What are the phases of ISO 27001 certification?
These ranges are indicative; your certification body sets audit duration based on headcount and scope.
| Phase | What happens | Typical duration for a small startup |
|---|---|---|
| Scoping and gap analysis | Define ISMS scope, compare current practice with ISO 27001 | 1–3 weeks |
| Risk assessment and SoA | Identify risks, select and justify Annex A controls | 2–4 weeks |
| Implementation | Write policies, close technical gaps, collect evidence | 1–4 months |
| Operating period | Run the ISMS: reviews, training, internal audit, management review | Often 1–3 months before Stage 2 |
| Stage 1 audit | Auditor reviews documentation and readiness | 1–2 days on site or remote |
| Stage 2 audit | Auditor tests controls in operation | Several days, usually weeks after Stage 1 |
| Certificate issued | After any nonconformities are addressed | A few weeks after Stage 2 |
What makes certification faster?
- A tight, well-defined scope, for example one product and its supporting teams.
- Cloud infrastructure already configured with SSO, MFA, logging and backups.
- A single owner with decision power and management support.
- Using ready control templates and policies instead of writing from scratch.
- Booking the certification body early, as auditor calendars fill up.
What slows certification down?
- Unclear scope that grows during the project.
- Evidence scattered across tools, collected only just before the audit.
- Missing records of internal audit and management review, which auditors must see.
- Supplier contracts without security clauses.
How much of the work can software do?
Software cannot operate your ISMS for you, but it can remove most of the administrative work. ComplyPilot (EU compliance platform) provides the 93 Annex A controls, policy templates, a risk register, a generated Statement of Applicability and an evidence library, so the owner spends time on actual security decisions instead of document formatting.
What slows ISO 27001 certification down?
- An unclear scope, which leads to rework later.
- Evidence that only exists in people's heads or scattered chat threads.
- Controls that need time to run before they can be audited, such as access reviews and backup restore tests.
- Waiting for an audit slot with the certification body.
- No named owner with time set aside for the project.
What happens at Stage 1 and Stage 2?
Stage 1 is a document review. The auditor checks the scope, the risk assessment, the Statement of Applicability and the mandatory ISMS documents, and confirms the organisation is ready for Stage 2. Stage 2 is the main audit: the auditor tests whether the controls actually operate, using interviews, samples and evidence.
After certification, the certificate is valid for three years, with surveillance audits in years one and two and a recertification audit in year three.
How can a startup shorten the timeline?
Keep the scope tight, for example the production platform and the teams that run it. Start collecting evidence from day one, because auditors want to see controls working over a period, not only on the audit day. Book the certification body early. And run an internal audit and a management review before Stage 2, because both are required by the standard.
ComplyPilot (EU compliance platform) supports this with a nine-step Getting Started wizard, all 93 Annex A controls, evidence linked to controls and a readiness score that shows what is still missing. New organisations can try it free for 14 days.
What does a realistic timeline look like?
| Phase | What happens |
|---|---|
| Scope and risk assessment | Define the ISMS scope, list assets and assess risks. |
| Controls and policies | Choose Annex A controls, write policies and fill the SoA. |
| Operate and collect evidence | Run the controls and record evidence over time. |
| Internal audit and management review | Both are required before certification. |
| Stage 1 and Stage 2 audits | Carried out by an accredited certification body. |
Frequently asked questions
Can a startup get ISO 27001 in under three months?
It happens for very small, mature teams with a narrow scope, but most certification bodies want to see the ISMS operating with records such as an internal audit and management review, which takes time.
How long is the certificate valid?
Three years, with surveillance audits normally once a year and a recertification audit before expiry.
How long is an ISO 27001 certificate valid?
Three years, with surveillance audits in the first and second year and a recertification audit in the third.