ISO 27001 timeline 2026
How long does ISO 27001 certification take?
ISO 27001 certification usually takes 3 to 12 months from kick-off to certificate.[1] By size: 3-6 months under 50 staff, 6-9 months for 50-250, 9-12 months for 250-1,000 and 12-18 months above that.[2]
The two certification audits take only days. The time goes into building the ISMS, running it for a while, booking the certification body and the gap between Stage 1 and Stage 2.[2][4]
· 5 sources
By company size
ISO 27001 timeline by company size
| Company size | Typical timeline | Source |
|---|---|---|
| Startup, under 50 staff | 3-6 months | [2] |
| SME, 50-250 staff | 6-9 months | [2] |
| Mid-market, 250-1,000 staff | 9-12 months | [2] |
| Enterprise, 1,000+ staff | 12-18 months | [2] |
| Typical UK project, planning to certificate | 3-9 months | [3] |
| Fastest realistic case (narrow scope, good controls, quick audit dates) | about 3 months | [3] |
SECJUR splits the range by approach: under 50 staff, 3-6 months with an ISMS platform and 6-12 months with a consultant or by hand; 50-500 staff, 6-9 months versus 9-15 months.[4] That split is a vendor's own figure.
By phase
How long each phase takes
| Phase | Typical duration | Source |
|---|---|---|
| Gap analysis | 1-4 weeks | [2] |
| Implementation: controls, policies, risk assessment, documentation | 2-6 months | [2] |
| ISMS in operation before Stage 2 | at least 3 months | [2] |
| Internal audit | 1-3 weeks | [2] |
| Management review | 1 week | [2] |
| Wait between booking the auditor and the audit date | 8-12 weeks is common | [4] |
| Stage 1 audit (documentation review) | 1-2 days | [2] |
| Gap between Stage 1 and Stage 2 | 4-8 weeks; at most 6 months, or Stage 1 is repeated | [2] |
| Stage 2 audit (effectiveness) | 2-10 days, depending on size | [2] |
| Closing findings after Stage 2 | typically within 90 days | [4] |
| Certificate issued | 2-4 weeks after Stage 2 | [2] |
The certificate is valid for three years, with a surveillance audit every year in between.[1][3]
Delays
What makes it take longer
SECJUR names missing management commitment, scarce staff, a complex scope with many sites and legacy IT.[4] The audit dates often set the end of the project, so book the certification body early.
Where Matproof fits
Matproof is software that gets your ISMS audit-ready in about 4 weeks: scope, risk assessment, Annex A controls, policies and evidence in one place. That is the readiness part of the timeline.
Matproof does not certify. The certification audit is done by an accredited certification body, and its scheduling, the operating period it expects and the Stage 1 to Stage 2 gap add time on top. Starter costs €290 a month, Professional €690 a month.[5]
14 days free. Card required, €0 today. Cancel in one click.
FAQ
Frequently asked questions
How long does ISO 27001 certification take?
Usually 3 to 12 months from kick-off to certificate (Vanta). ISMS.online gives 3-6 months for companies under 50 staff, 6-9 months for 50-250, 9-12 months for 250-1,000 and 12-18 months above that (updated 18 March 2026).
What is the fastest realistic ISO 27001 timeline?
About 3 months, according to SureCloud, when the scope is narrow, good controls already exist and the certification body has early audit dates. Most companies take longer.
How long are the Stage 1 and Stage 2 audits?
Stage 1, the documentation review, takes 1-2 days. Stage 2, the effectiveness audit, takes 2-10 days depending on company size (ISMS.online). SureCloud gives 2-5 days for Stage 2.
How much time is there between Stage 1 and Stage 2?
Usually 4 to 8 weeks (ISMS.online); SECJUR gives 4 to 12 weeks. The gap must not exceed six months, or Stage 1 has to be repeated (ISMS.online).
How long is an ISO 27001 certificate valid?
Three years. A surveillance audit takes place every year, and a recertification audit follows after three years.
Can software make ISO 27001 faster?
It shortens the readiness work. Matproof's claim is audit-ready in about 4 weeks. The audit itself is booked with an accredited certification body, so its lead time and the gap between Stage 1 and Stage 2 stay the same.
Does Matproof issue the ISO 27001 certificate?
No. Matproof is compliance software. Only an accredited certification body can audit and certify your ISMS.
Sources
Every source was read on 28 October 2026.
- Vanta, How long does it take to get ISO certified? (no page date, read 28 Oct 2026)https://www.vanta.com/collection/iso-27001/how-long-does-it-take-to-get-iso-certified
- ISMS.online, How Long Does ISO 27001 Take?, updated 18 March 2026https://www.isms.online/iso-27001/certification/how-long-does-certification-take/
- SureCloud, How Long ISO 27001 Certification Takes in the UK, 5 Feb 2026https://www.surecloud.com/blog-hub/how-long-iso-27001-certification-takes-in-the-uk
- SECJUR, ISO 27001 Zertifizierung: Ablauf mit Stage 1 und Stage 2 Audit, 10 Sept 2026https://www.secjur.com/blog/iso-27001-zertifizierung
- Matproof pricinghttps://matproof.com/pricing
Related
Get the readiness part done in about 4 weeks.
Start the 14-day trial and see your ISO 27001 scope, risks and controls in one place.
Start free trial