ISO 27001 certification takes months of preparation, not just the days spent with an auditor. DNV gives examples ranging from as little as three months for a small, simple organization to around 18 months for a large or complex one. Those are possible scenarios, not an industry average or a guaranteed deadline. Your starting point, scope, operating evidence, and certification body’s availability determine the actual schedule.
Table of Contents
This guide covers an organization’s first certification to ISO/IEC 27001:2022, rather than an individual’s training certificate. It explains the milestones and provides an illustrative six-month plan you can adapt before promising a date to a customer. DNV’s ISO/IEC 27001 certification guidance explains the factors behind its timing examples.
Separate the three date types · Copy the dependency record
Separate preparation, auditing, and certificate issuance
Your information security management system, or ISMS, is how your organization manages information security risks through people, processes, and technology. ISO/IEC 27001:2022 sets its requirements. Include the published 2024 climate action amendment when confirming the applicable requirements with your certification body.
Track three dates separately: when the ISMS should be ready, when the external audits are scheduled, and when a certificate might be issued. A quote for auditor-days describes audit effort; it does not tell you the elapsed time from project kickoff to certification. Likewise, a booked Stage 2 audit is not a confirmed certificate delivery date.
ISO develops standards but does not certify your organization. An independent certification body makes that decision. ISO’s certification guidance also explains accreditation, which provides independent recognition of a certification body’s competence. Check that a prospective provider’s accreditation covers ISO/IEC 27001 and that the proposed certificate scope meets your customer’s needs.
An illustrative six-month certification plan
The schedule below is an editorial planning example, not a measured average or an ISO requirement. It assumes a limited, stable scope, functioning security controls, available owners, and no major infrastructure replacement. Activities overlap. Confirm audit availability and evidence expectations early; if either conflicts with this plan, move the target date.
| Window | Main work | Readiness checkpoint |
|---|---|---|
| Month 1 | Confirm scope, ownership, gaps, and certification provider | Agreed boundary and funded work plan |
| Months 1–2 | Assess risks, select controls, and document the ISMS | Approved approach that matches actual operations |
| Months 2–4 | Operate controls and retain evidence | Records demonstrate implementation |
| Month 4 | Internal audit, management review, and corrective action | Results reviewed and material gaps addressed |
| Month 5 | Stage 1 and readiness follow-up | Proceed to Stage 2 as agreed with the auditor |
| Month 6 and contingency | Stage 2, findings response, and certification decision | Certificate issued following a positive decision |
For a hypothetical SaaS company, this could mean defining the production service and supporting teams in month one, operating the agreed processes from month two, and reviewing several months of records in month four. If an access-control redesign remains unfinished at that point, the readiness checkpoint has not been met. The calendar should reflect that dependency.
What to finish before the external audits
Define a scope that matches the business need
Identify the services, people, systems, locations, and dependencies covered by the ISMS. For planning purposes, put the proposed scope beside the customer’s request. A faster certificate for a boundary that excludes the service the customer buys may not solve the commercial problem.
Assign an executive sponsor and a working owner. Give engineering, IT, HR, procurement, and other relevant teams specific deliverables. An action such as “complete supplier reviews” needs an owner, a due date, and an agreed record of completion.
Connect risks, controls, and evidence
Assess information security risks, decide how to treat them, and prepare the Statement of Applicability. This document records necessary controls, their justification and implementation status, and reasons for excluding Annex A controls. Annex A is a reference set to consider, not an instruction to deploy every control identically. NQA’s ISO 27001 overview explains the relationship between risks and control selection.
Build evidence collection into the work. Useful records might include completed access reviews, training attendance, supplier decisions, recovery-test results, and tracked vulnerability remediation. Their relevance depends on your scope and selected controls. A policy describes intended behavior; a dated record helps demonstrate what happened.
For example, if your risk treatment includes stronger authentication, the MFA rollout guide can support implementation planning. For supplier work, the vendor security questionnaire template can help organize evidence, ownership, and follow-up decisions. Neither resource replaces your ISMS risk assessment.
Allow time to audit, review, and improve
Complete an internal audit and management review early enough to act on the results. DNV recommends these checks before the certification audit to establish that the ISMS operates effectively and remaining gaps are closed. Leave room for investigation, corrective work, and verification; scheduling the review immediately before an external audit leaves little recovery time.
Do you need three months of operating evidence?
Ask your certification body what it requires and when. NQA’s published certification process requires a management system to have been fully operational for at least three months and to have undergone management review and a full internal audit cycle. That is a concrete provider requirement, not evidence that every organization must follow an identical ISO-mandated 90-day project.
Agree what “operational” means for your scope. Buying software or approving a policy does not establish that every relevant process began that day. Ask whether existing records are acceptable, which processes need further evidence, and what must be complete before each audit stage. Never backdate records to make a target appear achievable.
Stage 1, Stage 2, and the certification decision
Stage 1 examines documentation and readiness for the main assessment. Stage 2 examines implementation through evidence, interviews, and observation. DNV’s accredited certification process describes Stage 1 as typically occurring some weeks before Stage 2. Use the interval your certification body agrees for your circumstances.
Reserve time after Stage 2 for responding to findings and for the certification decision. DNV separates the auditor’s recommendation from its independent internal review. A favorable closing meeting therefore does not mean a certificate has already been issued.
Major nonconformities can prevent issuance until corrective action has been verified. NQA also identifies internal audit and management review nonconformities as barriers requiring sufficient evidence of effective implementation. Ask for the applicable response deadlines and verification process rather than assuming every finding can be resolved with an emailed action plan.
Shorten the timeline by removing dependencies
The most useful acceleration work is specific. Discuss provisional audit dates while preparing the ISMS. Get decisions on scope before collecting evidence across the wrong systems. Reserve time with managers before their reviews become urgent. Reuse existing records only after checking their scope, relevance, and quality.
Track unfinished work, the responsible owner, evidence needed and the milestone it blocks in a dependency register. For example, an incomplete restore test might block your readiness decision; an unavailable auditor might block Stage 2 even when the ISMS is ready. These problems need different actions.
Copy a dependency and date-commitment record
Use your actual scope and certification-body agreement. Mark a date proposed, booked or completed and keep the supporting reference beside it. An audit booking is different from a certification decision; leave unknown dates unresolved.
ISMS scope / business need / responsible owner: Readiness target / status / conditions still open: Stage 1 date / proposed or booked / provider reference: Stage 2 date / proposed or booked / prerequisite evidence: Findings response and verification steps / owner: Certification decision or issuance estimate / provider confirmation: Customer-requested date / approved communication owner: Dependency or unfinished task: Milestone it blocks: Responsible owner and next action: Evidence needed and person who accepts it: Expected resolution date / confidence basis / unresolved assumption: Date reviewed and resulting schedule change:
This is a blank editorial planning aid, not a certificate forecast. Update the record when scope, operating evidence, findings or auditor availability changes. Do not convert an illustrative month-by-month plan into a promised issuance date.
Software can organize evidence and reminders, while a consultant can help resolve implementation questions. Evaluate either against the actual bottleneck. Neither can supply missing operational history retroactively or guarantee a certification body’s decision.
Plan beyond the first certificate
NQA describes a three-year certification cycle maintained through annual surveillance and recertification. Keep process owners and recurring reviews in place after the initial project. Certification is an ongoing management commitment, so the operating calendar should continue beyond certificate delivery.
Before committing to a customer deadline, obtain a scoped proposal and confirm evidence expectations, Stage 1 and Stage 2 availability, findings follow-up, and certificate decision turnaround. Then compare those dates with your unfinished work. Promise a certification date only with a clear understanding of the dependencies and remaining uncertainty.
Planning-record revision: October 23, 2026. Added a blank dependency and date-commitment record and checked the linked DNV and NQA timing/process references. Their scenarios and provider requirements are not a universal completion guarantee. This revision does not report an audit or certification performed by this site.