ISO 27001 duration: how long certification takes

The time depends on the route and on how much of an information security management system (ISMS) you already run. A company with a written security policy, a documented risk assessment and a record of incidents is far ahead of one that handles security by habit.

The table shows both routes side by side. The figures for the classic route are indicative ranges for a company of 10 to 100 employees. Certification bodies set their own schedules, and larger or more complex organisations take longer.

• ISO 27001 certificate

On the classic route, an auditor from a certification body visits or connects to your company twice. Most of the calendar time goes into the work before the first audit, not into the audits themselves.

1. 01

   Preparation and gap analysis

   You define the scope of the ISMS, name responsibilities and compare your current practice with the requirements. Plan one to two months, longer if management decisions are slow.

2. 02

   Risk assessment and documentation

   You assess information security risks, write the security policy and objectives, select the Annex A controls and prepare the Statement of Applicability. This is the longest phase, typically three to six months.

3. 03

   Implementation, training and internal audit

   Controls must be running and staff trained before the auditor arrives. The standard also expects an internal audit and a management review (clauses 9), which add a few weeks.

4. 04

   Stage 1 audit

   The auditor reviews your documentation and checks whether you are ready for stage 2. Findings must be fixed before the next step.

5. 05

   Stage 2 audit and certificate decision

   The auditor examines whether the controls work in practice. The certification body then decides on the certificate, which can take two to six weeks.

Two companies of the same size can end up months apart. These factors account for most of the difference.

Existing documentation

A current risk assessment, an access policy and an incident log save weeks. Starting from nothing means writing all of it.

Scope

Certifying one product or one site is quicker than covering the whole company with several locations and suppliers.

Management attention

Risk decisions and the security policy need sign-off from leadership (clause 5). Projects stall when that sign-off waits for the next board meeting.

Audit calendar

Certification bodies book their auditors in advance. A gap of several weeks between stage 1 and stage 2 is common.

The Zertify route replaces the two audits with an online self-assessment of 48 yes/no questions. It takes about an hour. To pass, you must answer yes to all 13 questions that cover mandatory requirements of the standard, plus at least 24 of the other 35.

After you pass and pay, the certificate arrives within 4 hours. It is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before issue. The PDF carries a certificate number and a QR code that leads to a public verification page, so a customer can confirm it in seconds.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. You can start the assessment without an account.

• Start the free self-assessment
• See pricing
• More on ISO 27001 at Zertify

The hour covers answering the questions, not building an ISMS. If you can say yes to the 13 mandatory questions today, you will pass the same day. Typical examples are a defined risk assessment, a security policy with objectives, awareness training and a process for handling incidents.

If some answers are no, you close those gaps first. That work takes as long as it takes, but it is limited to what is missing and does not wait for an audit date. Many companies run through the questions once as a checklist, fix the open points and then take the assessment.

• Certification without an on-site audit

If a supplier questionnaire or a tender asks for an ISO 27001 certificate by the end of the month, the classic route will not get you there. The Zertify route will, provided your practice meets the requirements.

If your customer explicitly demands an on-site audit by a certification body, the classic route is the one to plan for, with the timeline above. Ask the customer which form of certificate they accept before you decide.

• Compare the certification routes
• Certification cost explained