How long does it take to achieve ISO 27001 certification?

There is no fixed duration for ISO 27001 certification. Realistically, the path from project kickoff to an issued certificate takes between 3 and 12 months. Smaller organizations with a clear scope often achieve it in under 6 months, while larger or more complex companies tend to need 9 to 12 months. The actual timeline depends on a few key factors.

Factors that influence the timeline

A typical timeline

The road to certification can be broadly divided into the following phases:

• Preparation and gap analysis (approx. 2 to 6 weeks): defining the scope, taking stock of the current state, and comparing it against the standard's requirements.
• Building the ISMS and risk assessment (approx. 1 to 4 months): creating policies, treating risks, and producing the Statement of Applicability (SoA).
• Implementing the controls (approx. 1 to 3 months): putting the relevant Annex A controls into day-to-day operation.
• Operating phase and evidence collection (at least several weeks): the ISMS must demonstrably be running, including an internal audit and a management review before the external audit.
• Certification audit (Stage 1 and Stage 2, a few weeks apart): once the Stage 2 audit is passed, the certificate is issued.

Important note: auditors generally expect the ISMS to have been effectively operating for several weeks to months before the Stage 2 audit takes place. An internal audit and a management review must demonstrably have been carried out before the external audit. This requirement is often the real bottleneck for the overall timeline.

How Kertos accelerates certification

Kertos shortens the time to certification by automating the slow steps and supporting them with accredited expertise. Kertos combines an agentic compliance platform (KAIA) with in-house experts who work alongside your team:

• Faster gap analysis and scope definition: the platform identifies gaps early and prioritizes the next steps.
• Templates and automated evidence collection: policies, risk assessments, and the SoA are partly pre-prepared and continuously linked to evidence.
• Guided implementation: clear ownership and deadlines keep the project on track.
• Expert-led audit preparation: Kertos supports internal audits, the management review, and both Stage 1 and Stage 2.

The outcome is reflected in Kertos's track record: a 100% audit pass rate, roughly 80% less manual compliance effort, and customers like AskUI reaching ISO 27001 certification in just 2.5 months. With the right support, what is often a year-long project becomes a predictable process of a few months.