The ISO 27001 certification process: how to get certified, end to end

Written from the standards themselves · Editor-reviewed · Checked against the current editions on 23 October 2026

By the iso27001partners.co.uk editorial team · Published 20 September 2026 · Last reviewed 23 October 2026 · 10 min read

7 primary sources cited on this page. How we check what is on this site

The constraint nobody mentions on the first call Clauses 9.2 and 9.3

You cannot sit Stage 2 until you have run an internal audit and held a management review, and neither is meaningful unless the management system has actually been operating. That is the floor under your timeline, and money does not move it.

The audit is the part with a published length and it is the short part. Everything before it is your work, has no fixed duration, and is where both the cost and the delay actually live. In short, to get ISO 27001 certified you build and run the management system, apply to a certification body, and pass an initial audit that ISO/IEC 17021-1 requires to be in two stages; surveillance audits follow in the first and second years and a recertification audit in the third. The 13 steps are set out below.

Everything left of the dashed line has no fixed length and is where the cost varies. Everything right of it runs to a published day count.

The same diagram as a table

The certification cycle
Step	Whose work	Required by
Gap analysis	You or a consultant	Nothing — optional, but usual
Implementation: risk assessment, risk treatment, Statement of Applicability	You or a consultant	Clause 6
Internal audit	You or a consultant — never your certification body	Clause 9.2
Management review	Your management	Clause 9.3
Stage 1 audit	Certification body	ISO/IEC 17021-1
Stage 2 audit	Certification body	ISO/IEC 17021-1
Certificate issued, valid three years	Certification body	—
Surveillance audit, year 1	Certification body	One third of the initial audit time
Surveillance audit, year 2	Certification body	One third of the initial audit time
Recertification, year 3	Certification body	Two thirds of the initial audit time

How to apply for ISO 27001 certification

You apply to a certification body, not to ISO or UKAS. The body must collect the information it needs: ISO/IEC 17021-1 9.1.1 requires an authorised representative of the applicant to provide what establishes:

What a certification body must establish from your application (ISO/IEC 17021-1:2015 9.1.1, verbatim)
	The certification body establishes
a	the desired scope of the certification
b	relevant details of the applicant organization as required by the specific certification scheme, including its name and the address(es) of its site(s), its processes and operations, human and technical resources, functions, relationships and any relevant legal obligations
c	identification of outsourced processes used by the organization that will affect conformity to requirements
d	the standards or other requirements for which the applicant organization is seeking certification
e	whether consultancy relating to the management system to be certified has been provided and, if so, by whom

Then the body decides whether it can take you on

It reviews the application, including whether it has the competence for your scope, and then: “Following the review of the application, the certification body shall either accept or decline an application for certification.” Item (e) is there because of the impartiality rules: a consultancy related to the body can bar it from certifying you. See consultants.

What you are certified against

ISO 27001 is not a list of 93 security controls. You are audited against clauses 4 to 10, which describe a management system. Annex A is a reference set you select from, and the selection is justified in a Statement of Applicability.

ISO/IEC 27001:2022, clauses 4 to 10 — what you are actually audited against
Clause	Name	What it asks for
4	Context of the organisation	Who you are, who cares, and what is in scope.
5	Leadership	A policy, assigned roles, and management that owns the thing.
6	Planning	Risk assessment, risk treatment, the Statement of Applicability, objectives.
7	Support	Resources, competence, awareness, communication, documented information.
8	Operation	Running the risk assessment and treatment you planned in clause 6.
9	Performance evaluation	Monitoring, internal audit, management review.
10	Improvement	Nonconformity, corrective action, continual improvement.

The distinction matters commercially as well as technically. Two organisations of identical size can have honestly different amounts of work ahead of them, because the work is driven by what their risk assessment produced and not by a fixed checklist. It is also why “how many controls have you got left?” is the wrong question to put to a consultant.

The ISO 27001 certification process in 13 steps

Every step in order, the clause or rule behind it, and whose work it is:

The ISO 27001 certification process, step by step, with the clause or rule behind each step
#	Step	Required by	Whose work	What it is
1	Gap analysis	Optional	You, or a consultant	Where you are against clauses 4 to 10 and Annex A. Produces the plan, not the ISMS.
2	Scope	Clause 4.3	You	What is in and what is out. This decides the headcount, so it decides the audit fee.
3	Risk assessment and treatment	Clause 6.1	You, or a consultant	The core of the standard. Everything in Annex A flows from what this produced.
4	Statement of Applicability	Clause 6.1.3 d)	You	Which Annex A controls apply, why, and — the part people forget — why the excluded ones do not.
5	Documented information	Clause 7.5	You, or a consultant	Policies and records. The part a toolkit genuinely accelerates.
6	Operate it	Clause 8	You	The system has to actually run. This is the floor under the timeline.
7	Internal audit	Clause 9.2	You, a consultant, or a contractor — never your certification body	Required before Stage 2. Your certification body is barred from doing this for you.
8	Management review	Clause 9.3	Your management	Required before Stage 2, with named inputs. Minutes are the evidence.
9	Stage 1 audit	ISO/IEC 17021-1	Certification body	Readiness and documentation. Produces findings you have to close.
10	Stage 2 audit	ISO/IEC 17021-1	Certification body	The certification audit proper. Evidence that the system is operating.
11	Certificate	—	Certification body	Issued after the certification decision, which is made by people who did not carry out the audit. Valid three years.
12	Surveillance, years 1 and 2	one third of the initial audit	Certification body	Annual, and not optional: not allowing it is a ground for suspension.
13	Recertification, year 3	two thirds of the initial audit	Certification body	Then the cycle repeats.

The certification body's six stages

Counted from the certification body's side, the cycle has six stages. ISO/IEC 17021-1: “The audit programme for the initial certification shall include a two-stage initial audit, surveillance audits in the first and second years following the certification decision, and a recertification audit in the third year prior to expiration of certification.” Between the audits sits the certification decision:

The certification body's stages in the first three-year cycle (ISO/IEC 17021-1:2015 9.1.3.2 and 9.5)
#	Stage	When
1	Stage 1 audit	Initial audit, first stage
2	Stage 2 audit	Initial audit, second stage
3	Certification decision	After Stage 2, by people who did not audit
4	First surveillance audit	Within 12 months of the certification decision
5	Second surveillance audit	Year two
6	Recertification audit	Year three, before expiry

The two-supplier rule

Read the third column again. Everything above Stage 1 is yours or a consultant's; everything from Stage 1 down is the certification body's; and the internal audit row says explicitly that it cannot be the certification body. You are buying from two separate suppliers, and the standard requires them to be separate.

How long ISO 27001 certification takes

No rule sets a total. What the rules do set is which parts have a fixed length, which have a floor, and which depend on you:

What sets the length of each part of the ISO 27001 timeline (sources as named)
Part	What sets its length	Source
Preparation (scope, risk assessment, controls, documents)	Your size, scope and starting point; no published rule	—
Operating the system before Stage 2	Long enough for an internal audit and a management review to have something to examine	Clauses 9.2, 9.3; 17021-1 9.3.1.2.2 g
Stage 1 and Stage 2 audit days	Headcount band, e.g. 5 days for 1–10 people	ISO/IEC 27006-1:2024 Table C.1
Gap between Stage 1 and Stage 2	Your time to resolve Stage 1 concerns, and scheduling	17021-1 9.3.1.2.4
A major nonconformity at Stage 2	Must be verified within 6 months of Stage 2, or Stage 2 is repeated	17021-1 9.5.3.2
Certification decision	Made by people who did not audit; after Stage 2	17021-1 9.5.1.1
First surveillance audit	No more than 12 months after the certification decision	17021-1 9.1.3.3

So the honest answer to “how long?” is: as long as it takes your system to run and produce the evidence the internal audit and management review need, plus the audit and decision steps above. Any fixed figure you are quoted is somebody's estimate.

The floor under the timeline

Ask how fast ISO 27001 can be done and you will be quoted a number of months. The useful answer is structural rather than numeric.

Clause 9.2 requires internal audits at planned intervals covering whether the ISMS conforms to your own requirements and to the standard, and whether it is effectively implemented and maintained. An internal audit of a management system that has been running for a fortnight has almost nothing to examine.

Clause 9.3 requires a management review with specified inputs. In the common text ISO 27001 applies, they begin with “the status of actions from previous management reviews” and include information on performance, including trends in nonconformities, monitoring results and audit results. Those inputs only exist once the system has run and produced them. See management review.

So the binding constraint is not how many consultant days you buy. It is that the system has to operate long enough to generate the evidence that the internal audit and the management review then consume. Stage 2 exists to test exactly that: “The purpose of stage 2 is to evaluate the implementation, including effectiveness, of the client’s management system. The stage 2 shall take place at the site(s) of the client.”

The second constraint is external: the audits are scheduled with the certification body. ISO/IEC 17021-1 also builds a gap into the process on purpose: “In determining the interval between stage 1 and stage 2, consideration shall be given to the needs of the client to resolve areas of concern identified during stage 1.” If you have a contractual date, ask about lead times on the first call.

Stage 1 and Stage 2 are one audit with a gap in it

Both stages come out of the same day count in the published table — they are not separately priced events. Stage 1 looks at readiness: scope, documented information, the risk assessment, the Statement of Applicability, and evidence that the internal audit and management review have happened. It produces findings.

Ring binders open to tabbed dividers beside printed evidence bundles — Stage 1 reads the documents. Stage 2 asks you to show the same things happening.

The gap exists so you can close those findings. Then Stage 2 looks for evidence that the system operates as documented: it samples records and interviews people beyond the compliance team. Stage 2 must include, among other things, “operational control of the client’s processes”.

The standard lists exactly what each stage must cover — seven objectives for Stage 1 and six things Stage 2 must audit. Stage 1 and Stage 2, item by item sets them out in the standard's own words.

The certificate itself comes after the certification decision, and the decision is separate from the audit: “The certification body shall ensure that the persons or committees that make the decisions for granting or refusing certification, expanding or reducing the scope of certification, suspending or restoring certification, withdrawing certification or renewing certification are different from those who carried out the audits.” So the certificate date is later than the last audit day. If a contract has a date on it, work backwards from the certificate, not from Stage 2.

Then it never stops

A certificate is valid for three years, but the audits are annual. One third of the initial audit in year one, the same in year two, and two thirds at recertification in year three — see what each surveillance audit must cover and what happens at recertification. Findings at any of them are graded as major or minor nonconformities. Add an internal audit every year, from somebody who is not your certification body, and a management review — see who can be your internal auditor.

Taken together, the three years after certification contain more audit time than certifying did. That is a knowable number on day one and it belongs in the business case. The cost page has the full table, or the calculator does it for your headcount.

The edition trap

ISO/IEC 27001:2022 was published on 25 October 2022, and ISO/IEC 27001:2022/Amd 1:2024, Climate action changes followed in February 2024. Two climate-change additions to clause 4: whether climate change is a relevant issue must be determined, and interested parties may have climate-related requirements. It changed no Annex A control and added no new control.

Certificates against ISO/IEC 27001:2013 ceased to be valid on 31 October 2025. Certificates issued against the 2013 edition ceased to be valid after that date. Any certificate you are shown today that still names ISO/IEC 27001:2013 is expired, whoever issued it. If you are collecting supplier certificates as part of your own Annex A supplier controls, this is worth a pass through the folder.

Where to go next

Common questions

How do I apply for ISO 27001 certification?

Apply to an accredited certification body. It will ask for your intended scope, your sites, processes and resources, any outsourced processes, the standard you want, and whether you used a consultant and who (ISO/IEC 17021-1 9.1.1). It then reviews the application and accepts or declines it before planning Stage 1.

What are the stages of the ISO 27001 certification process?

From the certification body's side there are six: Stage 1 audit, Stage 2 audit, the certification decision, surveillance audits in years one and two, and a recertification audit in year three. Before Stage 1 is your own work: scope, risk assessment and treatment, Statement of Applicability, documented information, operating the system, an internal audit and a management review.

How long does ISO 27001 certification take?

The audit is the short part and the only part with a published length. What sets the timeline is clauses 9.2 and 9.3: you cannot sit Stage 2 without having run an internal audit and held a management review, and neither is meaningful unless the management system has been operating long enough to produce evidence. That is the floor, and no budget removes it. Beyond that the variables are how much documented information you already have, how quickly your own people can make the decisions only they can make, and your chosen certification body's lead time — worth asking about on the first call.

What is the difference between Stage 1 and Stage 2?

Stage 1 examines whether you are ready: the scope, the documented information, the risk assessment, the Statement of Applicability, and whether the internal audit and management review have actually happened. It produces findings. Stage 2 is the certification audit proper, and looks for evidence that the system is operating as documented. They are separate visits with a gap between them precisely so you can close what Stage 1 found. Both are inside the single day count the published table gives you.

Can we skip the gap analysis?

Yes. Nothing in the standard requires one. It is a planning exercise, and whether it is worth buying depends on whether you already know what you are missing. A team already running another management system standard has much of the structure in place; a team that has never operated one has less to go on, and a gap analysis is a way to size the job before committing to a route or a date — our reading.

Who can do our internal audit?

Anyone competent and sufficiently independent of the activity being audited — an internal person from another team, a contractor, or a consultancy. What you cannot use is your certification body. BS EN ISO/IEC 17021-1:2015, clause 5.2 (Management of impartiality), full text clause 5.2.6 bars it from providing internal audits to its certified clients and says that doing so locks it out of certifying that management system for 2 years. It is an annual requirement, not a one-off.

What happens if we fail?

Stage 2 has no pass mark; it produces nonconformities graded major or minor. Before it can decide, the certification body must have, for a major one, “for any major nonconformities, it has reviewed, accepted and verified the correction and corrective actions”, and for a minor one only “for any minor nonconformities it has reviewed and accepted the client’s plan for correction and corrective action”. If a major cannot be verified within 6 months of the last day of Stage 2, Stage 2 is done again. Verification can take an additional full or limited audit, which is more audit time; in a tender the delay can cost more than the visit.

Does the certificate expire?

It is valid for three years from the certification decision, with surveillance audits in years one and two and recertification in year three (ISO/IEC 17021-1 clause 9.1.3.2). Not allowing surveillance at the required frequency is one of that standard's examples of grounds for suspension, and “Under suspension, the client’s management system certification is temporarily invalid.” Separately, certificates issued against the withdrawn ISO/IEC 27001:2013 edition ceased to be valid on 31 October 2025.

What is the Statement of Applicability actually for?

It is the document that connects your risk assessment to Annex A, and it is the one an auditor reaches for first. For each of the 93 controls in ISO/IEC 27001:2022 it records whether the control applies, the justification, and whether it is implemented. The part organisations under-do is the justification for exclusions: “not applicable” on its own is a finding waiting to happen, because the standard asks for the reasoning, not the conclusion.

Do we need to be certified to the amendment as well?

ISO/IEC 27001:2022/Amd 1:2024, Climate action changes was published in February 2024 and is part of the current standard. Two climate-change additions to clause 4: whether climate change is a relevant issue must be determined, and interested parties may have climate-related requirements. It changed no Annex A control and added no new control. In practice it means clause 4 has to show you considered whether climate change is a relevant issue for your organisation, and recorded the answer. The answer may legitimately be that it is not material to your ISMS. What an auditor is looking for is that the question was asked.

Sources cited on this page

Every figure above was read from the source it is attributed to on 20 September 2026. Figures that are our own arithmetic rather than a published rule are labelled as estimates wherever they appear. How we check this.