The ISO 27001 (ISMS) Certification Process and Timeline: 8 Steps from Kickoff to Registration

The Full Picture and How Long It Takes

ISO/IEC 27001 certification starts with defining the scope, then moves through risk assessment, documentation, operation, internal audit and management review, and finally the Stage 1 and Stage 2 audits performed by a certification body. For IT companies of up to roughly 100 people, a six to twelve month timeline is common, and organisations that already have internal rules and security practices in place tend to land at the shorter end.

The biggest factor is not the volume of documents but the accumulation of operating records. Auditors confirm through records that the system is being run the way the documents say, so it is common practice to allow at least around three months of operation after the documents are in place before going to audit. For budgeting, see the cost of ISMS certification.

PDCA and Clauses 4 to 10 of ISO/IEC 27001:2022

The requirements of ISO/IEC 27001:2022 sit in clauses 4 through 10 and map directly onto the PDCA cycle. Building your project plan along this structure makes gaps much easier to spot.

• Plan — Clause 4 (context of the organisation), Clause 5 (leadership) and Clause 6 (planning). Scope, the information security policy, risk assessment and risk treatment, the Statement of Applicability (SoA), and information security objectives all live here.
• Do — Clause 7 (support) and Clause 8 (operation). Competence and awareness, communication, control of documented information, and the day-to-day operation that produces records.
• Check — Clause 9 (performance evaluation). Monitoring and measurement, internal audit, and management review form the self-check set.
• Act — Clause 10 (improvement). Nonconformity and corrective action, plus continual improvement. Findings from internal audits and external audits are closed here.

The Annex A controls, organised in the 2022 edition into four themes (organizational, people, physical and technological, 93 controls in total), are selected on the basis of the Clause 6 risk assessment. The document listing those decisions and their justification is the Statement of Applicability (SoA), which auditors always examine. For the mechanics of assessing risk, see how to run an ISMS risk assessment.

Eight Steps from Kickoff to Registration

1. Build the team and define the scope — Obtain management approval, appoint an ISMS lead and a working group, fix the boundary of organisations, sites, services and information assets, and issue the information security policy.
2. Gap analysis — Compare current internal rules and practices against clauses 4 to 10 and the Annex A controls, and list what is missing. That list becomes your task backlog.
3. Risk assessment, risk treatment plan and SoA — Inventory information assets, identify, analyse and evaluate risks in terms of confidentiality, integrity and availability, decide treatment options against your acceptance criteria, and record the control decisions in the SoA.
4. Documentation — Prepare the policy, supporting policies and procedures (access control, asset management, supplier management, business continuity, incident response and so on) and the forms that go with them. Build on the rules you already have, and write at a level people can actually follow. See the ISMS document list for the overall picture.
5. Operate and accumulate records — Actually run the system. Keep training records, asset inventory updates, access rights granting and review records, supplier evaluations, incident records and change records. Around three months of operation is a commonly cited minimum.
6. Internal audit — Plan the audit and have auditors with sufficient independence cover all requirements and the applied controls. Log findings as corrective actions and close them against a deadline.
7. Management review — Report internal audit results, changes in risk, progress against objectives, incidents and interested party feedback to top management, decide on resources and improvement direction, and minute the outcome.
8. Select a certification body, apply and be audited — Apply to an accredited certification body, undergo the Stage 1 audit (documentation) and the Stage 2 audit (operation), submit corrective actions for any findings, and proceed through the certification decision to registration.

What Stage 1 and Stage 2 Audits Look At

Stage 1 Audit (Documentation Review)

This audit confirms that the documented ISMS meets the requirements, that the scope and the SoA are consistent, and that you are ready for Stage 2. The policy, the risk assessment method and results, the SoA, and the internal audit and management review records are the main items examined. If readiness gaps come up here, moving the Stage 2 date back is a common outcome.

Stage 2 Audit (Operational Audit)

Through interviews on site and inspection of records, this audit checks whether the system is run as documented. Physical access logs, access rights reviews, training records, supplier evaluations, and vulnerability and incident handling histories are all examined as actual evidence. Findings are classified by severity, and depending on the classification you submit either a corrective action plan or evidence of completed correction before the certification decision.

A Month-by-Month Schedule (10-Month Model)

This example assumes an IT company of roughly 50 to 100 people using partial external support. Adjust it to your own situation, since timings shift with the state of the organisation.

Starting the selection of and application to a certification body three to four months before the Stage 1 audit gives you room to negotiate dates. Busy seasons make preferred dates hard to secure, so requesting quotes in parallel with the start of operation is a practical approach.

Four Common Stumbling Blocks

• Setting the scope too wide — Covering every entity, site and service on the first attempt inflates the asset inventory, the documentation work and the evidence gathering all at once. Narrowing to the main service and head office first, and expanding at recertification, is a legitimate option.
• Treating documentation as the finish line — Policies produced by filling in a template tend to drift from what people actually do. Stage 2 looks at records of the system running, not at the documents themselves. Write at a level someone other than the author can execute.
• Doing the work but keeping no records — It is very common for activities to happen without the date, the person responsible, the target and the outcome being recorded. Training, access rights reviews, supplier evaluations and backup checks should be recorded at the moment they are performed.
• Internal audit as a formality — An audit that only ticks boxes produces zero findings and no improvement. Secure auditor independence and sample the actual records.

After Certification: Surveillance and Recertification Audits

Certification is not the end point, because maintenance audits continue. Commonly, a surveillance audit takes place roughly once a year after registration, and a recertification audit every three years. Surveillance audits are often narrower in scope than the initial audit, but internal audit and management review still need to be carried out every year.

In other words, the operating cycle you build during the certification project should be designed on the assumption that it runs every year. If evidence collection depends on one person doing it by hand, the burden rises sharply from the second year and records start going missing.

Keeping Progress and Evidence in One Place

A certification project touches the asset inventory, the risk register, the SoA, document version control, training completion, internal audit findings and corrective actions, and management review minutes. Spreading all of that across spreadsheets and shared folders makes it hard to see how far along you are and which evidence is missing, and the gap shows up as a scramble just before the audit. Linking risks, controls, documents and records inside a single tool makes progress and gaps visible on the spot, and lets you run maintenance the same way in later years.

If you want to work out which stage you are at and what to tackle next, start with the ISMS readiness self-check.

This article is for general information only and does not guarantee any audit outcome or certification. Schemes and costs change, so confirm the latest details with certification bodies.