Skip to content

How long does ISO 27001 take?

You may hear "ISO 27001 in weeks." That is the time to get ready, not the time to get a certificate. Here is the honest timeline, step by step.

Your certificate
About 3 to 6 months
From the day you start, with two audits by an accredited certification body.
The audits
Stage 1, then Stage 2
Stage 1 reviews your documents. Stage 2, a few weeks later, tests that your controls work.
After that
A 3-year cycle
A surveillance audit each year, and a full recertification audit before year 3 ends.

Counted from the day you start. Getting ready takes about 4 to 8 weeks. Your certification body sets the audit dates.

Start free trialBook a demo

14-day free trial. No credit card.

Where the time goes

You control how fast you get ready. Then your ISMS has to run for a while, and two audits follow.

Scroll sideways to see the whole chart.

  • You and Strac Comply
  • Your ISMS runs, and you check it
  • Your certification body audits
  • Your certification body decides

Bars show a typical case. The bracket shows the earliest and latest week.

Five steps to your ISO 27001 certificate

Strac Comply builds your ISMS evidence. An accredited certification body audits it and issues the certificate.

  1. Step 1: Sign up, connect and set your scope

    Day 1

    You, in minutes

    Connect your cloud, identity provider and code. Then decide which parts of your company the ISMS covers. Strac Comply sets up the 93 Annex A controls and starts to collect evidence.

  2. Step 2: Build your ISMS

    About 4 to 8 weeks

    You, with Strac Comply

    Write down how you manage security risk, and put the controls in place. For example:

    • Do a risk assessment and a risk treatment plan
    • Approve your Statement of Applicability
    • Approve your security policies
    • Fix the failing tests Strac Comply finds

  3. Step 3: Run it, then check it yourself

    About 4 to 8 weeks

    You, over time

    Your ISMS must run and make records. Before Stage 2 you do an internal audit (clause 9.2) and a management review (clause 9.3). The standard sets no minimum time, but many certification bodies want a few months of records.

  4. Step 4: Stage 1 and Stage 2 audits

    About 4 to 6 weeks

    Your certification body

    Pick an accredited certification body early, because their dates fill up. Stage 1 reviews your documents and your readiness. Stage 2, a few weeks later, tests that your controls work.

  5. Step 5: Close findings and get your certificate

    About 2 to 4 weeks

    Your certification body

    Fix any major nonconformity the auditor finds. Then the certification body decides and issues your certificate. It is valid for 3 years.

What nobody can promise you

  • Only a certification body issues the certificate

    Strac is not a certification body. Software makes you ready faster. It does not set the audit dates or the decision.

  • The operating time is up to your auditor

    The standard sets no minimum. Ask your certification body how many months of records it wants before Stage 2.

  • Major findings must be fixed first

    The certificate waits until a major nonconformity is fixed. If it is not fixed in time, the body can repeat Stage 2.

Questions founders ask

Can I get ISO 27001 in a few weeks?

You can get ready in weeks. The certificate also needs your ISMS to run, an internal audit, a management review and two audits by a certification body. So most startups take about 3 to 6 months.

Without software, plan on 6 to 12 months.

How long must my ISMS run before the audit?

ISO 27001 sets no minimum. Many certification bodies want a few months of records, including your internal audit and management review, before Stage 2. Ask yours when you book.

What is the difference between Stage 1 and Stage 2?

Stage 1 reviews your documents, such as your scope, risk assessment and Statement of Applicability, and checks you are ready. Stage 2 tests that your controls work in practice. It usually comes a few weeks after Stage 1.

How long is an ISO 27001 certificate valid?

3 years. A surveillance audit happens each year in between, and a recertification audit renews the certificate before it ends.

Is ISO 27001 faster than SOC 2?

Often about the same. ISO 27001 has no observation period like a SOC 2 Type II, but it needs an internal audit, a management review and two audits. A first SOC 2 Type II takes about 4 months.

Does Strac issue the certificate?

No. An accredited certification body audits you and issues the certificate. Strac Comply gets you ready and keeps your evidence.

How long does each framework take?

Typical times for a startup that uses Strac Comply, from the day you start.

  • SOC 2

    About 4 months

    To a first Type II report. A Type I takes about 1 to 2 months.

    See the SOC 2 timeline

  • ISO 27001

    About 3 to 6 months

    To a certificate, after a Stage 1 and a Stage 2 audit.

    You are reading this one

  • HIPAA

    About 2 to 4 months

    To a documented Security Rule program. There is no official certification.

    See the HIPAA timeline

  • PCI DSS

    About 4 to 8 weeks

    For a self-assessment (SAQ). A Level 1 assessment by a QSA takes about 4 to 8 months.

    See the PCI DSS timeline

Your ISMS clock starts when your controls work. Start today.

Connect your systems, see your failing tests on day 1, and start building your records now.

Start free trialBook a demo

14-day free trial. No credit card. Plans from $4,995 per year. See pricing · ISO 27001 in Strac Comply