What are the steps in the ISO 27001 certification process?

The path to ISO 27001 certification follows a clear sequence of steps that fall into two phases: building and operating the Information Security Management System (ISMS), and then the external certification audit. The standard prescribes the outcome, not every individual project step. In practice, however, a proven sequence has become established that reliably meets the requirements.

The steps at a glance

The two phases of the external audit

The certification audit itself takes place in two stages:

• Stage 1 (documentation review): the certification body checks whether the ISMS is documented and fundamentally ready. It identifies areas that need to be addressed before Stage 2.
• Stage 2 (implementation audit): over several days, on site or remotely, the auditors assess whether the ISMS is effectively lived and whether the controls actually work. On success, the certificate is issued and is valid for three years.

Important note: the ISMS must demonstrably have been operating for several weeks to months before the Stage 2 audit. The internal audit and management review are mandatory prerequisites and must be completed before the external audit.

How Kertos structures and accelerates the process

Kertos guides you step by step through the entire certification process and automates the most demanding parts. Kertos combines an agentic compliance platform (KAIA) with accredited in-house experts who work alongside your team:

• Guided project plan: the platform translates the steps into concrete tasks with ownership and deadlines.
• Automated gap analysis and risk assessment: gaps become visible early, and risks are linked directly to controls.
• Templates and evidence collection: policies, the SoA, and evidence are prepared and continuously mapped.
• Expert-led audit support: Kertos supports the internal audit, the management review, and both Stage 1 and Stage 2.

The outcome is reflected in Kertos's track record: a 100% audit pass rate, roughly 80% less manual compliance effort, and customers like AskUI reaching ISO 27001 certification in just 2.5 months. A complex process becomes a predictable, traceable path.