How fast can I get ISO 27001 certified?

Your timeline depends on how much of the work you already do, how much needs to change and when a certification body can audit you. A promised certificate date before anyone has looked at your business is a guess.

A small company with working security processes has a different starting point from one still deciding who owns security. Headcount alone will not tell you how long it takes.

Start with a scope you can explain

Define the service, team and systems the certificate needs to cover. Check that this scope matches what your customers are buying. Certifying an unrelated part of the business will not resolve a customer’s concern about your product.

ISO 27001 sets requirements for an information security management system: the way your organisation manages information security risks and improves its approach. Buying software or collecting policy templates does not establish that system. ISO’s overview explains the purpose of the standard.

Build the schedule around dependencies

Before committing to a date, work through the following with the people who will do the work:

Identify the gaps between existing practices and the requirements for your scope.
Assign owners and time for changes, including technical work that competes with product development.
Run the processes and retain evidence that they work.
Complete the internal audit and management review, and address the issues they reveal.
Agree the external audit schedule and allow time to respond to findings.

Initial certification involves a stage 1 assessment of readiness and a stage 2 assessment of implementation. The certification decision follows the assessment process; the last audit meeting is not a guaranteed certificate date. NQA describes that process.

Separate the customer deadline from the audit date

If a customer needs assurance next month, ask what they will accept while certification is in progress. Existing security documentation or a dated remediation plan may help them assess you. They decide whether that is enough; an audit booking does not make you certified.

Avoid promising a universal minimum number of weeks. Ask your chosen certification body what operating evidence it needs and whether its proposed dates are realistic for your readiness.

Make the next step concrete

Write down your intended scope, the customer’s deadline and the controls already operating. Use those facts to agree a readiness plan with named owners. Yrso can organise the checks and evidence, with support from our team where needed. The independent certification body makes the certification decision.