An ISO 27001 fast track is a tightly managed plan that compresses the preparation work: scoping, gap assessment, risk assessment, policies and evidence collection. It does not remove the requirement that your information security management system (ISMS) actually operates for a while before the certification audit. Done well, you can realistically aim for a few months instead of a year. Done badly, you get a pile of documents and a failed Stage 2.
This guide shows which parts of the work can be accelerated, which can’t, what a compressed timeline looks like, and how to size the effort before you commit budget.
TL;DR
- A fast track compresses preparation (scope, gap assessment, risk work, policies, evidence collection). It cannot skip the period your ISMS has to run before Stage 2.
- Published ranges for preparation run from about three months to a year, depending on size, scope, and readiness. Small, focused scopes sit at the short end.
- The biggest accelerators are a narrow scope, executive sign-off on day one, reusable work from other frameworks, and a named owner for every control.
- Management review and internal audit must be finished before the external audits, so schedule them early rather than last.
- Size the effort first. A readiness check and a cost estimate show you whether your target date is realistic.
Table of Contents
- What “fast track” actually means
- How long a fast track really takes
- What you can accelerate
- What you can’t accelerate
- The audit sequence at a glance
- Fast-track tips by company type
- Perspective
- How to size your fast track before you start
- Start with a quick readiness read
- FAQ
- Sources
What “fast track” actually means
Vendors use the phrase in different ways. Some mean a managed program with parallel workstreams and a library of templates, such as one consulting firm’s fast-track service, which describes parallel workstreams, 40+ templates and hands-on guidance from senior security professionals. Others mean a pre-built toolkit you fill in yourself. Others mean reusing an existing audit, such as SOC 2, as a head start.
What they have in common is that they speed up the work you control: how fast you decide, write, assign and collect evidence. Work that typically gets accelerated includes the gap assessment against ISO 27001:2022 and Annex A, ISMS scoping, the Statement of Applicability, policy and procedure development, and audit-ready documentation.
What they cannot speed up is the clock. According to one practitioner analysis, no accelerated program can bypass the operating period before the Stage 2 external audit, because the pace is set by how long the management system must run to produce evidence, not just by how hard you work on documentation. An auditor wants to see that controls are working, not that they are written down.
So the honest definition is this: a fast track shortens the time you spend getting ready to operate, and it lets the operating period start sooner.
How long a fast track really takes
No single number applies to every company. The U.S. accreditation body ANAB says the process can take from several weeks to more than a year, depending on organizational readiness, size, scope, and the number and location of facilities.
A certification body’s guidance narrows it a little: Schellman says preparation can take three months to a year, and lists the factors that move the number: preparation level, employee count, scope changes, nonconformities, ISMS complexity, business type, technology, outsourcing, system development, and the number of sites.
That gives you a useful way to read marketing claims such as “certified in 90 days” or “six months from zero.” They can be true for a small company with a narrow scope, executive support and some existing controls. They are rarely true for a multi-site business with a sprawling scope and no documented processes.
A compressed timeline for a small, focused scope
The table below is our planning model for a small company (for example, a SaaS team of under 100 people with one product in scope). It is an illustration of sequencing, not a guarantee, and your numbers will differ.
| Phase | What happens | Fast-track lever |
|---|---|---|
| Weeks 1 to 2 | Scope, objectives, leadership commitment, owners named | Decide the scope in one workshop, not five meetings |
| Weeks 2 to 5 | Gap assessment against ISO 27001:2022 clauses and Annex A | Assess against a structured checklist instead of free-form interviews |
| Weeks 4 to 8 | Risk assessment, risk treatment plan, Statement of Applicability | Use a pre-built risk register and tailor it |
| Weeks 6 to 12 | Policies, procedures, technical and organizational controls | Parallel workstreams, one owner per control domain |
| Weeks 10 onward | ISMS operates and generates evidence (access reviews, training logs, incident records) | Start operating as soon as each control is ready, not when all are |
| Before Stage 1 | Management review | Put it on the calendar from the start |
| Before Stage 2 | Internal audit, fix nonconformities | Use an independent or trained internal auditor |
The overlap in the middle is the whole trick. Teams that finish all documentation before running anything lose weeks they never get back. For a deeper look at phase lengths, see our ISO 27001 implementation timeline and the companion piece on the certification timeline.
What you can accelerate
Scope
Scope is the highest-leverage decision. Every system, site, team and supplier you include adds controls to implement and evidence to collect. A fast track almost always starts with the narrowest scope that still satisfies the customers or regulators asking for the certificate: one product, one legal entity, one or two locations. You can widen the scope at a later surveillance or recertification cycle.
The gap assessment
A gap assessment tells you which requirements you already meet. Instead of discovering gaps one at a time during implementation, score every clause and control up front, then sequence the work by effort and risk. Our ISO 27001 certification checklist breaks the whole job into 80 steps you can assign, and our Annex A controls explainer helps your owners understand what each control expects.
The Statement of Applicability
The Statement of Applicability (SoA) lists which Annex A controls you apply and why. It depends on your risk assessment, so it can’t be finished first, but a template with the controls already listed saves days. Our Statement of Applicability guide walks through the structure.
Policies, procedures and the documentation set
Writing is where templates help most. Start from a proven policy set, then edit it to describe what your company really does. An auditor will test whether you follow your own documents, so a short policy that matches reality beats a long one that doesn’t.
The foundation is dull but essential: asset inventories, access control, backup, patching, vendor review, incident response, and employee training. If your IT team is thin, an outside provider that handles the foundational security work can get the basics in place while your staff focus on ISMS ownership and evidence.
Reusing work you’ve already done
Many companies arrive with a SOC 2 report, a NIST-based program, customer questionnaires, or a cyber insurance application. Those controls and evidence sets overlap heavily with ISO 27001. Mapping them to Annex A can cut the gap list considerably. NIST’s work on OSCAL, a machine-readable format covering multiple frameworks including ISO 27001 and NIST SP 800-53, shows why crosswalking is a recognized practice. Our crosswalk guide shows five steps from a NIST mapping to audit evidence.
One caution that matters for finance and any company that relies on cloud vendors: a vendor’s SOC report covers the vendor, not you. American Banker’s advice to credit unions is not to present a cloud host’s SOC report as their own, because it doesn’t ensure the security of your specific product. In ISO 27001 terms, you still need your own supplier controls and evidence.
What you can’t accelerate
The operating period. Controls have to run long enough to leave a trail: access reviews that happened, training that was completed, incidents that were logged and closed. The Stage 2 audit tests whether controls are implemented and working, not just whether they exist on paper.
Management review and internal audit. Both are mandatory and have to be finished before the external audits. Schellman’s guidance puts it plainly: they come before the certification body begins Stage 1 and Stage 2. Plan them as milestones, not afterthoughts.
The certification body’s schedule. In the U.S., the audits are performed by accredited certification bodies, not by the accreditation body itself, as ANAB explains. Good ones book weeks out, so request quotes and hold audit dates while you are still building.
Leadership commitment. ISO 27001 is a cycle, not a one-time project. Schellman describes it as a management system that demands constant resources and top-down support. A fast track without an executive sponsor stalls the first time a control needs budget.
The audit sequence at a glance
- Stage 1: a document and readiness review by the certification body. It confirms your scope, SoA, risk work and management review are in place.
- Fix the findings. Close anything the auditor flagged before moving on.
- Stage 2: the operational audit, where the auditor samples records and tests controls.
- Nonconformities: address them before certification is issued.
Our article on the audit stages and what sample records auditors ask for lists the evidence compliance teams usually need ready.
Fast-track tips by company type
SaaS and tech startups
Startups often move fastest because there is little legacy to untangle. Keep the scope to the production environment and the teams that touch it, use your cloud provider’s native logging and access tools as evidence sources, and write policies a small team will actually follow. The SaaS and tech company guide covers the decisions specific to product teams.
If your team has never done this before, the first step ANAB recommends for newcomers is to get familiar with the standard itself. A day spent reading Clauses 4 to 10 saves weeks of rework.
Finance firms
Financial companies tend to have more existing controls, which shortens the gap list, but also more third parties, more regulators and stricter customer questionnaires. Vendor management and evidence of oversight deserve extra time. Our audit prep guide for finance companies goes deeper.
Companies already on the 2013 edition
If you hold an older certificate and need to move to the 2022 revision, ISACA notes that a 90-day transition challenge can work, as long as the process stays holistic and interconnected rather than a checklist exercise.
Perspective
The most common mistake we see in fast-track plans is a date chosen before the effort is known. Teams pick “certified by Q2,” then discover that scope, maturity and headcount make that either easy or impossible.
We built ISMS Calculator around the opposite order: estimate first, commit second. When you enter your company size, industry and security maturity, you get a real-time estimate of cost and effort, with assumptions you can edit and a methodology that is traceable and versioned. If the number surprises you, you can change the scope, compare scenarios side by side, and see what a narrower plan does to the timeline before you spend anything.
A fast track is a good idea. A fast track built on an unchecked guess is how companies end up paying twice. We would rather you validate the plan against model reference comparisons and then move quickly with confidence.
Martin
How to size your fast track before you start
Before you ask anyone for a quote or set a date, answer five questions:
- What is in scope? Name the product, entities, locations and suppliers.
- How mature are your controls today? Do you have documented access control, change management, incident response, and vendor review, or are they informal?
- Who owns what? Every control domain needs a named owner and a backup.
- What can you reuse? List existing SOC 2 work, NIST mappings, and customer security answers.
- Who needs the certificate, and by when? A customer deadline is a real constraint; an internal wish is not.
The answers drive both the cost and the calendar. Our methodology page explains how the estimate treats these inputs, so you can challenge any figure you disagree with.
Common fast-track pitfalls
- Template overload. Copying policies you don’t follow creates nonconformities.
- Scope creep. Each added system extends evidence collection. Freeze the scope after the gap assessment.
- Late internal audit. If the first audit finds major gaps two weeks before Stage 2, the schedule slips.
- No evidence habit. Control owners who don’t save records leave you rebuilding the trail later.
- Tool before process. Software helps organize evidence, but it can’t invent the process for you.
If your implementation includes technical hardening, logging, and documentation before the audits, specialists who deliver advanced security controls and documentation can take on the heavy lifting while your team keeps ownership of the ISMS.
Start with a quick readiness read
If you are weighing a fast track, the quickest first step is to find out where you stand. Our free 2-minute check gives you an instant readiness read, with no signup needed for the initial calculation. When you want the full picture, the ISO 27001 readiness assessment covers maturity across the four Annex A control themes, and the cost calculator turns your answers into an estimate you can save, compare, export as a PDF, and share by link. If you want outside help, you can also request an introduction to an independent ISO 27001 consultant.
Building the plan inside the calculator lets you add customizable Gantt-style phases, so the timeline your executives see matches the assumptions behind the budget.
FAQ
Can you get ISO 27001 certified in 90 days?
Sometimes, for a small company with a narrow scope, strong executive support and existing controls. Published guidance puts preparation anywhere from three months to a year, so 90 days sits at the optimistic end. The limiting factor is usually the operating period, not the paperwork.
Does a SOC 2 report make ISO 27001 faster?
Usually yes, because many controls and evidence types overlap, so your gap list is shorter. You still need ISO-specific elements such as the scope statement, risk treatment plan, Statement of Applicability, internal audit and management review. Start by mapping existing controls to Annex A.
Can a consultant or software guarantee a fast certification?
No. Neither can control how long your ISMS must operate or when the certification body can schedule your audits. They can remove delays in your own work, such as unclear scope, missing owners and weak documentation. Be cautious of any promise that ignores the audit calendar.
What should I do first if I want to move quickly?
Decide your scope, secure an executive sponsor, and run a gap assessment. Those three steps set the length of everything after them. A short readiness check and a cost estimate will tell you whether your target date is realistic.
Sources
- ISO27001 Fast Track, Cubic Consulting
- How Long ISO 27001 Certification Takes, Cybernion
- How to Seek Certification to a Management Systems Standard, ANAB
- 6 Factors That Can Affect the Timeline of an ISO 27001, Schellman
- Prepare for the ISO 27001 Certification Process, Schellman
- Navigating the ISO/IEC 27001:2022 Transition: A 90-Day Challenge, ISACA
- NIST OSCAL: What It Is and Who Needs It
- CUs shouldn’t ignore risks posed by cloud-based vendors, American Banker
- ISO 27001 for SaaS Startups: A Practical 90-Day Roadmap, ISOReady360