ISO 27001 certification process: steps and timeline

What is the ISO 27001 certification process and how long does it take?

When a customer or contract requires ISO 27001, the organization itself builds an information security management system (ISMS) that meets clauses 4 to 10 of ISO/IEC 27001:2022 and records its control decisions in a Statement of Applicability. An accredited certification body then runs a two-stage initial audit and, if the findings are acceptable, issues the certificate. The organization owns every control and every decision in that record. ISO does not certify organizations, and neither does DeployOpen: our role is to prepare systems, controls and evidence so the certification body has something concrete to test. No overall duration is supplied as a fact for this topic, so treat any figure you hear, including ours, as an estimate until it is written into a plan. Total time depends on three things: how much of the ISMS already exists, how wide the scope is (the number of people, sites and systems the certificate will cover), and when the certification body can schedule stage 1, the interval, and stage 2. Ask the certification body for its audit programme and audit plan early, because it prepares these before stage 1 so you know what will be audited and when. Ask your implementation partner for a written plan that separates preparation work from the audit calendar.

Once the certificate is issued, the clock moves to a three-year certification cycle. Under ISO/IEC 17021-1, the certification body must carry out at least one audit in every calendar year of that cycle, either a surveillance audit or the recertification audit that closes the cycle. A certificate must show the expiry or recertification due date, and one issued with a one-year validity does not conform. Plan the first surveillance audit as a standing commitment, not an occasional event, because a delayed audit must be justified by the certification body and cannot be used to push the next year's audit back. For the work ahead, confirm the following in writing before you sign: the scope and the people in it, the stage 1 and stage 2 dates, who on your side owns each open item, and the deadline for closing any major nonconformity. Under ISO/IEC 17021-1, if corrections for a major nonconformity cannot be verified within 6 months after the last day of stage 2, another stage 2 must be conducted before certification can be recommended. Check that the Statement of Applicability and risk treatment plan are finished before stage 1 starts, since auditors read them first.

Which phases take an organization from decision to certificate?

The sequence runs from setting scope to a certification decision, and each phase leaves a named document or record that the next phase depends on. The organization owns the management system throughout, while the certification body only audits it and decides on certification.

Decide scope and secure leadership ownership
Leadership decides why the organization is pursuing certification, which products, sites, systems and people fall inside the information security management system, and who is accountable for it. Clause 4.3 requires a documented scope, and clause 5 requires top management to show commitment and set an information security policy. The output is a scope statement and a signed policy, both owned by the organization. The step is done when the scope is written down and a named executive has accepted responsibility for the ISMS.
Build the ISMS against clauses 4 to 10
The team builds the management system the standard requires: the context of the organization and interested parties, roles and responsibilities, objectives, resources, competence and awareness, documented information, operational processes, performance measurement, internal audit and management review. Every clause from 4 to 10 applies in full, so none of it can be left out of scope. The organization owns this work, and a consultant or implementation partner can prepare documents and evidence but cannot make the decisions. The step is complete when each clause has a documented process and an owner who can show it operating.
Assess risk and write the Statement of Applicability
The organization identifies its information security risks, evaluates them, and selects a risk treatment for each. It then compares its necessary controls with the 93 Annex A controls so that none is overlooked, and records every control as included or excluded with a justification. The outputs are a risk assessment record, a risk treatment plan and a Statement of Applicability. The organization owns these documents and must keep the Statement of Applicability consistent with the risk treatment plan. The step is done when every Annex A control has a recorded decision and status.
Choose and contract an accredited certification body
The organization compares accredited ISMS certification bodies, checks that each works to ISO/IEC 17021-1 and ISO/IEC 27006-1, and confirms accreditation before signing. The contract covers the audit scope, fees, and how the body handles impartiality. The organization pays the certification body for audit time, while any consultant is paid separately and cannot also act as the auditor. The output is a signed agreement and a named audit team. The step is complete when the body confirms the application and the scope it will audit.
Receive the audit programme and plan for stage 1
Before the stage 1 audit, the certification body prepares an audit programme and an audit plan, so the organization knows what will be examined and when. For the first certification cycle, the body prepares the programme before stage 1 and revises it after the certification decision. The organization owns the readiness work that follows, including internal audit and management review. The output is an approved audit plan with dates agreed in advance. The step is done when the organization has the plan and has confirmed its people and documents are ready.
Complete the stage 1 documentation review
The stage 1 audit checks whether the documented ISMS is ready for a detailed assessment. The auditors review the scope, policy, risk assessment, Statement of Applicability and the evidence that clauses 4 to 10 are in place, and they report any gaps that must be addressed before stage 2. The organization owns the response, updating documents and filing evidence. The output is a stage 1 report and a list of items to resolve. The step is complete when the body confirms the organization may proceed to stage 2.
Run the stage 2 implementation audit
The stage 2 audit tests whether the ISMS is implemented and operating as documented. Auditors sample records, interview staff, and check that Annex A controls selected in the Statement of Applicability actually work in practice. The organization owns the evidence, including logs, access reviews, incident records and internal audit results. The output is a stage 2 report that lists any nonconformities, classified as major or minor. The step is done when the audit closes and the body issues its findings.
Close nonconformities and reach the certification decision
The organization corrects each nonconformity and submits corrective action evidence. Major nonconformities must be verified within 6 months after the last day of stage 2. If the body cannot verify corrections in that window, it must conduct another stage 2 before recommending certification. The certification body, separate from the audit team, then makes the certification decision. The output is a certification decision and, if positive, the first certificate that states the scope and the expiry date of the three-year cycle. The certificate is the body's document, not the organization's, and it can be checked through IAF CertSearch.

What must the ISMS prove before the first audit starts?

Before a certification body books stage 1, the organization needs a working information security management system (ISMS) that already runs across every management system clause. Clause 1 of ISO/IEC 27001:2022 makes this non-negotiable: an organization claiming conformity may not exclude any requirement in clauses 4 to 10, so the auditor tests all of them. The Annex A controls work differently. The 93 Annex A controls are not all required in the same way. You select the ones you need through risk treatment, then record the choices and justifications in the Statement of Applicability under clause 6.1.3. Confirm that scope choice with your certification body early, because it determines what evidence the auditor expects to see.

Clauses 4 to 10 cover the organization's context and interested parties (clause 4), leadership commitment and policy (clause 5), planning, including risk assessment and objectives (clause 6), support such as resources, competence, awareness and documented information (clause 7), operation (clause 8), performance evaluation through monitoring and internal audit (clause 9), and improvement, including nonconformity handling (clause 10). Auditors test these by sampling records, not by reading policies alone. Expect to show meeting minutes where leadership reviewed information security, a risk register with owners and dates, internal audit reports with findings and an independent auditor, and management review outputs that set actions. Each record should show that the process ran, not only that the document exists.

Ask yourself one question for each clause: can I show a dated record from the last few months that proves this process operated? If the answer is no for any clause, the gap is the first thing to close, because stage 1 reports on readiness and an open gap there will shape the stage 2 plan. Have an outside gap analysis or a certification body's pre-audit review this evidence, but remember that neither replaces the organization's own ownership of the ISMS.

What should be in place before the ISO 27001 certification audit?

Before booking stage 1, the organization should be able to show a settled scope, a finished risk picture, a Statement of Applicability that matches it, and a management system that has actually run. Each check below can be verified by the organization itself, and each one maps to something the certification body will ask to see.

Approved scope document

The ISMS scope must be written, approved by management and stated in terms of the business units, locations, systems and interfaces it covers. Check that the scope names every clause 4 to 10 requirement as applying and that any excluded items are justified in writing. Auditors will ask who approved the scope, when, and whether the people, sites and cloud accounts in it match what is actually operated. A scope that changes after stage 1 can move the audit, so settle it first.

Completed risk assessment and treatment plan

The organization needs a documented risk assessment using its own criteria, with identified risks, owners, likelihood and impact ratings, and a risk treatment plan that says how each risk is handled. Check that every risk has a recorded decision and that the plan covers the controls the organization says it needs. Auditors will ask to trace a sample of risks to treatment decisions and to see evidence that the assessment was repeated at planned intervals.

Statement of Applicability in step with the plan

The Statement of Applicability records which Annex A controls are necessary, how each is implemented, and why any control is excluded. Check that every control in the 93-item comparison has a status and a justification, and that each implemented control points to the treatment plan and to a real artifact. Auditors will pick controls at random and ask for the matching policy, configuration or record. Any mismatch between the plan and the SoA is a common finding.

Records showing the ISMS has operated

A certification body expects the management system to have run for a period, not only to exist on paper. Check for management review minutes that cover the required inputs, at least one internal audit with a documented programme and independent auditor, and a corrective action log showing root cause and closure. Auditors will ask for dated records and will test whether findings from internal audits led to changes. Confirm the period covered with your certification body, since the expected duration depends on the body and the scope.

Named owners for each control

Every implemented control should have a named person accountable for it, with a deputy where the control depends on one individual. Check the owner list against the Statement of Applicability and confirm each owner knows the control's purpose and the evidence it generates. Auditors will often ask an owner to explain a control in their own words and to show how they know it is working. Gaps here usually show up in interviews rather than in documents.

Access to evidence sources

Auditors need read access to the systems that produce evidence: identity provider logs and access reviews, centralized logging, endpoint management records and the ticketing system that tracks changes and incidents. Check that the team can export these records for a chosen period without manual reconstruction. Ask whether any evidence lives only in personal drives or chat threads, since that is hard to defend in an audit. Pre-audits and gap analyses help find these gaps, but they do not replace the stage 1 review that the certification body performs.

Who owns each step of the ISO 27001 certification process?

The organization owns its information security management system (ISMS) from start to finish. ISO/IEC 27001:2022 requires top management to demonstrate leadership, and the decisions that define the ISMS cannot be handed to anyone else. A consultant can draft material, but the organization must accept the risks, set the scope, approve the policies and answer for the results.

Scope and policy decisions: Management sets the ISMS scope, approves the information security policy and assigns roles and responsibilities.
Risk decisions: The organization performs the risk assessment, chooses risk treatment options and accepts residual risk.
Statement of Applicability: Staff decide which Annex A controls are necessary, justify inclusions and exclusions, and keep the document in step with the risk treatment plan.
Internal audit and management review: The organization runs internal audits of the ISMS and reviews results at planned management meetings, then acts on what they find.
Operation and evidence: Control owners run daily controls and keep the records that show them working.

Before engaging any outside party, confirm which of these decisions your leadership team will sign and who will maintain them after the certificate is issued.

Which certification route fits the organization?

This table compares three routes: full certification through an accredited body, a readiness assessment without certification, and building the ISMS now without seeking certification. Read each row against the customer's written requirement, because the formal outcome and who issues it differ by route.

Route	What it produces and who issues the outcome	When it fits and what to confirm first
Full certification	An ISO/IEC 27001 certificate issued by an accredited certification body after the stage 1 and stage 2 audits. ISO does not issue certificates.	Fits customers or contracts that name certification or ask for a certificate number. Confirm the required scope, whether the body must be accredited, and the certificate expiry or recertification date the customer will check.
Readiness assessment or gap analysis	A findings report prepared by the organization's chosen adviser or internal team. It is not a certificate and no certification body issues it.	Fits customers that accept a self-assessment or readiness letter, or organizations that want to learn their gaps before committing to audit. Confirm in writing that the customer accepts a non-certified document and who will sign it.
Implementing the ISMS without certification	Working clauses 4 to 10, the Annex A controls, the risk treatment plan and the Statement of Applicability, with evidence kept. No external outcome is issued.	Fits organizations that need the controls for their own risk management and can answer questionnaires with evidence. Confirm whether the customer will later require certification and whether a deadline applies to the contract.
Who owns the controls	The organization owns its controls and records under every route. An implementation partner prepares systems and evidence, and only an independent auditor or certification body issues reports or certificates.	Confirm which partner tasks are in the written scope, and which decisions, sign-offs and internal audits remain with the organization's own staff.
Evidence the buyer can show	Under certification, the certificate and scope statement. Under the other two routes, the ISMS documents, the Statement of Applicability and dated evidence of operation.	Ask the customer which evidence format it accepts. A certified scope covers only the sites and services named, so confirm that the scope matches the service the customer buys.
Effort and timing	Certification adds the audit programme, the stage 2 gap window and annual audits across the three-year cycle. The other routes avoid external audit scheduling.	Costs and durations depend on scope and the people in it. Request a written quote for each route from the certification body or adviser rather than comparing estimates across routes.
Re-entry path	A certified organization that lapses must rebuild the audit cycle. A readiness or implementation project can move to full certification later with its documents intact.	Confirm with the customer whether a readiness route will be accepted now and if a later certificate will be required, so the early documents match the scope the auditor will test.

How to choose and check the certification body

Only an accredited certification body can issue an ISO 27001 certificate that customers and regulators will recognize. The cards below cover the checks to run before signing, the questions to put to the body, and the verification to repeat once the certificate arrives.

Confirm accreditation for ISMS certification

Ask the body which accreditation body accredits it and confirm, in that accreditor's listing, that its scope covers ISO/IEC 27001 certification of information security management systems. A body that offers ISO 27001 certification without accreditation may issue a document that looks like a certificate but carries no assurance for your customers. ISO advises checking whether a body is accredited, so make this the first gate in your evaluation, before fees are discussed.

Confirm the standards the body applies

Ask the body to confirm in writing that it works to ISO/IEC 17021-1 and ISO/IEC 27006-1:2024. The second standard sets requirements specific to information security audits, and IAF MD 29:2024 required accredited bodies to apply it to all clients by 31 March 2026. A body that cannot name both standards, or that offers an older arrangement for your audit, should be asked how it will meet the deadline before you commit.

Check independence from the ISMS design

A certification body must remain impartial, so it should not design, implement or write the ISMS it will later audit. Ask whether the body or its affiliates offer consulting on ISO 27001, and if so, how they separate those teams. Keep the readiness work with your own staff or a separate implementation partner, and record who prepared each document so the auditor's findings stay credible.

Ask how stage 1 will be scoped

Ask how the body plans the initial audit, when it prepares the audit programme and audit plan, and what it will check at stage 1 before stage 2 begins. The body should explain that it prepares the audit programme before stage 1 and revises it after the certification decision. Vague answers here usually predict surprises in the timeline, so ask for the planned sequence in writing before you book the first audit date.

Confirm the certificate shows the cycle end

Before you sign, ask the body to confirm that the certificate will display the expiry or recertification due date that completes the three-year cycle. Certificates issued with a one-year validity do not conform to ISO/IEC 17021-1. Also confirm that an audit will take place in every calendar year, since a delayed audit must be justified by the body and cannot be used to push the next year's audit back a year.

Verify the certificate in IAF CertSearch

Once the certificate is issued, check it independently in IAF CertSearch, which ISO points to for accredited certificates. Search by certificate holder, confirm the certified scope matches your ISMS scope, and confirm the issuing body is listed. Repeat the check at each surveillance and recertification audit, and give the same link to customers who ask for proof rather than a copy of the PDF.

What the three-year cycle asks after the certificate is issued

The certification cycle is three years, and the certificate itself must show the expiry or recertification due date that completes that cycle. A certificate issued with a one-year validity does not conform to the ISO/IEC 17021-1 cycle rule, as European Accreditation FAQ 51.7 makes clear. Before accepting a certificate, check that its dates match a three-year cycle and that the certification body is accredited, since buyers will check the same dates when they verify the certificate in IAF CertSearch or through the certification body.

Certification bodies must carry out at least one audit, either surveillance or recertification, in every calendar year of the cycle. European Accreditation FAQ 37.12 treats a delayed audit as an exceptional case that the certification body must justify, and it cannot be used to push the next year's audit back by a year. For the organization, this means the annual audit date is effectively fixed from the first certification decision onward, so the internal work that feeds it needs a calendar, not a single pre-audit push. Confirm with your certification body how it schedules the annual audit and what it expects in the surveillance scope each year.

Between audits, the organization owns the management system. It must keep running internal audits under clause 9.2, hold management reviews, reassess risks at planned intervals, and close corrective actions with recorded evidence. An implementation partner can help build the audit programme, prepare review packs, and keep the Statement of Applicability and risk treatment records current, but it cannot perform the management review or sign off the results on the organization's behalf. Buyers will check the cycle over time, not only the first audit, so the question to answer each quarter is whether the evidence for the last surveillance audit is still accurate.

What usually delays the ISO 27001 certification process?

Most ISO 27001 delays trace back to a few decisions made too late or not checked against each other. The cards below cover the scope, the Statement of Applicability, operating evidence, internal review, technical evidence and the choice of certification body, and say which stage of the process each one slows down.

Scope set late or changed after stage 1

The scope under clause 4.3 decides which people, sites, systems and services the auditor must examine. If it is settled after the stage 1 audit has been planned, the audit programme and audit plan may have to be rebuilt, and the stage 1 review may need to be repeated. Fix the boundary in writing before the certification body prepares its plan, and confirm with the body which changes after stage 1 would reopen earlier findings.

Statement of Applicability out of step with risk treatment

The Statement of Applicability records which Annex A controls are necessary, why each is included or excluded, and how it is implemented. When it does not match the risk treatment plan, an auditor finds controls that are claimed but not tied to any risk, or risks that have no selected control. Reconcile the two documents at each change, and make sure each control's status matches what staff actually do.

Controls with no operating records

A policy or procedure that exists on paper does not show that a control runs. During stage 2, auditors ask for records produced over a period of time, such as access reviews, training completions, incident tickets and change approvals. Controls that began shortly before the audit often have too few records to test. Start each control early enough that it has generated evidence before stage 2 begins.

Internal audit and management review not yet run

Clause 9 requires the organization to audit its own management system and review it at top management level. A certification body expects both to have run and produced findings, with corrective actions tracked to closure. If neither has happened by stage 2, the organization may have to schedule them and wait for results before the audit can proceed. Plan the internal audit and management review as dated events with recorded outputs.

Weak evidence from cloud, identity and logging

Many Annex A technological controls depend on configuration that lives in cloud consoles, identity providers and logging platforms. When these systems cannot show who has access, which changes were made and what was logged, the auditor cannot test the control, even if the practice is sound. Confirm early that identity exports, audit logs, change histories and configuration baselines can be retrieved in a form an auditor can read, and that retention covers the audit period.

Certification body chosen late in the schedule

The certification body prepares the audit programme and plan before stage 1, and its availability sets the earliest audit dates. Choosing it late can push stage 1 into a later window and leave little room to close findings before the planned stage 2. Compare several bodies early, confirm they use ISO/IEC 27006-1 and check their accreditation, and ask for their availability and planning timetable in writing before committing.

Common questions about the ISO 27001 certification process

Can our team run the whole ISO 27001 certification process without a consultant?

Yes, an organization can build and certify its own ISMS without an outside consultant, because the standard places ownership of the controls, risk decisions and the Statement of Applicability with the organization itself. What drives the answer is whether the team has people who can read clauses 4 to 10, run a risk assessment, and keep evidence current for three years. Outside help is usually a question of capacity and speed rather than permission. Before deciding, confirm with the certification body which documents and records it expects at stage 1, and ask a consultant or implementation partner to write its scope in a written proposal so you can compare the work against your own plan.

What does the work need from our engineers and managers?

The work needs named owners for each control area, time from engineers to configure systems and collect evidence, and managers who make risk decisions and approve policies. Engineers typically carry the technical controls in clause 8 of Annex A, such as access, logging, backups and secure development, while managers own roles, training and supplier decisions. The effort grows with the number of systems and people in scope, so ask the certification body and any partner to estimate the hours by role in writing before you commit staff.

Who issues the ISO 27001 certificate?

An external certification body issues the certificate after its own audit, not ISO and not the consultant who helped you prepare. ISO states that it does not certify organizations, and accredited bodies operate to ISO/IEC 17021-1 plus ISO/IEC 27006-1:2024. Check the body's accreditation before you sign, and verify the issued certificate in IAF CertSearch as ISO describes on its certification page.

Does a pre-audit count as the stage 1 audit?

No, a pre-audit or gap assessment does not replace stage 1 because stage 1 is part of the certification body's own initial audit and produces its findings and readiness decision. A pre-audit is run by a party you choose to test your readiness, and it cannot record the certification body's conclusions. Ask the certification body how it treats any pre-audit you have had, and whether it will plan stage 1 around the evidence you have already gathered.

What happens if a major nonconformity is not closed within 6 months after stage 2?

If the certification body cannot verify the correction and corrective action for each major nonconformity within 6 months after the last day of stage 2, ISO/IEC 17021-1 requires it to conduct another stage 2 before it recommends certification. This is the main timing risk in the process, because the clock starts at the end of stage 2 rather than at the nonconformity finding. Ask the certification body for its written rule on this deadline, and plan corrective actions and evidence collection so they can be verified inside that window.

How long does the certificate last and what happens at recertification?

A certificate issued under ISO/IEC 17021-1 covers a three-year cycle, and the certificate must show the expiry or recertification date that completes that cycle. The body must audit you at least once in every calendar year through surveillance or recertification audits, and a delayed audit must be justified as an exceptional case. Recertification is a full audit before the cycle ends, so keep evidence current throughout the cycle rather than rebuilding it at the end. Confirm the expiry date and audit calendar with your certification body when the certificate is issued.

Does DeployOpen issue ISO 27001 certificates?

No, DeployOpen does not issue ISO 27001 audit reports, attestations or certificates, because only an independent certification body can do that. DeployOpen is a Chainscore Labs company that plans, implements, hardens and documents self-hosted open-source platforms inside your own infrastructure, and it can prepare systems and evidence for the assessment. Work is usually fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and a quote follows from that scope. Ask your certification body which evidence it will sample, and confirm with it before scoping any preparation work.

How DeployOpen prepares systems and evidence for ISO 27001 audits

DeployOpen helps organizations prepare the systems, controls and evidence that an ISO 27001 certification body will examine during the audit process. The organization keeps ownership of its ISMS, its risk decisions and its Statement of Applicability, while DeployOpen plans and implements the self-hosted open-source platforms that run those controls inside the client's own infrastructure. Certificates are issued only by an accredited certification body.

How we scope

Agree the written scope of systems, sites and controls before any work starts, in a fixed-scope engagement.
Map which parts of the ISO 27001 management system the platforms will support, and which stay with the organization.
Confirm with the client and its certification body which systems and evidence the audit will sample.

How we build

Implement self-hosted open-source platforms inside the client's cloud accounts, data centers or air-gapped networks.
Configure access, logging, backup and change records so each platform produces evidence an auditor can review.
Test the configured systems against the controls in the written scope before handing them over.

How we hand over

Document each system, its configuration, its owner and the evidence it generates in a form the client can maintain.
Deliver runbooks and records that show how controls operate, so staff can answer auditor questions without DeployOpen present.
Confirm with the client which deliverables are handed over and which items remain the organization's own responsibility.

How we support

Provide ongoing support, upgrades and continuous testing through a retainer, if the client chooses one.
Support surveillance and recertification preparation by keeping evidence current across the three-year cycle.
Ask the certification body for its written requirements on evidence format before the stage 1 audit.