Insights · Field note · Security assurance and compliance
ISO/IEC 27001 readiness in twelve weeks: what is realistic
Twelve weeks is enough to be ready for a certification audit under specific conditions. Without them it is a timeline for disappointment.
Twelve weeks to ISO/IEC 27001 readiness is realistic for an organization with a defined scope, a committed sponsor, an internal owner with time, existing controls that largely operate, and a willingness to write documents to actual practice rather than to an ideal. In that time the scope, context, policy, risk assessment, Statement of Applicability, procedures and evidence can be produced, the internal audit and management review completed, and the certification body scheduled. It is not realistic for an organization that must first implement the controls, that cannot free an owner, or that wants the documents to describe a program it does not run.
In detail
What the evidence shows.
What the standard requires
ISO/IEC 27001:2022 requires a management system: scope and context, leadership and policy, risk assessment and treatment with a Statement of Applicability against the Annex A controls, support and competence, operation, performance evaluation including internal audit and management review, and improvement. Certification bodies audit the system in two stages and then on a three-year cycle with surveillance.
What twelve weeks can contain
Weeks one to three: scope, context, policy, roles, risk method and the risk assessment. Weeks four to seven: risk treatment, Statement of Applicability, procedures written to practice, control gaps closed where feasible. Weeks eight to ten: evidence collection, supplier register, training records, operating the system. Weeks eleven and twelve: internal audit, management review, corrective actions, certification scheduling. The sequence assumes the controls mostly exist.
What stretches it
Controls that must be implemented, not documented. A scope that includes systems nobody owns. A sponsor who delegates and disappears. Documents imported from a template and never adapted, which the auditor recognizes immediately. Evidence that does not exist because the controls have not operated long enough to produce it.
How to decide
A gap assessment in the first week answers whether twelve weeks is a plan or a wish. See ISO/IEC 27001 readiness, the readiness checklist and ISO/IEC 27001 versus SOC 2.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days