“How long does ISO 27001 certification take?” is one of the first questions leadership asks, and the honest answer is three to twelve months for most organisations. The range is wide because the timeline depends on your size, your starting maturity, and how much effort you can commit. This guide breaks down what drives the schedule so you can answer “how long does ISO 27001 certification take” for your own situation.
The short answer
- Small, well-prepared company: ~3–4 months
- Typical mid-sized organization: ~6–8 months
- Large or complex scope, starting from scratch: 9–12+ months
What drives the timeline
- Scope. A single product team certifies far faster than a whole multi-site enterprise.
- Starting point. If you already have security controls and policies, you’re closing gaps rather than building from zero.
- Documentation effort. Authoring 30+ policies and registers from a blank page is the most common source of delay.
- Resource commitment. A dedicated owner moves things along; a side-of-desk project stalls.
- The mandatory “operating” period. Auditors need to see the ISMS running and generating records before Stage 2 — typically a few months of evidence.
A realistic phase-by-phase timeline
- Gap analysis (2–4 weeks). Understand where you stand against the standard.
- Documentation & ISMS build (4–12 weeks). Write policies, run the risk assessment, produce the Statement of Applicability. This is where a template set saves the most time — see the required documents checklist.
- Implementation & operation (8–16 weeks). Roll out controls and let the ISMS generate real records.
- Internal audit & management review (2–4 weeks). Required before you can certify.
- Stage 1 & Stage 2 audits (3–6 weeks, plus scheduling). The certification body’s readiness review, then the full audit.
Shave months off the build.
The biggest time sink is writing documentation from scratch. The ISO 27001 Toolkit gives you the full, auditor-written document set ready to tailor — so you spend your time implementing, not drafting.
How to move faster (without cutting corners)
- Keep the scope tight for your first certificate; you can expand later.
- Start from proven documentation instead of drafting from scratch.
- Assign a single accountable owner with real time allocated.
- Book your certification body early — audit slots are often weeks out.
- Run the ISMS in parallel with finishing documentation, so the evidence clock starts sooner.
So, how long does ISO 27001 certification take in practice?
For a small, well-run company using a documentation toolkit and a focused project owner, three to four months to Stage 2 is achievable. Mid-sized organisations building an ISMS from scratch typically need six to nine months, and complex or heavily regulated environments can run past a year. The single biggest accelerator is not starting from a blank page: pre-written, mapped policies remove weeks of drafting. The certificate itself is issued by an accredited body against the ISO standard after a successful two-stage audit, so book your audit dates early, as good assessors are often scheduled months ahead.
It also helps to understand why the range is so wide. A company that already runs mature IT processes, has leadership buy-in, and dedicates a project owner can compress the work dramatically, while one starting from scratch spends most of its time writing policies and building evidence. Surveillance and the gap between Stage 1 and Stage 2 audits add fixed waiting periods you cannot rush, so the realistic answer to how long ISO 27001 certification takes is “as fast as your preparation and your certification body’s calendar allow.”
Frequently asked questions
Can we get certified in under three months?
It’s possible for a small, security-mature team with tight scope and dedicated resources — but the mandatory operating/evidence period makes a genuinely rushed certification difficult.
How long is the certificate valid?
Three years, with annual surveillance audits and a recertification audit at the end of the cycle.
For the full picture of the process, see our complete guide to ISO 27001 certification.
The takeaway: how long ISO 27001 certification takes is largely within your control. Commit an owner, use ready-made documentation, and fix findings promptly, and you will land at the fast end of the range.
People ask how long does ISO 27001 certification take because they need to plan budgets, resource a project, and set a go-live date for the certificate. The most useful way to answer how long does ISO 27001 certification take for your business is to run a short gap analysis first: it converts the generic three-to-twelve-month range into a schedule grounded in your real starting point.