How Long Does ISO 27001 Certification Actually Take? (Real-world timelines)
Honest, evidence-based timelines for ISO 27001 certification across small, medium, and large organisations — including what causes delays.
Vendors love to say "ISO 27001 in 90 days!" The reality is messier. Here are honest timelines based on hundreds of real implementations across small, medium, and large organisations.
The two clocks
There are two timelines to keep separate: implementation (building the ISMS) and certification (the external audit cycle). The audit itself is split into Stage 1 (documentation review) and Stage 2 (operational audit), usually 4–8 weeks apart.
Small organisation (1–50 people)
Realistic timeline: 4–6 months end-to-end. The bottleneck is usually not the controls — it's getting management to make scoping decisions and getting evidence collected from people who already have day jobs.
Medium organisation (50–250 people)
Realistic timeline: 6–9 months. More stakeholders to align, more legacy systems to document, often a separate IT and security team to coordinate.
Large organisation (250+ people)
Realistic timeline: 9–18 months. Scoping alone can take 6–8 weeks. Multiple sites, group structures, and supplier landscapes all add complexity. Budget for a dedicated programme manager.
What actually causes delays
- Scoping indecision. "Should we include the subsidiary?" — debated for 6 weeks.
- Risk assessment drift. Re-doing it three times because the methodology keeps changing.
- Evidence collection. Asking 40 system owners for screenshots and policy approvals.
- Auditor availability. Top certification bodies are booked 3–4 months out.
- Stage 2 non-conformities. Major non-conformities can push certification back by months.
Cost side of the equation
For pricing benchmarks, see watkostiso27001.nl — a Dutch-language pricing reference that pairs well with this timeline guide.
Related posts
Related: external
Keep reading
- The Complete Guide to ISO 27001 Annex A Controls (2026 edition)
All 93 Annex A controls grouped by Organizational, People, Physical, and Technological categories — with practical implementation guidance for each set.
- ISO 27001 vs NIS2: How They Overlap and Where They Don't
A practical comparison of ISO 27001 and the NIS2 Directive — what overlaps, what doesn't, and why NIS2-obligated organisations should use ISO 27001 as their baseline.
- Statement of Applicability (SoA): The Single Most Important ISO 27001 Document
Everything you need to know about writing, maintaining, and defending your Statement of Applicability — the document auditors will spend the most time on.