Most ISO 27001 projects that run late do not fail on technology. They slip because the evidence an auditor needs does not exist yet, because the auditor’s calendar is fuller than planned, or because nobody froze the scope. All three are plannable. This guide shows where the weeks go, how to put buffers in the right places, and how to spot slippage while it is still cheap to fix.
TL;DR
- Slippage is mostly a management problem: missing internal audit records and management review minutes stall projects more often than missing policies, according to ANAB guidance.
- Skipping scoping and gap assessment looks like a shortcut and usually produces rework and overruns.
- The gap between finishing implementation and the Stage 2 audit cannot be compressed, because the ISMS must have actually operated, including one internal audit and one management review.
- Book your certification body early, then work backward. Auditor availability is the most overlooked line in most plans.
- Track slippage with a few leading indicators every two weeks, not at the end.
Table of Contents
- What slippage looks like in an ISO 27001 project
- Where the weeks actually go
- The two-stage audit and why the gap matters
- A note on the 2022 transition
- How to build a schedule that absorbs slippage
- Leading indicators to track every two weeks
- Special case: SaaS and regulated U.S. companies
- Our perspective
- Test your own schedule
- FAQ
- Sources
What slippage looks like in an ISO 27001 project
Slippage is the distance between the date you promised leadership or a customer and the date a certificate is actually issued. It rarely arrives as one big miss. It builds in small steps: a risk assessment that takes five weeks instead of three, a policy approval that waits on a vacationing executive, an internal audit that finds more than expected.
Typical published timelines give you a baseline to measure against. One source puts a realistic path at 9 to 14 months in five phases for a small or midsize company (that guide is written around Spanish SMEs, so treat it as a reference point, not a U.S. norm). A SaaS-focused roadmap lays out a 12-month plan that ends with the certifier audit in months 9 to 12. Our own certification timeline guide and implementation timeline guide go through the same ranges by company size.
A plan that fits inside those ranges is not slipping. A plan that promises 12 weeks to a company with no existing controls, no risk register and no security owner is already slipping on day one; it just has not shown up on the calendar yet.
Where the weeks actually go
Below are the six places we see schedules break, roughly in the order a project meets them.
| Stage | Typical cause of delay | Early warning sign |
|---|---|---|
| Scoping and gap assessment | Skipped or rushed, scope argued late | No signed scope statement by week 4 |
| Risk assessment and treatment | Asset list incomplete, owners not named | Risks without owners |
| Control implementation | Dependencies on IT, HR, or vendors | Tickets waiting more than two weeks |
| Operating period | Not enough logs, training or incident records | Empty evidence folders |
| Internal audit and management review | Scheduled too late, findings need rework | No review date in calendars |
| Certification audits | Auditor waitlist, major nonconformities | No booked Stage 1 date |
1. Skipping scoping and the gap baseline
It feels faster to start implementing controls on day one. Practitioners say the opposite: rushing past scoping and gap assessment is a leading driver of cost and schedule overruns, because teams without a baseline end up redoing work. The same source places the scoping and gap phase in roughly weeks 1 to 6.
Six weeks of planning is not wasted time. It is the cheapest time in the project to find that your cloud environment, your support team in another country, or a subsidiary you forgot belongs in scope. If you need a method, our step-by-step gap analysis guide walks through it.
2. Scope that keeps moving
A scope that grows mid-project resets work that was nearly done. A new product line adds assets to the register, new risks to the treatment plan and new evidence to collect. Freeze the scope statement after the gap phase, and send any change through a short, written approval with its schedule impact stated. We cover this in detail in how to stop ISO 27001 scope creep.
3. Paper-only implementation
This is the one that surprises people. Auditors want objective evidence that controls function. Practitioners warn that thin logs, too little staff training or undocumented incident response activity can trigger major nonconformities at Stage 2, and the remediation and verification that follow can turn a planned three-month sprint into six months.
A policy that says access reviews happen quarterly is not evidence. A completed review with a date, a reviewer and a list of removed accounts is.
4. Internal audit and management review left too late
Accreditation experts point out that the thing that most commonly stalls projects on the way to Stage 2 is the inability to show an operating ISMS, such as completed internal audit records and management review minutes. Organizations tend to assume documentation is the hurdle.
The practical fix is simple. Put the internal audit and the management review on calendars during the first month, with named attendees. A management review is a meeting of the people who are hardest to schedule. If you wait until implementation ends to find a date, you will wait.
5. The operating-period gap nobody budgets
Certification bodies expect proof of an operating management system. That means at least one full management review cycle and one internal audit, and this lag cannot be artificially compressed. A SaaS roadmap shows the same pattern: after the Stage 1 review, it allows 30 to 60 days of observation to finish pending controls and gather evidence.
If your plan shows Phase 3 ending on a Friday and Stage 2 starting the next Monday, the plan is wrong.
6. Auditor availability
Many teams assume they can book an auditor on demand. Background material from practitioners notes that popular certification bodies often have multi-month waitlists. We would add a plain point: the cheapest slippage to prevent is the one caused by an empty calendar slot. Ask for quotes and available windows during scoping, not after the ISMS is built. Our project milestones article makes the case for booking Stage 2 first and planning backward.
The two-stage audit and why the gap matters
Certification is two audits by the same certification body. Stage 1 asks whether the ISMS is designed and ready; Stage 2 asks whether it works. One preparation guide gives typical durations of 2 to 4 audit days for Stage 1 and 8 to 11 audit days for Stage 2 for organizations of 100 to 300 people, with a gap of roughly 2 to 8 weeks between them. Another roadmap assumes a shorter Stage 1 of one to two days, so your certification body’s own quote is the number that counts.
The same guide explains the logic of that gap, which follows ISO/IEC 17021-1: it must be long enough to close Stage 1 concerns, yet short enough that the Stage 1 findings are still current. That cuts both ways for scheduling:
- Too short, and open Stage 1 findings carry into Stage 2 as risk.
- Too long, and the certifier may need to revisit Stage 1 conclusions.
So do not pad the gap casually. Fill it with specific work: closing findings, the internal audit if it is not done, and the management review. Our guide to audit stages and sample records lists what an auditor will sample.
A note on the 2022 transition
The transition deadline is behind us. Under the IAF’s mandatory document, ISO/IEC 27001:2013 certificates expired on October 31, 2025, regardless of where they sat in their three-year cycle. Some search results still talk about that date as upcoming, which is a reason to check publication dates.
For a new project in late 2026, the lesson is simple: build against ISO/IEC 27001:2022 from the start. Starting a project on the old edition would mean redoing the control mapping, which is exactly the kind of avoidable slippage this article is about. If you hold an older certificate or an interrupted project, ask your certification body what it requires now, since transition policies vary by body.
How to build a schedule that absorbs slippage
A schedule with no buffers is a schedule that will be late. These steps put time where history says it will be needed.
- Work backward from a booked audit window. Confirm Stage 1 and Stage 2 availability with your chosen certification body before you finalize any internal dates.
- Add a fixed operating period. Plan at least 30 to 60 days after the controls go live to collect evidence, run the internal audit and hold the management review.
- Schedule the people, not just the tasks. Put the internal audit, the management review and risk treatment sign-off on executive calendars in month one.
- Hold a buffer for nonconformities. Reserve two to four weeks after the internal audit for corrective actions. Findings are normal; surprise is the problem.
- Cap scope changes. One written approval step, with the schedule effect stated.
- Separate the critical path from nice-to-haves. A polished awareness portal can follow certification. A risk treatment plan cannot.
If you want a structured starting point, our 12-week project plan shows the weekly deliverables for a compact project. Be honest about whether it fits you: it suits organizations that already run mature controls. A company starting from scratch should expect the longer ranges above.
Leading indicators to track every two weeks
Missed milestones tell you about slippage after it happens. These tell you before:
- Evidence count vs. plan. How many recurring controls have produced at least one dated record?
- Owner coverage. What share of risks, assets and controls has a named owner?
- Open decisions over 10 days. Scope questions, tool choices and policy approvals that are stuck.
- Auditor calendar status. Is Stage 1 booked? Is the Stage 2 window held?
- Internal audit readiness. Is an independent auditor named, and is the audit scheduled?
- Vendor dependencies. Which controls depend on a supplier answering a questionnaire or a provider changing a setting?
When two of these turn red at once, move the date or the scope now. Moving a date in month four is a conversation. Moving it in month nine is a customer problem.
Special case: SaaS and regulated U.S. companies
Many of our users are SaaS companies chasing a certificate because enterprise buyers ask for it. Their slippage has a specific shape: engineering sprints compete with control work, and the sales team has already promised a date. Our guide to ISO 27001 for SaaS and tech companies covers how to keep security tasks in the same backlog as product work.
If you also sell into healthcare, another framework competes for the same people. A 30/90/180 day HIPAA plan for SaaS founders shows how phased milestones can be laid out, and the same phasing logic helps you sequence ISO 27001 work alongside it. Where two frameworks overlap, such as access control and incident response, produce one set of evidence and map it to both. Do not run two projects for the same control.
Financial firms face a similar clash with exam and audit cycles. Put your ISMS milestones around those cycles instead of hoping they will not collide.
Our perspective
We built our estimator because the same pattern kept repeating: teams priced the work and timed the work, but never priced the waiting. Waiting for an auditor, for a management review slot, for evidence to accumulate. Those periods are real elapsed time that no amount of overtime shortens.
Our view is that a good estimate shows its assumptions. If a plan says 9 months, you should be able to see that it assumes a booked audit window, a 30 to 60 day operating period and a buffer for corrective actions, and you should be able to edit each one. That is why our calculator keeps its assumptions editable and its methodology traceable. If your sponsor challenges a number, you can show where it came from.
We also think teams should accept an uncomfortable truth early: a short plan is not a good plan. A plan that survives one failed internal audit and one rescheduled review is.
— Martin
Test your own schedule
If you are not sure how much buffer your project needs, start with the free 2-minute readiness check. It gives you a view of where you stand. Then use the ISO 27001 cost calculator to model effort by company size, industry and security maturity, and save several scenarios to compare an aggressive timeline with a cautious one. For a deeper domain-by-domain view, the readiness assessment covers the four Annex A control themes.
FAQ
What is the most common cause of ISO 27001 delays?
Accreditation experts point to missing evidence of an operating ISMS, such as internal audit records and management review minutes, rather than missing documentation. Auditor availability and skipped scoping work come next. Most of these causes can be scheduled around in the first month.
How much buffer should I add to an ISO 27001 plan?
There is no official figure, so base it on the stages. Allow a 30 to 60 day operating period before Stage 2, a gap of about 2 to 8 weeks between audits as your certification body advises, and a couple of weeks for corrective actions after the internal audit. Confirm each with your certification body.
Can I shorten the time between implementation and Stage 2?
Only to a point. The certification body needs to see a working system, including an internal audit and a management review, and that evidence cannot be artificially compressed. You can shorten it by running those two events earlier in the project rather than at the end.
Do I still need to worry about the 2013 to 2022 transition?
Not for new projects. The IAF set October 31, 2025 as the end for 2013 certificates, so a project started now should be built on ISO/IEC 27001:2022. If you are unsure about a lapsed certificate, ask your certification body directly.
Sources
- ANAB: How to seek certification to a management systems standard
- Cleared Systems: Security controls implementation timelines
- CISO Times: Stage 1 and Stage 2 audit preparation guide
- IAF MD 26: Transition requirements for ISO/IEC 27001:2022
- WeeSec: ISO 27001 for B2B SaaS, 12-month roadmap
- Angel Ortega Castro: ISO 27001 implementation for SMEs
- The Startup MD: 30/90/180 day HIPAA plan for SaaS founders