# How long does ISO 27001 take?

Separate the work of getting ready from the audit before you promise a customer a date.

The Assurance Desk. Published 8 October 2026. Last checked 8 October 2026.

Part of the guide [What does ISO 27001 certification take, and who can certify you?](https://theassurancedesk.com/guides/iso-27001-certification-and-who-can-certify-you.md).

**The short answer.** Plan for preparation, time running your security system and the certification audits. NQA, for example, asks for at least three months of operation, plus internal audits and a management review. That is NQA’s requirement for a working system, not a promise to finish your whole project in three months ([nqa.com, ISO 27001 Certification: Benefits, ISMS & Data Protection, NQA](https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide) and [nqa.com, NQA Global Accredited Certification Body](https://www.nqa.com/en-gb/lp/iso-27001), checked 8 October 2026).

## What takes time before the ISO 27001 audit?

Getting the system working comes before showing that it works. ISMS means information security management system. It covers how people, processes and technology protect information, including the checks and improvements you make along the way ([nqa.com, ISO 27001 Certification: Benefits, ISMS & Data Protection, NQA](https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide), checked 8 October 2026).

NQA’s audit guidance calls for a working system, with evidence of internal audits and a management review. An internal audit checks your own arrangements. A management review brings the results back to the people who run the organisation ([nqa.com, ISO 27001 Certification: Benefits, ISMS & Data Protection, NQA](https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide), checked 8 October 2026).

> "The ISMS must be operational, with evidence of internal audits and a management review."
> NQA, ISO audit guidance
> nqa.com, ISO 27001 Certification: Benefits, ISMS & Data Protection, NQA, https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide (checked 8 October 2026)

## What happens at Stage 1 and Stage 2?

Stage 1 checks whether the system is ready and what it covers. Stage 2 checks how it works in practice. NQA describes both stages, followed by a decision on certification after a successful Stage 2 audit ([nqa.com, ISO 27001 Certification: Benefits, ISMS & Data Protection, NQA](https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide) and [nqa.com, NQA Global Accredited Certification Body](https://www.nqa.com/en-gb/lp/iso-27001), checked 8 October 2026).

**From preparation to a certification decision**

- Build and run: Put the security arrangements into daily use. (Check → Review the evidence)
- Review the evidence: Complete internal audits and management review. (Assess readiness → Stage 1)
- Stage 1: Check scope, design and readiness. (Assess practice → Stage 2)
- Stage 2: Check the system working in practice. (Decision → Certification decision)
- Certification decision: NQA issues a certificate if the decision is positive.

The stages show the work to plan. Their widths do not represent time. The audit descriptions and decision follow NQA’s process.

Source: nqa.com, ISO 27001 Certification: Benefits, ISMS & Data Protection, NQA, https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide (checked 8 October 2026); nqa.com, NQA Global Accredited Certification Body, https://www.nqa.com/en-gb/lp/iso-27001 (checked 8 October 2026)

## Can you get ISO 27001 in three months?

Three months of operation is a requirement stated by NQA. Its page also calls for a management review and a full cycle of internal audits. It does not say that starting from scratch and getting a certificate takes three months ([nqa.com, NQA Global Accredited Certification Body](https://www.nqa.com/en-gb/lp/iso-27001), checked 8 October 2026).

Ask your chosen certification body what evidence it needs and when it can assess you. ISO recommends comparing certification bodies. The body you choose carries out certification, rather than ISO itself ([committee.iso.org, ISO, Certification](https://committee.iso.org/certification.html), checked 8 October 2026).

**Separate these parts of the timetable**

| Part of the work | What to put in your plan |
| --- | --- |
| Preparation | The work needed to build and run the security system. |
| Operating evidence | What shows the system working, including internal audits and management review. |
| External audit | Stage 1 readiness and Stage 2 assessment of practice. |
| Decision | The certification body’s decision after the audit. |

Source: nqa.com, ISO 27001 Certification: Benefits, ISMS & Data Protection, NQA, https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide (checked 8 October 2026); nqa.com, NQA Global Accredited Certification Body, https://www.nqa.com/en-gb/lp/iso-27001 (checked 8 October 2026)

## What makes the preparation hard?

Preparation can be hard because the work reaches beyond the IT team. Your system covers people and processes as well as technology. It also needs checks that fit your risks and evidence that the arrangements work ([nqa.com, ISO 27001 Certification: Benefits, ISMS & Data Protection, NQA](https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide), checked 8 October 2026).

Use these questions to turn a target date into named tasks. They are planning prompts, not a prediction of how long your organisation will take.

**Questions to settle before promising a date**

| Question | What to write down |
| --- | --- |
| What are we asking the auditor to assess? | The proposed scope and who will agree it. |
| Which safeguards fit our risks? | The decisions, the reasons and who will put them into practice. |
| What is already working? | The evidence available and the gaps to close. |
| Who will do the internal audit? | The person responsible and when the results will be ready. |
| When will management review the results? | The review date and who can agree improvements. |

Source: nqa.com, ISO 27001 Certification: Benefits, ISMS & Data Protection, NQA, https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide (checked 8 October 2026)

## Does buying software finish the preparation?

Buying software does not demonstrate that your security system works. The audit process checks the system in practice, including evidence of internal audits and management review. Keep that work visible in the plan, whichever tools you use ([nqa.com, ISO 27001 Certification: Benefits, ISMS & Data Protection, NQA](https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide), checked 8 October 2026).

## Who should you ask for an audit timetable?

Ask the certification body that will assess you. ISO recommends comparing bodies and checking their accreditation, which is an independent check of the body’s competence. In the UK, UKAS accredits bodies that certify organisations to ISO 27001 ([committee.iso.org, ISO, Certification](https://committee.iso.org/certification.html) and [UKAS, Accreditation of information security, cybersecurity and privacy protection](https://www.ukas.com/accreditation/sectors/digital/info-sec/), checked 8 October 2026).

Bring the proposed scope and the evidence you already have. Ask what must be ready for each stage, what operating history the body expects and what happens after the assessment ([nqa.com, ISO 27001 Certification: Benefits, ISMS & Data Protection, NQA](https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide) and [nqa.com, NQA Global Accredited Certification Body](https://www.nqa.com/en-gb/lp/iso-27001), checked 8 October 2026).

## What to do

1. Write down what the system will cover and the risks it needs to address ([nqa.com, ISO 27001 Certification: Benefits, ISMS & Data Protection, NQA](https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide), checked 8 October 2026).
2. Name the work needed to run it, check it and improve it ([nqa.com, ISO 27001 Certification: Benefits, ISMS & Data Protection, NQA](https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide), checked 8 October 2026).
3. Plan the internal audits and management review ([nqa.com, ISO 27001 Certification: Benefits, ISMS & Data Protection, NQA](https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide), checked 8 October 2026).
4. Compare certification bodies and ask each for its evidence requirements and audit timetable ([committee.iso.org, ISO, Certification](https://committee.iso.org/certification.html) and [nqa.com, ISO 27001 Certification: Benefits, ISMS & Data Protection, NQA](https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide), checked 8 October 2026).

## Common questions

### Is three months a universal ISO 27001 deadline?

No. The three months described here is NQA’s own minimum operating-history requirement. It also asks for internal audits and a management review. Do not use it as a promise about another body or a whole project ([nqa.com, NQA Global Accredited Certification Body](https://www.nqa.com/en-gb/lp/iso-27001), checked 8 October 2026).

### Can a small business plan the work itself?

Start by naming who will build, run, check and improve the system. If you use outside help, keep those tasks clear. The assessment still needs evidence of a working system ([nqa.com, ISO 27001 Certification: Benefits, ISMS & Data Protection, NQA](https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide), checked 8 October 2026).

### Is the audit the whole project?

No. Preparation includes running and checking the system before its external assessment. The audit then reviews readiness and how the system works in practice ([nqa.com, ISO 27001 Certification: Benefits, ISMS & Data Protection, NQA](https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide), checked 8 October 2026).

## Where next

- [What does ISO 27001 certification take, and who can certify you?](https://theassurancedesk.com/guides/iso-27001-certification-and-who-can-certify-you.md)
- [How much does ISO 27001 certification cost in the UK?](https://theassurancedesk.com/guides/iso-27001-certification-cost-uk.md)
- [How to find UKAS accredited ISO 27001 certification bodies](https://theassurancedesk.com/guides/ukas-accredited-iso-27001-certification-bodies.md)
- [How do you answer a security questionnaire without a certificate?](https://theassurancedesk.com/guides/security-questionnaire-without-certification.md)

## Sources

- nqa.com, ISO 27001 Certification: Benefits, ISMS & Data Protection, NQA: https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide (checked 8 October 2026)
- nqa.com, NQA Global Accredited Certification Body: https://www.nqa.com/en-gb/lp/iso-27001 (checked 8 October 2026)
- committee.iso.org, ISO, Certification: https://committee.iso.org/certification.html (checked 8 October 2026)
- UKAS, Accreditation of information security, cybersecurity and privacy protection: https://www.ukas.com/accreditation/sectors/digital/info-sec/ (checked 8 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.