Most organizations complete ISO 27001 certification in 6 to 10 months, with well-prepared small companies finishing in 3 to 4 months and complex, multi-site enterprises often needing 12 months or more, according to scenario data from governance compliance guides. That range hides two separate clocks running side by side: an implementation clock (building the ISMS and gathering evidence) and an audit clock (scheduling Stage 1, Stage 2, and the certification decision). The implementation clock almost always determines your total, because certification bodies require proof that your information security management system has actually been running before Stage 2 can even start.
That single rule trips up more teams than any documentation gap. You cannot write policies on a Friday and audit them the following Monday.
- Fast path: 3 to 4 months, for small, single-site companies with mature IT practices already in place
- Typical path: 6 to 10 months, for most mid-market organizations
- Complex path: 9 to 15+ months, for multi-site, multi-subsidiary, or highly regulated enterprises
- Gating requirement: your ISMS needs an operating history, including a completed internal audit and management review, before Stage 2 can be scheduled
Key Takeaways
Certification timing is determined less by paperwork speed than by how long your ISMS has actually been operating and generating evidence before Stage 2.
Table of Contents
- How Long Does ISO 27001 Certification Take, Phase by Phase?
- What Happens During the Pre-Audit Implementation Phase?
- What Do Stage 1 and Stage 2 Audits Actually Involve?
- How Long Does Certification Take at Different Company Sizes?
- What Factors Speed Up or Slow Down Certification?
- Building a 6-Month Implementation Planner
- What Happens After You Get Certified?
- How a Planning Tool Shortens the Guesswork
- Why the Three-Month Operating Rule Exists
- What This Timeline Really Tells You
- Sources
How Long Does ISO 27001 Certification Take, Phase by Phase?
Certification breaks into five phases, and the calendar time each one eats varies enormously depending on how much groundwork you’ve already done.
- Scoping and gap analysis (weeks 2 to 6): Define what’s in scope, run a gap assessment against Annex A controls, and build your project backlog.
- Risk assessment and Statement of Applicability (weeks 4 to 10, often overlapping with phase 1): Identify risks, choose treatments, and document why each control is included or excluded.
- Control implementation and documentation (months 2 to 5): Deploy technical and procedural controls, write policies, and start collecting evidence.
- Operating period (minimum ~3 months): Run the ISMS live, complete an internal audit, and hold at least one management review.
- Audit and certification decision (2 to 5 months): Stage 1 documentation review, a remediation gap, Stage 2 verification, and the certification body’s internal sign-off.
Your organization controls the first three phases almost entirely. Phase 4’s floor is set largely by the certification body’s expectations, not your speed. Phase 5 depends partly on your audit firm’s calendar, since Stage 2 must generally happen within several months of Stage 1 and busy auditors book out weeks in advance.
The operating period is the phase teams underestimate most. You can compress documentation with templates and automation, but you cannot compress the requirement that controls have been live long enough to produce audit evidence. That’s the floor beneath every “fast track” claim you’ll see online.
What Happens During the Pre-Audit Implementation Phase?
This is where 70 percent or more of your total timeline actually lives, and where most delays start. Get the following steps right and everything downstream moves faster.
Scope definition comes first, and it deserves more attention than most teams give it. Decide which business units, locations, systems, and data flows fall inside the ISMS boundary, then get formal signoff from an executive sponsor. Loose scoping, like vaguely including “all customer data” without defining systems and boundaries, is one of the most common sources of Stage 1 findings. Budget one to two weeks for scope alone, with a named ISMS owner accountable for keeping it locked.
Gap analysis compares your current controls against the 93 controls in Annex A and produces a prioritized backlog, not a report that sits in a shared drive. Tools built for this, including our ISO 27001 gap analysis guide, can turn a two-week manual exercise into a few days of structured work.
Risk assessment and the Statement of Applicability follow directly from the gap analysis. You identify risks, assign owners, choose treatments, and document why each Annex A control is included, excluded, or modified. This is the document Stage 1 auditors scrutinize hardest, so sloppy justifications here cause more remediation than any other single artifact.
Control implementation is the longest single stretch, typically two to five months depending on scope. Technical controls (access management, encryption, logging) usually move faster than procedural ones (incident response drills, vendor risk reviews, training records), because procedural controls need repeated evidence over time, not a one-time configuration change.
Running the ISMS long enough to generate evidence is the step that can’t be rushed. You need a completed internal audit and at least one management review with documented minutes and follow-up actions before a certification body will schedule Stage 2.
- Reuse SOC 2 or HIPAA evidence where controls overlap. AICPA SOC resources map cleanly onto several ISO 27001 domains, especially access control and change management.
- Parallelize workstreams. Risk assessment, policy writing, and technical control deployment don’t need to happen in sequence.
- Use a documented checklist rather than reinventing structure. Our ISO 27001 certification checklist covers all 80 steps most teams need to track.
Pro Tip: Start your internal audit the moment your highest-risk controls go live, not after every control is finished. A partial internal audit against critical controls, followed by a second pass closer to Stage 2, often beats waiting for 100 percent completion before auditing anything.
What Do Stage 1 and Stage 2 Audits Actually Involve?
Stage 1 is a documentation review, and it’s shorter than most people expect: usually one to two days on-site or remote, spent checking your Statement of Applicability, risk assessment, policies, and internal audit records for completeness. Auditors aren’t testing whether controls work yet. They’re confirming your ISMS is structurally sound enough to be tested.
Most organizations get a list of minor gaps after Stage 1, not a pass or fail. The typical remediation window runs four to eight weeks, and certification bodies generally require Stage 2 to happen within six months of Stage 1, so don’t let the gap stretch indefinitely.
Stage 2 verifies that controls actually operate as documented. Auditors sample evidence: access logs, training records, incident tickets, vendor assessments, and internal audit findings. This stage runs longer, often three to five days depending on scope and site count, because auditors need enough samples to be confident the ISMS isn’t just paperwork.
After Stage 2, the auditor compiles a report for the certification body’s internal technical review. That administrative step can add several weeks to a few months before your certificate is actually issued, which surprises teams who assume the audit itself is the finish line.
Common nonconformities that add real time:
- Incomplete or inconsistent risk treatment documentation in the Statement of Applicability
- Internal audits that only checked a handful of controls instead of the full scope
- Missing evidence of management review decisions, especially follow-up on prior action items
- Access control exceptions that were never formally risk-accepted
Each of these is preventable with a thorough internal audit before you ever schedule Stage 1 — see our practical checklist for SA teams to get started.
How Long Does Certification Take at Different Company Sizes?
Your timeline depends far more on organizational complexity and existing compliance maturity than on headcount alone. A 200-person company with three offices and custom infrastructure can take longer than a 500-person company running entirely on well-governed cloud platforms.
- Startup, fast path: A single-site SaaS company with modern cloud infrastructure and no legacy systems can realistically target 3 to 4 months, provided leadership treats it as a full-time project for at least one person.
- Small to mid-market: Most companies in the 50 to 500 employee range land at 6 to 8 months, with delays usually traced to slow control implementation rather than audit scheduling.
- Mid-market with complexity: Multiple product lines, contractors, or partial remote workforces tend to push this to 8 months even with good management support.
- Enterprise or multi-site: Organizations with multiple subsidiaries, on-premises data centers, or regulatory overlays commonly need 9 to 15 months or longer, largely due to scope negotiation and evidence collection across sites.
- Existing SOC 2 or HIPAA programs: Mature compliance programs can shave two to three months off implementation, because access control, logging, and vendor management evidence often transfers directly.
If you’re a technology company weighing whether your existing engineering practices already satisfy several Annex A domains, our guide on ISO 27001 for SaaS and tech companies breaks down which controls typically need the least rework.
What Factors Speed Up or Slow Down Certification?
A handful of variables explain most of the variance between a 4-month project and a 12-month one.
- Scope boundaries. Narrower, well-justified scope shrinks every downstream phase. Overly broad scope multiplies evidence requirements across every team you included.
- Existing control maturity. Organizations with established access management, logging, and vendor review processes skip weeks of buildout.
- A single accountable owner. Projects with one named ISMS lead consistently move faster than those run by committee, because decisions on control ownership and risk acceptance don’t stall in email threads.
- Automation and templates. Policy templates, GRC tools, and dedicated calculators cut documentation time substantially, though they cannot shorten the operating-evidence period itself.
- Certification body scheduling. Popular auditors book out 4 to 8 weeks in advance; book your Stage 1 slot as soon as you have a realistic completion date, not after you’re fully ready.
- How you triage Stage 1 findings. Fixing the highest-risk gaps first, rather than working through the list alphabetically, shortens the remediation window before Stage 2.
Building a 6-Month Implementation Planner
If your organization has decent baseline maturity, this month-by-month structure works as a starting Gantt template.
- Month 1: Finalize scope, appoint an ISMS owner, run the gap analysis, and kick off risk assessment.
- Month 2: Complete the Statement of Applicability, begin control implementation, and start policy drafting in parallel.
- Month 3: Continue control rollout, launch evidence-collection processes, and schedule your internal audit for month 4.
- Month 4: Run the internal audit, hold the first management review, and remediate any findings.
- Month 5: Confirm the ISMS has an adequate operating history, schedule Stage 1, and address any last documentation gaps.
- Month 6: Complete Stage 1, remediate minor nonconformities, and enter Stage 2 within the following weeks.
| Deliverable | Owed by | Stage it satisfies |
|---|---|---|
| Statement of Applicability | End of month 2 | Stage 1 |
| Internal audit report | Month 4 | Stage 1 and Stage 2 |
| Management review minutes | Month 4 | Stage 1 and Stage 2 |
| Control evidence samples | Ongoing from month 3 | Stage 2 |
| Remediation log from Stage 1 | Month 5–6 | Stage 2 |
Run risk assessment and control implementation in parallel rather than sequentially, and get your internal audit scheduled the moment core controls stabilize. For a longer version of this planning structure, see our ISO 27001 implementation timeline guide.
What Happens After You Get Certified?
Certification isn’t a one-time event. It’s a three-year cycle with recurring obligations that catch first-time certificate holders off guard.
- Annual surveillance audits in years 1 and 2 confirm your ISMS is still operating as certified. These run shorter than the original Stage 2, often one to two days, but still require current evidence.
- Recertification happens at year 3, essentially repeating a full Stage 2 style audit against your updated risk landscape.
- Ongoing ISMS activities never stop: internal audits, at least one management review per year, and corrective action tracking for anything surveillance auditors flag.
Budget staff time for this every year, not just in the months leading up to your original certificate. NQA’s certification guidance confirms this surveillance and recertification structure is standard across accredited bodies.
How a Planning Tool Shortens the Guesswork
Uncertainty about timing is what makes ISO 27001 projects feel unpredictable, and that’s exactly the gap ISMS Calculator is built to close. Its real-time estimator generates a tailored timeline and effort projection based on your company size, industry, and current security maturity, instead of forcing you to average out generic ranges from different guides.
- Industry benchmarks let you check your projected timeline against similar organizations before committing to a deadline
- Maturity assessments across 14 ISO domains pinpoint exactly which control areas will eat the most implementation time
- Exportable Gantt charts turn a rough plan into a schedule your project team can actually track
- A free 2-minute readiness check gives a starting estimate before you invest in deeper planning
Pro Tip: Use a readiness tool to compress Stage 1 preparation, not to skip the operating period. No calculator or template can substitute for the months your ISMS needs to actually run and generate evidence.
Run a free readiness check to see where your organization likely falls on the timeline before you build a formal project plan.
Why the Three-Month Operating Rule Exists
Certification bodies didn’t invent the roughly three-month operating requirement to slow you down. They need proof your controls work in practice, not just on paper, and that requires enough elapsed time for logs, tickets, and reviews to accumulate naturally.
An internal audit run against a two-week-old control tells you almost nothing about whether that control holds up under real operational pressure. A management review needs actual incidents, actual metrics, and actual decisions to review, not a blank template signed the same week the ISMS launched. NQA’s guidance on certification confirms auditors expect this operating history as a baseline, not an optional nicety.
This is also why “certified in six weeks” claims you’ll sometimes see from consultants should raise skepticism. Unless an organization already had a functioning ISMS with months of history behind an informal name, that timeline almost always means the operating period got skipped or falsified. Auditors who catch gaps between claimed evidence dates and system logs will flag it immediately, and that costs far more time than doing it right the first time.
Plan for three months as a floor, not a target. If your controls have been running longer, even informally, before you formalize the ISMS, that history often counts toward satisfying this requirement.
What This Timeline Really Tells You
The conventional advice on ISO 27001 timing treats it as a documentation problem: write enough policies, fill enough templates, and certification follows. That’s backward. The evidence here points to operating history as the real constraint, and most delays trace back to teams who built a beautiful ISMS on paper and then discovered they hadn’t run it long enough to prove anything.
The scenario data is blunt about this: small, disciplined companies hit 3 to 4 months not because they skip steps, but because they start the operating clock earlier by launching controls before documentation is even finished. Enterprises that stretch past a year usually aren’t slow at writing policies. They’re slow at deciding scope and then re-deciding it three months later.
If you take one thing from this, prioritize locking scope and starting your operating period earlier than feels comfortable. Everything else, including audit scheduling and documentation polish, can happen in parallel once that clock is running.
— Martin
Sources
- ISO/IEC 27001 — Information security, cybersecurity and privacy protection — ISO
- ISO 27001 Timeline: How Long Does Certification Take?
- ISO 27001 Certification - Information Security System | NQA
- ISO 27001 Certification Timeline: How Long It Really Takes (ComplyJet)