one.
• Know your gaps before the project starts, not halfway through remediation.
• Book the certification body early, and allow four to six weeks between Stage 1 and Stage 2.
• If you compress for a contract, keep the rest of the gap list under quarterly review.

Frequently asked questions