All services Every engagement has a fixed, published price. Book a strategy call
The short answer: commonly four to nine months, with the stage by stage timeline, the five drivers that set your number, and the evidence period money cannot compress.
Ask how long ISO 27001 takes and the market answers with a discovery call. Ask a vendor selling documentation and the answer is suspiciously short. Ask a consultancy selling day rates and the answer is suspiciously long. The honest answer is a range with named drivers, and this guide gives it: the timeline stage by stage, what sets your number, the one part money cannot compress, and the five ways organisations quietly lose three months.
The short answer. ISO 27001 certification commonly takes four to nine months end to end. A small organisation with mature security and a tight scope can land around four months. A mid sized first timer commonly needs six to nine. Large or multi site estates commonly run nine to twelve months or more. The floor under every timeline is the same: auditors commonly expect around three months of operating evidence before the Stage 2 audit, and that period cannot be compressed by spending more. Everything else can be run in parallel, which is where good planning earns its keep.
| Stage | Typical duration | What controls it |
|---|---|---|
| Gap analysis | Commonly 2 to 4 weeks | Estate size and how quickly your people can be interviewed |
| ISMS build | Commonly 6 to 16 weeks | Scope, starting maturity and the speed of your decisions |
| Operating evidence | Commonly around 12 weeks | The calendar. This runs partly in parallel with the build when planned well |
| Internal audit and management review | Commonly 1 to 2 weeks | Auditor availability and how many findings need fixing |
| Stage 1 audit and fixes | Commonly 2 to 4 weeks including the fix window | Certification body lead times and the state of your documentation |
| Stage 2 audit to certificate | Commonly 2 to 6 weeks after the audit days | Nonconformity closure and the certifier’s issue process |
The stages overlap in a well run programme, which is why the end to end total is commonly four to nine months rather than the sum of the rows. The full step by step detail of what happens in each stage is in our guide to the ISO 27001 certification process.
Your starting position sets more of the timeline than anything else. The free ISO readiness checker scores it in about six minutes and gives you a months estimate matched to your answers.
Scope. One office and one service line certifies months faster than an entire group. Scope is a choice, and it is the biggest single lever you control. Starting maturity. Organisations already running access reviews, incident logging and joiner leaver processes are recording what exists. Organisations starting cold are building habits, and habits take longer than documents. Decision speed. An ISMS needs owners named, risks accepted and policies signed. Every fortnightly steering meeting that defers a decision adds a fortnight. Certifier lead times. Certification bodies book audits weeks or months ahead, so the Stage 1 and Stage 2 slots must be reserved early rather than sought when you feel ready. Evidence. The fixed floor, covered next.
Certification bodies audit a system in operation, and auditors commonly expect around three months of operating records before Stage 2: access reviews held, incidents handled, risks treated, training delivered. No budget shortens the calendar. What good planning does instead is start the clock early: the evidence generating rhythms begin in the first weeks of the build rather than after it, so the evidence period runs inside the programme rather than after it. That single scheduling decision is commonly the difference between a six month journey and a nine month one.
| Organisation | Honest expectation | Why |
|---|---|---|
| Small, security mature, tight scope | Commonly around 4 months | Little to build, evidence starts immediately, decisions happen fast |
| Mid sized, first certification | Commonly 6 to 9 months | Real build work, habits to establish, evidence from a standing start |
| Large or multi site | Commonly 9 to 12 months or more | Scope negotiation, more owners, more sites sampled at audit |
Anyone quoting a fixed short timeline without asking about scope, maturity and decision speed is quoting their sales cycle rather than your certification.
The same five delays recur. Booking Stage 2 before the operating evidence exists, which converts the audit into a postponement. Letting scope grow mid build, which restarts risk work that was finished. Slow decisions, because a management system cannot outpace its management. Template documentation bounced at Stage 1, which triggers a rewrite under time pressure. And forgetting certifier lead times, which strands a ready ISMS in a queue. Every one of these is a planning failure rather than a security failure, which is why the fix is a calendar built backwards from the audit dates on day one.
Start with a gap analysis from £8,500 + VAT so the plan is built on evidence rather than optimism. Draw the tightest defensible scope and certify it first. Start the evidence rhythms in week one of the build, from £25,000 + VAT, and book the certification body at the same time. Buy the internal audit from £4,500 + VAT from people who had no hand in the build, early enough to fix what it finds. And once certified, keep the system alive between audits with a Managed ISMS from £2,500 + VAT per month, because the fastest recertification is the one you never stopped being ready for. The full pricing picture is in our guide to what ISO 27001 costs in the UK.
Commonly four to nine months end to end. Small, security mature organisations with a tight scope can land around four months, mid sized first timers commonly need six to nine, and large or multi site estates commonly run nine to twelve months or more.
Rarely, and only where the organisation is small, already mature and tightly scoped, because auditors commonly expect around three months of operating evidence before Stage 2. For most organisations the practical floor is around four months, and promises materially below that deserve scrutiny.
Commonly four to six months. The build is smaller and decisions are faster, but the operating evidence period and certifier lead times apply at every size, which sets the floor.
The operating evidence period, commonly around three months, because certification bodies audit a running system rather than a documented one. It is also the one stage money cannot shorten, which is why well run programmes start it in parallel with the build.
The certificate is valid for three years, with surveillance audits each year and full recertification at year three. A system kept alive between audits makes each of those a formality rather than a project.
Far less than first certification where the ISMS has been maintained: the recertification audit is booked like a surveillance visit and the system already holds three years of evidence. Where the system has decayed, recertification can approach first time effort, which is the expensive way to learn that maintenance was cheaper.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
