How long ISO 27001 really takes, and which parts cannot be compressed

For an organisation under roughly 200 people with a contained scope and someone genuinely accountable for the programme, six to nine months from kick-off to Stage 2 is a reasonable expectation. Larger or more distributed scopes, regulated environments, or organisations where nobody owns the work run longer — often considerably.

That range is experience rather than a rule; the standard specifies no timeline at all. What it reflects is a fairly consistent shape: a short, intense documentation phase, then a longer period whose length is set by how often your controls run, then an audit sequence whose dates depend on a third party.

The useful thing is not the number. It is knowing which of those three you can spend money to shorten, and which you cannot.

This surprises people, because documentation is what the programme looks like from outside and it is where most of the anxiety sits. Writing a scope statement, a risk method, a Statement of Applicability and a set of policies is real work, but it is work with no waiting in it. A focused team, or a team with help, can move through it quickly.

The trap is that finishing the documents feels like finishing the programme, and it is roughly the halfway point. What follows is the part with elapsed time in it, and organisations that treat the document set as the deliverable tend to discover the remaining months late, having already told someone a date.

A useful reframe: the documents describe a system. The audit examines the system. Between describing and examining, the system has to run.

Controls with a periodic cadence have to have operated, visibly, with records, before an auditor can sample them. Access reviews, risk reassessment, supplier reviews, awareness training, backup restoration tests, vulnerability scanning cycles — if your policy says quarterly, then the evidence arrives quarterly, and no budget changes that.

This is the single question that sets your date: what has to run before the audit can test it, and when does it next run? Answer that and the timeline mostly draws itself backwards from the audit.

It also has a design consequence worth taking early. If a control is genuinely important, monthly cadence produces evidence three times faster than quarterly — and organisations sometimes set a quarterly cadence on paper because it sounds achievable, then wait a quarter for a record they could have had in weeks. Choose cadences you can actually sustain, but be aware you are also choosing your evidence rate.

Internal audit and management review sit in the critical path and are routinely scheduled last, which is exactly backwards.

They gate the audit because evaluating whether they are planned and performed is one of the stated objectives of the first certification visit. They also gate each other: a management review needs internal audit results to consider, so the two are a sequence rather than a pair, and a compressed version where both happen in the same week produces records that are technically present and visibly performative.

The sequence that works is: internal audit early enough that its findings can be acted on, corrective actions with dates, then a management review that considers the audit, the findings and what was done about them. That is three or four weeks of elapsed time minimum, and it is why "we will do those at the end" quietly adds a month.

In practice, rarely the standard. The recurring causes are ordinary: no single accountable owner, so decisions wait; a scope argued about for six weeks because it was treated as administrative rather than commercial; evidence collected manually by someone with another full-time job; and certification body lead times discovered at the point of booking rather than at the start.

That last one is worth acting on immediately. Talk to certification bodies early — not to commit, but to understand their availability, because their calendar is a hard input to yours and it does not flex for you. Lead times lengthen towards the end of the calendar year.

The other reliable accelerant is deciding, at the start, who signs off what. Most delay in these programmes is not work outstanding; it is work finished and waiting for a decision.