How long does ISO 27001 take?

Part of the guide What does ISO 27001 certification take, and who can certify you?

What takes time before the ISO 27001 audit?

Getting the system working comes before showing that it works. ISMS means information security management system. It covers how people, processes and technology protect information, including the checks and improvements you make along the way.

NQA’s audit guidance calls for a working system, with evidence of internal audits and a management review. An internal audit checks your own arrangements. A management review brings the results back to the people who run the organisation.

What happens at Stage 1 and Stage 2?

Stage 1 checks whether the system is ready and what it covers. Stage 2 checks how it works in practice. NQA describes both stages, followed by a decision on certification after a successful Stage 2 audit.

Can you get ISO 27001 in three months?

Three months of operation is a requirement stated by NQA. Its page also calls for a management review and a full cycle of internal audits. It does not say that starting from scratch and getting a certificate takes three months.

Ask your chosen certification body what evidence it needs and when it can assess you. ISO recommends comparing certification bodies. The body you choose carries out certification, rather than ISO itself.

What makes the preparation hard?

Preparation can be hard because the work reaches beyond the IT team. Your system covers people and processes as well as technology. It also needs checks that fit your risks and evidence that the arrangements work.

Use these questions to turn a target date into named tasks. They are planning prompts, not a prediction of how long your organisation will take.

Does buying software finish the preparation?

Buying software does not demonstrate that your security system works. The audit process checks the system in practice, including evidence of internal audits and management review. Keep that work visible in the plan, whichever tools you use.

Who should you ask for an audit timetable?

Ask the certification body that will assess you. ISO recommends comparing bodies and checking their accreditation, which is an independent check of the body’s competence. In the UK, UKAS accredits bodies that certify organisations to ISO 27001.

Bring the proposed scope and the evidence you already have. Ask what must be ready for each stage, what operating history the body expects and what happens after the assessment.

What to do

1. Write down what the system will cover and the risks it needs to address.
2. Name the work needed to run it, check it and improve it.
3. Plan the internal audits and management review.
4. Compare certification bodies and ask each for its evidence requirements and audit timetable.

Common questions

Is three months a universal ISO 27001 deadline?

No. The three months described here is NQA’s own minimum operating-history requirement. It also asks for internal audits and a management review. Do not use it as a promise about another body or a whole project.

Can a small business plan the work itself?

Start by naming who will build, run, check and improve the system. If you use outside help, keep those tasks clear. The assessment still needs evidence of a working system.

Is the audit the whole project?

No. Preparation includes running and checking the system before its external assessment. The audit then reviews readiness and how the system works in practice.

Where next

• What does ISO 27001 certification take, and who can certify you?
• How much does ISO 27001 certification cost in the UK?
• How to find UKAS accredited ISO 27001 certification bodies
• How do you answer a security questionnaire without a certificate?

This is an independent editorial guide, not legal advice.