The realistic ISO 27001 timeline
From kickoff to certificate: what actually happens, how long each phase takes, and where the time goes.
A first ISO 27001 certification typically takes 3–9 months from kickoff to certificate: 1–4 months of ISMS implementation and remediation, then Stage 1 and Stage 2 audits 2–8 weeks apart, plus 2–4 weeks for the certification decision.
- Gap assessment (2–4 weeks). Compare your current state against ISO 27001:2022. Output: a work list, not a pass/fail. Skippable only if you already know your gaps.
- ISMS implementation & remediation (1–4 months). Write the scope statement, policies, risk assessment, and Statement of Applicability; implement the Annex A controls you selected; start collecting evidence. This is where most of the calendar goes — and it's the phase that shrinks to weeks if controls already operate.
- Internal audit + management review (2–4 weeks). Required by the standard before certification. Run a real internal audit, close findings, and hold the management review. Stage 1 will check these happened.
- Stage 1 audit (1–2 days, ~2–4 weeks to schedule). The CB reviews documentation: scope, policies, risk assessment, SoA, internal audit and management review records. Output: findings to fix before Stage 2, not a certificate.
- Remediation window (2–6 weeks). Close Stage 1 findings. Minor nonconformities here become major ones at Stage 2 if ignored.
- Stage 2 audit (2–10+ days by size). The CB tests whether the ISMS actually operates: interviews, sampling, evidence review, site visits. This is the audit that decides certification.
- Certification decision (2–4 weeks). The CB's decision-maker — independent of the audit team — reviews the audit pack and issues the certificate, valid for three years.
After the certificate
Annual surveillance audits in years two and three keep the certificate valid — shorter than Stage 2, roughly one-third to one-half the duration. In year four, a full recertification audit (Stage 2 scale) starts a new three-year cycle.
Plan your certification window
Tell us your target date — matched CBs quote realistic schedules, not marketing ones.
How it works: tell us once (4 questions, 2 min) → we match licensed auditors to your size and scope → they send scoped quotes directly. Free, no obligation.