In brief
How long ISO 27001 certification takes: readiness depends on your ISMS scope, the Stage 1 and Stage 2 audits follow the certification body's schedule.
How long does ISO 27001 certification take? It depends on two clocks: readiness, which your team controls (scope, risk assessment, Statement of Applicability, running the controls), and the Stage 1 and Stage 2 audits, which an accredited certification body schedules. pTrackly's own certification took 3 weeks of readiness and a 4-week audit; a customer case matched it. Your scope sets your number.
How long does ISO 27001 certification take from start to certificate?
ISO 27001 certification time is the sum of internal readiness, internal audit and management review, the two-stage certification audit, and the certification body's decision. Only the first two are in your hands. The audit is run by a certification body accredited under ISO/IEC 17021-1, so auditor availability and the outcome of Stage 1 decide the rest. There is no standard duration for every company; a useful estimate starts from the scope of your ISMS and how many controls already run today.
| Phase | Who controls the time | What drives it |
|---|---|---|
| Readiness (scope, asset inventory, risk assessment, SoA, policies, operating controls) | Your team | ISMS scope, number of systems and sites, controls already in place, owner time |
| Internal audit and management review | Your team (or a contracted internal auditor) | Required by clauses 9.2 and 9.3 before the certification audit |
| Stage 1 (documentation and readiness review) | Certification body | Auditor availability, completeness of ISMS documentation |
| Remediation between Stage 1 and Stage 2 | Your team | Number of Stage 1 findings |
| Stage 2 (implementation audit) | Certification body | Audit days set by size and complexity, auditor availability |
| Certification decision | Certification body | Their internal review, open nonconformities |
What does a fast ISO 27001 timeline look like in practice?
pTrackly certified its own ISMS in 7 weeks: 3 weeks to audit readiness, then a 4-week audit through certification. A customer reached the same result. In both cases most controls were already operating day to day, so the 3 weeks were about verifying and closing gaps, not building from nothing. The full story is in how pTrackly got ISO 27001 certified in 7 weeks. It is an example, not a promise: a different scope or starting point gives a different timeline.
What makes ISO 27001 readiness take longer?
Readiness time is driven by how much has to be created rather than documented. ISO/IEC 27001:2022 has 93 Annex A controls in four themes (organizational, people, physical, technological), and the Statement of Applicability must state whether each applies and why. A team that already runs access reviews, change management, backups and training mostly needs to record and evidence them; a team that does not must start operating them first.
- ISMS scope. One product and one office is far less work than the whole company across several sites.
- Asset inventory. The risk assessment depends on it; an incomplete inventory forces a restart.
- Policy approval. Policies circulating in email without an approver and a deadline are the most common source of delay.
- Owner time. A part-time owner with a few hours a week moves slower than one with protected time.
- Certification body scheduling. Contact certification bodies early and confirm their accreditation covers ISO/IEC 27001:2022.
Teams in IT outsourcing can follow the ISO 27001 implementation checklist for Vietnam IT outsourcing companies, and scope questions specific to outsourcing are covered in ISO 27001 for IT outsourcing companies.
Why can ISO 27001 finish sooner than a first SOC 2 Type II report?
ISO 27001 certifies a management system, while SOC 2 is an attestation report issued by a CPA firm. ISO 27001 needs an approved scope, a Statement of Applicability for all 93 controls, and an internal audit and management review before certification. A SOC 2 Type II report needs an observation period, typically 3 to 12 months; the AICPA sets no minimum. So ISO 27001 can be done before a first Type II report even though it involves more documentation. The ISO 27001 vs SOC 2 comparison covers which to start with.
What happens after the certificate is issued?
An ISO 27001 certificate runs on a 3-year cycle. Under ISO/IEC 17021-1 the certification body performs surveillance audits at least once a year in years 1 and 2 and a recertification audit before the cycle ends. Between audits you maintain the controls, run internal audits as planned, update the risk assessment when significant changes happen, and keep the SoA current. The transition from ISO/IEC 27001:2013 ended on 31 October 2025 under the IAF timeline, so every current certificate is against the 2022 edition.
Where does pTrackly fit, and what stays with you?
pTrackly includes the ISO 27001:2022 framework with policy templates tailored to your company, recurring evidence tasks (daily to yearly) with reminders 7, 3 and 1 days before they are due, a risk register scored by likelihood × impact, and an audit workspace where your auditor works the request list and evidence through an auditor portal. Controls are shared across frameworks, so adding SOC 2 or ISO 42001 reuses the work. pTrackly does not certify anyone and does not replace the certification body; scope, risk decisions and running the controls remain your team's job. See pTrackly for ISO 27001.
Frequently asked questions
How long does ISO 27001 take for a small company?
It depends on scope and on the controls already running more than on headcount. A small company with a tight scope and working processes can be audit-ready in weeks; pTrackly's own certification took 3 weeks of readiness and a 4-week audit.
How long is the gap between Stage 1 and Stage 2?
There is no fixed gap. The certification body schedules Stage 2 after reviewing Stage 1, and the interval depends on how many findings you must fix and on auditor availability.
How long is an ISO 27001 certificate valid?
The certificate runs on a 3-year cycle with surveillance audits at least once a year in years 1 and 2, followed by a recertification audit before it expires.
Do we need a consultant to get ISO 27001 certified?
No. The standard does not require one, and many teams run the project themselves with templates and an experienced owner. A consultant helps when the scope is broad or nobody on the team has run an ISO management system before.
