Insights · Question
How long does ISO/IEC 27001 readiness take?
Twelve weeks to be ready for the certification audit is realistic when the scope is defined, a sponsor is committed, an internal owner has time, existing controls largely operate and the organization is willing to write documents to actual practice. In that time the scope, context, policy, risk assessment, Statement of Applicability, procedures and evidence can be produced, the internal audit and management review completed, and the certification body scheduled. It takes longer where controls must first be implemented rather than documented, where the scope includes systems nobody owns, or where evidence does not yet exist because the controls have not operated long enough to produce it.
In more detail
The reasoning.
A gap assessment in the first week answers whether twelve weeks is a plan or a wish. Certification itself follows readiness: the certification body performs stage one and stage two audits on its own schedule, and the certificate runs on a three-year cycle with annual surveillance.
Templates imported and never adapted are recognized by auditors immediately. Documents written to what the organization actually does, with the practice changed where it must be, are what pass.
See ISO/IEC 27001 readiness in twelve weeks: what is realistic, ISO/IEC 27001 readiness and the readiness checklist.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 90 days