--- title: "How Long Does ISO 27001 Take? Timelines by Size" description: "How long ISO 27001 certification takes in the UK: realistic timelines by organisation size and project phase, and the evidence period that cannot be shortened." canonical: https://www.isosecurity.co.uk/resources/how-long-does-iso-27001-take updated: 2026-11-10 --- # How long does ISO 27001 take? Most UK organisations take three to nine months from starting work to receiving the certificate. A small, single-site business with reasonable controls in place usually takes three to six, and larger or multi-site scopes take nine to eighteen. ## How long does ISO 27001 usually take? Plan on **three to nine months**. The audits themselves take days. The time goes into building the management system, letting it run long enough to produce evidence, and working around the certification body's diary. Any timescale quoted before someone has seen your scope and starting position is a guess, which is why I give an indicative plan after discovery and gap analysis. ## How long does ISO 27001 take for an organisation of your size? | Organisation | Typical time to certificate | What shapes it | | ------------------------------ | --------------------------- | ------------------------------------------------------------ | | Under 50 staff, single site | 3–6 months | Cloud-based systems, one main service, fast decisions | | 50–250 staff | 6–9 months | Several departments and suppliers, more evidence to generate | | 250–1,000 staff | 9–12 months | Formal change processes, multiple systems and owners | | Over 1,000 staff or multi-site | 12–18 months | Several sites or subsidiaries, regulatory overlap | ## Where does the time go in an ISO 27001 project? | Phase | Typical duration | | -------------------------------------------------------------- | -------------------------------------------- | | Scoping, context and gap analysis | 2–4 weeks | | Risk assessment, treatment plan and Statement of Applicability | 2–6 weeks | | Building and implementing policies and controls | 2–5 months | | Operating the system to generate evidence | Around 3 months, overlapping the phase above | | Internal audit and management review | 2–4 weeks | | Stage 1 audit, then the gap before Stage 2 | 4–8 weeks | | Stage 2 audit and the certification decision | 2–6 weeks | My [implementation guide](/resources/iso-27001-implementation-guide) explains what happens at each stage. [Stage 1 versus Stage 2](/resources/iso-27001-stage-1-stage-2-audit) explains the two audits in detail. ## Which part of the timeline cannot be compressed? Most phases can be shortened with focus and senior help. One cannot: before Stage 2, the management system has to have operated for a period, and certification bodies typically look for around three months of records. Those records are dated access reviews, risk reviews, training records, supplier assessments and a management review that genuinely happened. Dated records take calendar time to create. This is the main reason honest programmes measure in months, and why starting earlier is almost always cheaper than going faster. Costs behave the same way, as my guide to [ISO 27001 costs in the UK](/resources/iso-27001-cost-uk) explains. ## What delays ISO 27001 projects most often? - **No internal owner.** Decisions wait for diaries that never align. - **Scope debated too long.** Everything downstream waits on the boundary decision. - **Booking the certification body too late.** Audit diaries fill weeks ahead. - **Evidence left to the end.** Controls implemented in month four cannot produce month-one records. - **Waiting for perfection.** The standard expects a working, improving system. Flawless can wait. ## What if you have a fixed deadline? Work backwards from it: Stage 2 date, minus the gap after Stage 1, minus the evidence period, minus the build. If the arithmetic does not work, say so early, because customers and tender panels respond better to a credible programme with dates than to a promise that collapses. My guide for organisations whose [customer requires ISO 27001](/resources/customer-requires-iso-27001) covers exactly that conversation. ## Frequently asked questions about ISO 27001 timescales ### Can ISO 27001 be done in 90 days? A small organisation with a narrow scope, good existing controls and fast decisions can occasionally be ready for Stage 1 in about three months. The constraint is usually the evidence period and certification-body booking lead times rather than effort, and nobody can guarantee it, so treat any promise of certification in a fixed number of days as a warning sign. ### What takes the longest in an ISO 27001 project? Two things: implementing controls across other people's diaries (access reviews, supplier assessments, awareness training, backup restore tests), and the evidence period. During that period the system simply has to run for a while, so an auditor sees dated records instead of documents created last week, and documentation alone is rarely the bottleneck. ### How long are the Stage 1 and Stage 2 audits themselves? Short. Stage 1 typically takes one or two days as a documentation and readiness review, and Stage 2 lasts from a couple of days for a small organisation to over a week for a large, multi-site scope; the audits are measured in days, and the preparation around them in months. ### When should we book the certification body? Earlier than feels natural. Popular certification bodies can have lead times of six to twelve weeks for Stage 1 dates, with Stage 2 usually four to eight weeks later, so booking once your implementation plan exists protects your deadline. ## Contact Working to a deadline? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.