How long does ISO 27001 usually take?
Plan on three to nine months. The audits themselves take days.
The time goes into building the management system, letting it run long enough to produce evidence, and working around the certification body's diary. Any timescale quoted before someone has seen your scope and starting position is a guess, which is why I give an indicative plan after discovery and gap analysis.
How long does ISO 27001 take for an organisation of your size?
| Organisation | Typical time to certificate | What shapes it |
|---|---|---|
| Under 50 staff, single site | 3–6 months | Cloud-based systems, one main service, fast decisions |
| 50–250 staff | 6–9 months | Several departments and suppliers, more evidence to generate |
| 250–1,000 staff | 9–12 months | Formal change processes, multiple systems and owners |
| Over 1,000 staff or multi-site | 12–18 months | Several sites or subsidiaries, regulatory overlap |
Where does the time go in an ISO 27001 project?
| Phase | Typical duration |
|---|---|
| Scoping, context and gap analysis | 2–4 weeks |
| Risk assessment, treatment plan and Statement of Applicability | 2–6 weeks |
| Building and implementing policies and controls | 2–5 months |
| Operating the system to generate evidence | Around 3 months, overlapping the phase above |
| Internal audit and management review | 2–4 weeks |
| Stage 1 audit, then the gap before Stage 2 | 4–8 weeks |
| Stage 2 audit and the certification decision | 2–6 weeks |
My implementation guide explains what happens at each stage. Stage 1 versus Stage 2 explains the two audits in detail.
Which part of the timeline cannot be compressed?
Most phases can be shortened with focus and senior help. One cannot: before Stage 2, the management system has to have operated for a period, and certification bodies typically look for around three months of records.
Those records are dated access reviews, risk reviews, training records, supplier assessments and a management review that genuinely happened. Dated records take calendar time to create.
This is the main reason honest programmes measure in months, and why starting earlier is almost always cheaper than going faster. Costs behave the same way, as my guide to ISO 27001 costs in the UK explains.
What delays ISO 27001 projects most often?
- No internal owner. Decisions wait for diaries that never align.
- Scope debated too long. Everything downstream waits on the boundary decision.
- Booking the certification body too late. Audit diaries fill weeks ahead.
- Evidence left to the end. Controls implemented in month four cannot produce month-one records.
- Waiting for perfection. The standard expects a working, improving system. Flawless can wait.
What if you have a fixed deadline?
Work backwards from it: Stage 2 date, minus the gap after Stage 1, minus the evidence period, minus the build. If the arithmetic does not work, say so early, because customers and tender panels respond better to a credible programme with dates than to a promise that collapses.
My guide for organisations whose customer requires ISO 27001 covers exactly that conversation.