ISO 27001 timetables: what can be shortened and what cannot

Organisations preparing for ISO/IEC 27001 certification usually want to know how long it will take. The honest answer is that it depends, and that some of the variables sit outside the organisation's control. Understanding which parts of a programme can be planned more efficiently, and which cannot, helps set realistic expectations with customers, investors and boards.

The standard sets requirements, not a calendar

ISO/IEC 27001:2022 specifies requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS). It includes requirements for assessing and treating information security risks, and Annex A lists 93 reference controls grouped into four themes [1]. Implementation guidance for those controls is published separately in ISO/IEC 27002:2022 [6].

Nothing in the standard fixes how long implementation should take. What it does require is that the management system operates: risks are assessed and treated, controls are selected and justified in a Statement of Applicability, internal audits are carried out and top management reviews the ISMS [1]. Those activities take place over time, and that is the main reason a credible timetable cannot be reduced to a documentation exercise.

How the certification audit is structured

Certification bodies that audit management systems work to ISO/IEC 17021-1:2015, which sets requirements for their competence, consistency and impartiality [2]. For ISMS certification, ISO/IEC 27006-1:2024 adds requirements specific to information security, and replaced ISO/IEC 27006:2015 [3]. Certification bodies are in turn assessed by accreditation bodies, such as the United Kingdom Accreditation Service (UKAS) in the UK [5].

Under ISO/IEC 17021-1, initial certification is a two-stage audit. Stage 1 reviews the management system's design and readiness, including whether internal audits and management reviews are being planned and performed. Stage 2 evaluates whether the system is implemented and effective. Certificates then run on a three-year cycle with surveillance audits in the intervening years and a recertification audit before expiry [2].

What affects your timetable

The following factors usually have the greatest influence on how long preparation takes:

• Starting position. An organisation that already operates documented access control, change management, supplier management and incident response has less to build than one starting from informal practice.
• Scope. A scope covering one product, one hosting environment and one team is simpler to implement and audit than one spanning several sites, business units or legal entities.
• Operating evidence. Auditors look for evidence that controls are working, such as access reviews completed, incidents logged and training delivered. That evidence accumulates only as the controls operate.
• Internal audit and management review. Both are ISO/IEC 27001 requirements and need to have taken place, with outputs recorded, before the certification audit can assess them properly.
• Decision-making capacity. Risk treatment decisions, policy approvals and resourcing depend on management availability.
• Certification body scheduling. Certification bodies plan audits around auditor availability. Booking early reduces waiting time but does not change what the audit requires.

What can reasonably be made more efficient

Some parts of a programme respond well to better planning. Working from a structured set of policy and procedure templates, tailored to the organisation, can reduce drafting time compared with writing from nothing. Running workstreams in parallel, rather than one after another, can shorten elapsed time where people are available. Agreeing scope early and approaching certification bodies once scope is stable can avoid delays later.

Other parts do not compress. The risk assessment still needs to reflect the organisation's real risks. Controls still need to operate for long enough to produce meaningful evidence. The internal audit still needs to be conducted objectively and impartially, as the standard requires [1]. The certification body still decides the audit duration and makes the certification decision independently. A plan that appears to shorten any of these deserves close scrutiny.

Questions to ask of any proposed plan

1. What is the proposed ISMS scope, and has it been agreed with management in writing?
2. Which controls in Annex A are expected to be excluded, and on what justification?
3. How long will key controls have operated before the Stage 2 audit, and what evidence will exist?
4. When will the internal audit and management review take place, and who will conduct the internal audit?
5. Which accredited certification body is proposed, and has its availability been confirmed?
6. What happens to the plan if the Stage 1 audit identifies issues that need resolving before Stage 2?

Clear answers to these questions are a better indicator of a realistic plan than any headline duration. Where a timetable matters to a customer or investor, it is usually more credible to share the plan and its dependencies than a single target date.

Readiness support is available for organisations planning an ISO/IEC 27001:2022 programme and assessing what their own timetable depends on.