“How long will ISO 27001 take?” is almost always the first question, and the honest answer is: it depends more on your organization’s readiness than on the standard itself.
For a mid-sized organization starting close to zero formal information security management, a…
Before you can realistically schedule a Stage 1 audit, you need:
The most common reason a certification timeline slips isn’t the audit itself —…
For a mid-sized organization starting close to zero formal information security management, a typical path to certification runs three to six months of implementation, followed by a Stage 1 and Stage 2 audit from an accredited certification body. Organizations with existing security practices — access controls, backup procedures, incident response, even if undocumented — can move faster, because the gap assessment finds less to build from scratch.
Before you can realistically schedule a Stage 1 audit, you need:
The most common reason a certification timeline slips isn’t the audit itself — it’s evidence. Writing a policy is fast; generating three months of consistent operational evidence that the policy is actually being followed takes exactly three months, and there’s no way to compress that. Organizations that try to rush straight from policy-writing to Stage 2 without an operating history typically get non-conformities for exactly this reason.
If you’re also pursuing SOC 2 — common for SaaS vendors selling into the US — there’s substantial control overlap with ISO 27001 Annex A. Mapping both frameworks’ requirements together from the start avoids duplicating evidence-collection work later.
The certification body’s audit scheduling can sometimes be expedited, but the operating-evidence requirement can’t be — auditors are specifically checking that controls have been running long enough to generate a track record, which an expedited booking doesn’t shortcut.
They can be implemented together efficiently, since ISO 27701 (the privacy information management extension) builds directly on an ISO 27001 ISMS. Organizations with both security and privacy obligations — most that handle personal data — often implement them as one combined programme.
No. Certification is maintained through annual surveillance audits and a full recertification audit every three years, so the ISMS has to keep operating, not just exist at the point of the original audit.