Most companies achieve ISO 27001 certification in 3 to 6 months. That range is accurate but not very actionable on its own, since where you land inside it depends on decisions you make in the first two weeks, not luck. This page breaks the timeline into phases so you can see what actually drives the number.
Wondering how long the certificate stays valid once you have it, a different question from how long it takes to get, see how long ISO 27001 certification lasts.
Month-by-Month Timeline for a Typical Company
| Phase | Typical duration | What happens |
|---|---|---|
| Gap analysis | 1 – 3 weeks | Current practices reviewed against all 93 Annex A controls and core clauses |
| Risk assessment & SoA | 2 – 4 weeks | Risk register built, Statement of Applicability drafted and approved |
| Policy & control implementation | 4 – 10 weeks | Policies written, technical controls deployed, remediation of gap findings |
| Internal audit & management review | 1 – 2 weeks | Required ISMS activities completed and evidenced before Stage 1 |
| Stage 1 audit | 1 – 2 days on-site/remote | Certification body reviews documentation and readiness |
| Stage 1 remediation | 2 – 6 weeks | Closing any findings before Stage 2 is booked |
| Stage 2 audit | 2 – 4 days | Implementation audit, evidence that controls actually operate |
| Certificate issued | 1 – 3 weeks after Stage 2 | Final report reviewed internally by the certification body before issuance |
Summed conservatively that's roughly 3 to 6 months end to end, matching the commonly quoted range, but the table shows where the real variability sits: implementation and Stage 1 remediation, not the audits themselves.
The Fastest Realistic Timeline
Around 6 to 8 weeks is the floor, and it requires everything to line up: a small, cloud-native company with strong existing security practices already in place, a tightly scoped ISMS covering one clear system, dedicated full-time effort rather than a side project, and a certification body with immediate availability. This is the exception. Most companies claiming a 6-week ISO 27001 certification either had most of the underlying work done already or are describing Stage 1 alone, not the full certification.
What Slows the Timeline Down
- Decision latency, not audit latency. The single biggest cause of delay is internal: gap findings that sit unaddressed, a risk assessment nobody finishes reviewing, a Statement of Applicability stuck in approval. This consistently costs more time than anything the auditor does.
- Scope creep. Adding locations, business units, or systems mid-project without adjusting the plan.
- Certification body availability. Reputable bodies book out four to eight weeks ahead, longer near year end when demand spikes.
- Failed Stage 1 or Stage 2 findings that require a second visit rather than a documentation fix.
- Multiple sites, each of which adds coordination time even before considering multi-site sampling.
Timeline by Starting Point
Where you start matters more than company size alone:
- Starting from nothing (no formal security programme): expect the full 4 to 6 months.
- Already running SSO, MFA, and basic access controls: often 3 to 4 months, since a meaningful share of Annex A is already partially addressed.
- Already ISO 9001 certified: often 4 to 6 weeks faster than starting cold. Both standards share the same Annex SL structure for management review, internal audit and document control, so that scaffolding is reused rather than rebuilt.
- Already SOC 2 compliant: substantial control overlap, commonly saving 30 to 40 percent of implementation effort, though the audits themselves remain fully separate.
Want a timeline scoped to your actual starting point?
We map your current maturity against Annex A in the first week, so the estimate reflects your situation, not a generic average.
Get a Free QuoteWhy Certification Body Booking Is the Overlooked Bottleneck
Most timeline discussions focus entirely on internal readiness and skip the fact that the auditor's calendar is a hard external constraint. Reputable, accredited certification bodies routinely book four to eight weeks out, and that window stretches further in the final quarter of the calendar year as companies rush to certify before year end for board reporting or renewal cycles.
Booking Stage 1 as soon as a realistic completion date is in view, rather than waiting until implementation is fully finished, is one of the highest-leverage moves available. A confirmed audit date also tends to sharpen internal focus more effectively than an open-ended internal deadline.
Can the Timeline Be Rushed for an Urgent Deal?
Partially. You cannot skip Stage 1 or Stage 2, and a genuinely under-prepared organisation cannot compress months of control implementation into days without risking a failed audit that costs more time overall. What can realistically be accelerated: prioritising certification-body booking early, running gap analysis and remediation in parallel instead of sequentially, and tightening scope to the smallest defensible boundary so there is simply less to implement and evidence.
Working against a deal deadline?
Tell us your timeline constraint and we'll tell you honestly whether it's achievable, and what sequencing gets you there fastest.
Talk to an Avantcert ExpertFrequently asked questions about ISO 27001 timelines
What is the fastest possible timeline for ISO 27001 certification?
Around 6 to 8 weeks is the realistic floor, and only for a small, cloud-native company with strong existing security practices, a tightly scoped ISMS, and a certification body with immediate availability. This requires dedicated full-time effort and is the exception, not the typical case.
How far in advance should we book our certification body?
Four to eight weeks before you expect to be ready for Stage 1, longer during busy periods such as the final quarter of the calendar year, when many companies rush to certify before year end. Certification body availability is one of the most common and most avoidable causes of timeline slippage.
Does having ISO 9001 already speed up ISO 27001 certification?
Yes, meaningfully. Both standards share the same Annex SL high-level structure, covering management review, internal audit, document control and continual improvement, so an organisation already running ISO 9001 typically saves four to six weeks by reusing that management-system scaffolding rather than building it from scratch.
What is the single biggest factor that slows down ISO 27001 timelines?
Delayed evidence and decision-making from the client's own team, not the audit itself. Gap analysis findings that sit unaddressed for weeks, a risk assessment that keeps getting pushed to next sprint, or a Statement of Applicability nobody signs off on account for more lost time across projects than any external factor, including the audit scheduling.
How long does the gap analysis phase take?
Typically one to three weeks for a single-site company. It involves reviewing current practices against all 93 Annex A controls and the core clauses of the standard, then producing a prioritised list of what's missing. Multi-site or highly regulated organisations can take four to six weeks.
How long between Stage 1 and Stage 2 audits?
Certification bodies typically require a minimum gap of a few weeks, and most organisations use six to twelve weeks to remediate any Stage 1 findings before Stage 2. Rushing Stage 2 immediately after Stage 1 without closing findings is a common cause of a failed or delayed certification decision.
Can ISO 27001 certification be rushed for an urgent deal?
Partially. You cannot skip Stage 1 or Stage 2, and a genuinely under-prepared organisation cannot compress the underlying implementation work into days without risking a failed audit. What can be accelerated is scheduling: prioritising certification-body booking, running gap analysis and remediation in parallel rather than sequentially, and tightening scope to the minimum defensible boundary.
How long does it take a very small company under 10 people to get certified?
Often on the faster end, 2 to 4 months, because there are fewer systems, fewer people, and less organisational complexity to document. The constraint at this size is usually not the audit itself but available hours: a ten-person company doing this alongside product work needs realistic time allocation, not just a smaller scope.
About Avantcert. Avantcert is an ISO and compliance certification consultancy that has guided 3,000+ organisations across 40+ markets to certification, with gap analysis, implementation and accredited audit readiness. See our ISO 27001 service or request a free quote.