How long does ISO 27001 certification take for an organization like yours?
If a customer or contract has set a deadline for ISO 27001 certification, the timeline is set mainly by how much of the ISMS already runs in practice before the certification body's stage 1 audit, and by how quickly major nonconformities are closed afterward. No fixed duration is supplied for this page, so treat any single number you hear from a vendor or consultant as a starting point to test, not a promise. The organization owns its ISMS and the evidence behind it. An implementation partner, if you hire one, prepares systems, policies and records. Only the accredited certification body issues the certificate, and it sets its own audit plan and decision timing.
Three variables explain most of the difference between organizations. The first is scope: which products, services, locations and supporting systems sit inside the ISMS, since a narrow scope gives the auditor less to sample. The second is the number of people and sites in scope, which drives audit time and the amount of evidence that must exist across the organization. The third is evidence maturity: whether risk assessments, the Statement of Applicability, internal audits and management review have already run for a period long enough to be inspected, or whether they are still being written. Ask any certification body or consultant to explain how each of these three factors affects its planned audit days and the interval it expects before stage 2.
Before you commit to a date, ask three questions in writing. Which clause 9 activities (monitoring, internal audit and management review) will have run before stage 1, and how many cycles of each will the auditor see? How long does the certification body expect between stage 1 and stage 2, and what does it need from you to make that interval productive? If stage 2 finds major nonconformities, how will you show the corrections and corrective actions are verified within the 6-month limit that applies after the last day of stage 2? Those answers will tell you more about your real timeline than any generic estimate.
The phases of an ISO 27001 timeline and what each produces
The sequence runs from a working ISMS through a two-stage certification audit to a certificate that starts a three-year cycle, and each phase produces a record the next phase depends on. Ask your certification body for its own planning, because the pace depends on your scope, your readiness and its audit programme.
Build and run the ISMS to clauses 4 to 10
The organization itself defines the context, scope, leadership commitments, risk process, policies, roles, resources and operational controls required by clauses 4 to 10 of ISO/IEC 27001:2022. Implementation partners can prepare documents and systems, but management must own the decisions. The output is a documented ISMS that has been operating long enough to produce records, such as risk assessments, policy approvals, access reviews and training logs. Before any certification audit, the ISMS must also have run its performance evaluation: monitoring and measurement under clause 9.1, an internal audit under clause 9.2, management review under clause 9.3, and nonconformity and corrective action under clause 10.2. Confirm with your certification body which of these records it will sample at stage 1.
Agree the first-cycle audit programme with the certification body
Before the stage 1 audit, the certification body prepares the audit programme for the first certification cycle. This plan sets out which audits will take place across the three-year cycle and how audit time is allocated, and it is shaped by your scope, number of sites and people in scope. Your job is to provide accurate scope information and to confirm the dates your team can support. The output is an agreed audit plan and a contract that reflects it. Ask the certification body to explain how it calculates audit time and what changes would trigger a review.
Complete the stage 1 document review
Stage 1 is a review of your documented ISMS, usually including your scope, policies, Statement of Applicability, risk assessment and treatment records, and evidence that internal audit and management review have taken place. The certification body checks whether the design of the ISMS meets the requirements and whether you are ready for the detailed testing of stage 2. It may be conducted on site or remotely, depending on the arrangement agreed. The output is a stage 1 report that lists areas of concern, which the certification body expects you to address before stage 2. Ask the certification body what it will require at this stage and how it records findings.
Close stage 1 concerns during the interval before stage 2
ISO/IEC 17021-1 requires an interval between stage 1 and stage 2 long enough for the organization to address the areas of concern found at stage 1. The standard sets no maximum length. The certification body judges whether the stage 1 results remain valid when stage 2 is scheduled, and a long gap can prompt it to repeat parts of stage 1. The output is evidence that each concern was resolved, such as revised procedures, completed risk treatments or records of corrective action. Ask the certification body how it assesses the validity of stage 1 results and whether it will set a date by which stage 2 must start.
Pass the stage 2 audit of implementation and effectiveness
Stage 2 tests whether the ISMS is implemented and operating as documented. Auditors sample evidence across the scope, including the Annex A controls in your Statement of Applicability, interviews with staff and checks of logs, access reviews, incident records and supplier controls. They also test whether internal audit and management review are effective, not merely present. The output is the stage 2 audit report with any nonconformities graded by the certification body. Expect auditors to ask for evidence that matches what your policies say, so keep records current throughout the audit window.
Verify closure of nonconformities within the six-month limit
Nonconformities found at stage 2 require corrections and corrective actions. Under ISO/IEC 17021-1, if the corrections and corrective actions for major nonconformities cannot be verified within 6 months after the last day of stage 2, another stage 2 must be conducted before certification is recommended. Minor nonconformities are handled through the certification body's own process. The output is documented evidence that each fix addressed the root cause, accepted by the certification body. Plan the corrective action work so the verification falls inside that six-month window, and ask the certification body how it will verify closure.
Receive the certification decision and certificate
After stage 2 and the closure of nonconformities, the certification body makes a certification decision, separate from the audit team, based on the audit report and the evidence of corrective action. If the decision is positive, the certificate issues with a scope statement and a validity period that completes the three-year cycle. The certificate is issued by the certification body, not by ISO, and it can be checked in the accredited certificate database. The output is the certificate itself, which customers and regulators will ask to see along with the scope.
Run the three-year cycle with an audit in every calendar year
The certification cycle lasts three years, and the certification body must conduct at least one audit, surveillance or recertification, in every calendar year. Surveillance audits sample the ISMS across the cycle, and a recertification audit before the cycle ends renews the certificate. The certification body reviews planned audit time at each surveillance and recertification audit to reflect changes in your organization and system maturity. The output is a sequence of audit reports and, at the end, a recertification decision. Ask the certification body for its audit calendar for the full cycle when you sign.
Why the gap between stage 1 and stage 2 sets the pace
The interval between stage 1 and stage 2 is often the longest stretch of the initial certification, and it is set by how long the organization needs to fix what stage 1 found, not by the auditor's calendar. ISO/IEC 17021-1 requires an interval long enough for the organization to address areas of concern raised at stage 1. It sets no maximum. The certification body decides whether the stage 1 results are still valid when stage 2 is scheduled, so the reader should ask the certification body early how it will judge that, and in what form it wants the stage 1 findings closed out.
During the gap, the organization owns the work. Close documentation gaps first: the Statement of Applicability, the risk treatment plan and the policies must match what people actually do. Then run the clause 9.2 internal audit and the clause 9.3 management review on the ISMS as it now exists, and make sure the clause 10.2 corrective actions are logged with evidence. Collect records over a real period of operation, such as access reviews, incident tickets, training completions and supplier reviews, because stage 2 tests whether the controls have been working, not whether they are written down. A consultant or implementation partner can prepare this material, but the organization must run and own it.
Some stage 1 findings force a repeat of stage 1 rather than a simple top-up. If the scope, the risk assessment or the Statement of Applicability changes materially, or the organization cannot show the management system is operating, the certification body may decide the stage 1 result no longer holds. An interrupted stage 2 has no fixed time limit either, so a stalled audit is judged on a risk basis. Ask the certification body to state in writing what would trigger a repeat of stage 1 and what the new plan would cost in time and fees before you commit to a stage 2 date.
How the 6-month limit on major nonconformities affects the schedule
After stage 2, a certification body has a fixed window to verify fixes for major nonconformities. The clock starts on the last day of stage 2, so findings that stay open tend to push the certificate out by a full repeat of stage 2. The four cards below cover the gaps that most often keep major findings open and what to check before the audit.
Missing risk assessment evidence
A major nonconformity often appears when the risk assessment cannot show how each risk was scored, who approved the risk owners and how the treatment decisions link to the Statement of Applicability. Fixing this means producing a dated, repeatable risk register and a treatment plan, not rewriting the policy. Check that the assessment was run at planned intervals and that the record shows the decisions auditors will trace back to the controls. Ask the certification body which evidence format it expects before stage 2.
No completed internal audit
If the internal audit has not been run across the ISMS scope, or the auditor reviewed their own work, a certification body can raise a major finding. Closing it requires a documented audit programme, an auditor independent of the area audited, and a report that feeds into management review. Schedule the internal audit before stage 1 so findings have time to be corrected and verified. Confirm the timing with the certification body, since the 6-month limit applies to verifying the corrective actions, not to scheduling the audit.
Unmanaged supplier relationships
Major findings often come from suppliers that handle organizational data with no documented security requirements, no contract terms and no periodic review. Closing the gap means listing critical suppliers, recording their security obligations and collecting current assurance evidence such as reports or questionnaire responses. Each supplier decision should link to the relevant Annex A controls and the risk register. Ask your team to identify the suppliers that matter most, since reviewing them late is one of the most common reasons corrections slip past the window.
Weak access reviews
Access findings usually appear when user accounts, privileged roles and leavers are not reviewed on a set schedule. The fix is a recorded review of user access against approved roles, with removals completed and logged, plus evidence that privileged access was reviewed separately. Export the current access lists from your identity system and check them against HR records before the audit. Auditors will ask for the review records themselves, so a single completed cycle with signed results is more useful than a policy describing the intended process.
The annual audits across the three-year certification cycle
An ISO 27001 certificate runs for a three-year cycle, and the certification body must audit the organization at least once in every calendar year of that cycle. That audit is either a surveillance audit or the recertification audit that closes the cycle. European Accreditation's FAQs on ISO/IEC 17021-1 treat this annual rule as a requirement of the accreditation process, so the certification body cannot treat the first year after certification as a free year. Plan the audit calendar with the certification body at the start of the cycle, and confirm in writing which calendar year each audit falls in, since the requirement is tied to calendar years rather than to the date the certificate was issued.
A delayed audit is an exceptional case, not a scheduling option. If the certification body moves an audit out of its calendar year, it must justify that decision, and the justification cannot be used to push the following year's audit back by a year. Ask your certification body how it records and approves any exception, and keep that record with your audit evidence. The certificate itself must show the expiry or recertification due date that completes the three-year cycle. A certificate that shows only a one-year validity does not conform, so check the expiry date on the certificate you receive and check it again in the certification body's records.
If the certificate expires before recertification is complete, the rules are strict. Under ISO/IEC 17021-1, the certification body may restore an expired certificate within 6 months, but only if the outstanding recertification activities are completed in that window. If they are not completed, the organization needs at least a stage 2 audit before the certificate can be restored. A stage 2 audit is more expensive and slower than a recertification audit, so treat the recertification date as a hard deadline. Schedule the recertification audit early enough to close any nonconformities before the expiry date, and confirm the restoration rules with your certification body before you need them.
How the timeline differs by starting point
An organization with no management system has to build most of the ISMS before any certification body will schedule an audit. The longest phases are design and operation: defining the scope, performing the risk assessment and treatment, writing the Statement of Applicability, and then running the processes long enough to produce records. Clauses 4 to 10 must be in place and working, and the performance evaluation activities in clauses 9.1 to 9.3 and the corrective action process in clause 10.2 must have run at least once before stage 1. Stage 1 is the gate that tells you whether the design is ready for stage 2.
- Scope and risk work first: The scope, risk assessment and Statement of Applicability usually set the pace, because every later decision depends on them.
- Policies and processes built from scratch: Each control needs a documented process and someone who runs it, which takes time before evidence accumulates.
- Internal audit and management review: Both must have actually run, so the first cycle of these activities is a schedule item, not a paperwork exercise.
- Stage 1 readiness: Expect the certification body's review to produce findings that you must address before stage 2 is scheduled.
Ask the certification body how it expects the audit programme for the first cycle to be arranged, and what minimum operating history it expects you to show at stage 2.
An organization that has written policies but cannot show them working is in a different position. The documents exist, so the design phase is shorter, but the operation phase carries the risk. Auditors test whether controls run as described, and a policy with no records of execution is a common source of nonconformities. The critical path usually runs through collecting evidence over time, correcting the gaps between written practice and real practice, and proving that internal audit and management review have covered them.
- Gap between document and practice: Compare each policy against what staff actually do, and close the difference before the auditor finds it.
- Evidence history: Access reviews, incident records, supplier reviews and training logs need dates and sign-off. Gaps in these records often push stage 2 back.
- Statement of Applicability alignment: Check that each control marked as implemented points to a process and to records that exist.
- Internal audit coverage: An internal audit that has not yet examined the operating controls may not satisfy the certification body.
Ask the certification body whether it will review your documents before stage 1, whether that review counts toward its planned audit time, and how it judges records covering only a short period.
An organization with an established ISMS usually spends less time on design and more on targeted change. Two situations drive most of the work. The first is the move from ISO/IEC 27001:2013 to the 2022 edition: under IAF MD 26:2023, all certifications to the 2013 edition had to expire or be withdrawn by 31 October 2025, so any organization still relying on a 2013 certificate needed a transition completed by that date. The second is a change of scope, such as adding a site, product, business unit or cloud environment, which needs the scope, risk assessment and Statement of Applicability to be revised before the change is audited.
- Mapping the 2013 controls to the 2022 Annex A: The 2022 edition has 93 controls in four themes, with new, merged and updated controls that require fresh evidence.
- Revised risk treatment: New or changed controls need their treatment decisions and Statement of Applicability entries updated.
- Scope extension audit: A scope change can require additional audit time, and the certification body decides how much based on the change.
- Internal audit of the change: The changed areas must be covered by internal audit and management review before the external audit.
Confirm with the certification body whether your existing certificate is already on the 2022 edition, how it will treat the scope change, and whether it plans an extra audit or assessment to verify the change.
What must be running before the certification audit starts
A certification body will not start stage 1 against a system that has never operated. The items below are the records and routines that must already exist and show a track record, and each one can be checked before the auditor arrives. Together they show whether the ISMS is ready for assessment or still being built.
Internal audit and management review
Clause 9.2 requires internal audits at planned intervals, and clause 9.3 requires top management to review the ISMS at planned intervals. Both must have run at least once, with dated reports, findings and minutes that show management decisions. Check that the internal audit programme covers the full scope, that the auditors were independent of the work they examined, and that management review minutes record actions with owners and due dates.
Monitoring and measurement records
Clause 9.1 requires the organization to monitor, measure, analyze and evaluate the ISMS and its controls, and to keep evidence of the results. Ask for defined metrics, the method and frequency of each measurement, and dated results showing the metrics were reviewed. A set of metrics with no recorded results is a gap an assessor will notice quickly.
Nonconformity and corrective action log
Clause 10.2 requires the organization to react to nonconformities, correct them and address their causes. Keep a register that records each nonconformity from detection, the root cause, the corrective action, the person responsible and the verification that the fix worked. Check that closed items show evidence of effectiveness, not only a closure date.
Current Statement of Applicability
The Statement of Applicability must list the controls needed for the ISMS, the status of each one, and the reasons for inclusion or exclusion. It must match the latest risk treatment decisions and the current scope. Check the version date against the most recent risk assessment and confirm that every control marked as implemented points to evidence that exists today.
Completed risk assessment and treatment
The risk assessment and risk treatment must be finished and approved before stage 1, with the criteria, the risk register and the treatment plan on file. Clause 8.2 expects assessments at planned intervals, so one completed cycle is not enough to show the process works. Check that each risk has an owner, that treatment decisions trace to the Statement of Applicability, and that residual risks were accepted by someone with authority to accept them.
Defined scope and security event log
The scope must be written down under clause 4.3, listing the business units, locations, systems and interfaces covered. Alongside it, keep a log of security events and incidents that shows detection, triage and response over time. Check that the scope statement matches the systems actually operating, and that the event log covers the period since the ISMS went live, because assessors sample it for evidence that controls run in practice.
Common questions about ISO 27001 certification timing
How long does ISO 27001 certification take from start to finish?
No fixed duration applies to every organization. The pace is set by how far your ISMS already runs against clauses 4 to 10, how many people and sites are in scope, how quickly management makes decisions, and how soon a certification body can fit stage 1 and stage 2 into its calendar. Before the certification audit, the ISMS must have run monitoring and measurement under clause 9.1, an internal audit under clause 9.2, and a management review under clause 9.3, and those cycles take real calendar time to produce records. Ask the certification body for a written planning estimate based on your scope, and ask your implementation partner to show which tasks sit on the critical path.
Can our team run ISO 27001 certification without an outside partner?
Yes, the organization owns the ISMS, the Statement of Applicability, the risk treatment decisions and the evidence, so an internal team can run the project if it has the time and competence. Most teams underestimate the internal effort in clause 9 activities and in producing consistent records across the cycle. A capable in-house lead should read the requirements, follow the process steps and test readiness with an internal audit before booking a certification body. Outside help is a choice about capacity and experience, not a legal requirement.
What can an implementation partner do for our ISO 27001 timeline, and what can it not do?
A partner can plan the work, build or configure systems, draft documentation, collect evidence, run a gap analysis and prepare your staff for audit questions. It cannot decide your risks, accept residual risk, sign the Statement of Applicability on your behalf, or issue a certificate. Only an accredited certification body can audit and certify. Keep the partner separate from the certification body's audit team, and confirm the scope, deliverables and dates in writing before work starts, because a fixed-scope agreement makes the schedule easier to measure.
Why can't we skip stage 1 and go straight to stage 2?
Stage 1 checks that your ISMS design and documentation are ready for a full assessment and gives the certification body a basis for planning stage 2. ISO/IEC 17021-1 requires an interval between the two stages long enough for you to address areas of concern found in stage 1, and the certification body decides whether the stage 1 results still hold. A pre-audit run by a consultant is not a substitute because it does not carry the certification body's stage 1 findings or its planning decisions. Skipping stage 1 usually means the stage 2 audit finds gaps that could have been closed earlier.
What happens if we miss the 6-month deadline for closing major nonconformities?
Under ISO/IEC 17021-1, if corrections and corrective actions for major nonconformities cannot be verified within 6 months after the last day of stage 2, the certification body must conduct another stage 2 audit before it can recommend certification. That means the initial audit effectively restarts for the affected areas, adding fees and months to the project. Plan corrective actions with a written close-out date and collect evidence as you go, so verification can happen quickly. Ask the certification body to confirm how it counts the 6 months against your own audit dates.
What happens if our ISO 27001 certificate lapses?
After a certificate expires, the certification body can restore it within 6 months if the outstanding recertification activities are completed. If that window passes without completion, ISO/IEC 17021-1 requires at least a stage 2 audit before certification can be restored. Customers who check certificates in the IAF CertSearch database will see the status change, so a lapse can affect contracts and tenders. Diary the recertification audit well before the three-year cycle ends, and confirm with your certification body which activities must be complete for restoration.
What should we ask a certification body for a planning estimate?
Ask for a written plan that lists the stage 1 and stage 2 dates or windows, the audit days by stage, the minimum interval between stages, the audit programme for the first cycle, and the annual audit dates for the three-year cycle. Also ask how the certification body reviews planned audit time as your scope and system maturity change, which IAF MD 5 expects at surveillance and recertification audits. Confirm its accreditation status and whether the estimate includes travel, multi-site sampling and any second stage 2 risk. Compare estimates on the same scope and ask each body to state its assumptions.
How DeployOpen prepares systems and evidence ahead of your audit
DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure so the ISMS has run long enough to be audited. We prepare systems, controls and evidence for your certification body, while your organization owns its controls and the independent certification body makes the certification decision.
How we scope
- Engagements are fixed-scope, with the ISMS boundary, deliverables and timeline agreed in writing before work starts.
- We confirm which systems and sites fall inside the ISMS so the audit timeline reflects the real scope.
- We agree with you when the certification body must be engaged, so the performance evaluation runs before stage 1.
How we build
- We configure self-hosted platforms in your cloud accounts, data centers or air-gapped networks to produce control evidence.
- We help run the clause 9.1 monitoring and measurement activities, so records accumulate across the planning window.
- We document nonconformities and corrective actions under clause 10.2 with dated records that show closure progress.
How we hand over
- You receive a written evidence index mapping each control to its records, owners and collection dates.
- We provide documented runbooks so your team can keep operating the platforms after the engagement ends.
- We prepare a handover pack that lists open items, verification steps and what to confirm with your certification body.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial engagement.
- A retainer can cover evidence collection for the surveillance audit that must occur in each calendar year.
- Confirm with your certification body which evidence it expects, since it sets its own audit programme and planned audit time.
