Certification to ISO/IEC 27001 is an independent statement that your information security management system meets the standard. It is awarded by a certification body, not by the consultant who helped you prepare, and not by the standard’s authors. That independence is what gives it value.
Preparation usually moves through a recognisable sequence.
- Scope. Decide what the system covers, and write down why.
- Risk assessment and treatment. Identify risks, decide how to treat them, and record the decisions.
- Control selection. Choose controls, including from Annex A, and record which apply and why in a statement of applicability.
- Documentation. Write the policies and procedures the system needs, no more.
- Operation. Run the controls long enough to generate real records.
- Internal audit and management review. Check yourselves before someone else does.
- Certification audit. In two stages. Stage 1 reviews your documentation, scope and readiness, and the auditor’s understanding of how you work. Stage 2 evaluates whether the system is implemented and operating effectively, through interviews, sampling and examination of evidence.
A certificate is normally issued for a three-year cycle, subject to satisfactory surveillance audits, typically conducted annually. Recertification takes place before the certificate expires. If you are working from an older version of the standard, note that the transition from the 2013 edition to the 2022 edition closed on 31 October 2025, so new certification is to the 2022 edition.
Where readiness is won or lost
Two points decide most outcomes. First, whether controls have been operating before the audit, because an auditor wants to see records over time, not a freshly written procedure. Second, whether the internal audit and management review actually happened and led to action.
How long it takes
There is no honest single answer. It depends on your starting point, your scope, the number of sites, and the time your teams can give. A plan should start with a gap assessment that shows the real distance, and a date comes afterwards.
Choosing a certification body
Check that it is accredited for the standard and scope you need, and ask how it handles surveillance. Cost and availability differ.
An organisation preparing for ISO/IEC 27001 certification had completed its risk assessment, approved its information security policies and documented its applicable Annex A controls. However, during its readiness assessment, it became clear that several controls had not been operating consistently. Access reviews were overdue, security awareness training records were incomplete, and management reviews had not been conducted as planned. Rather than proceeding with certification prematurely, the organisation prioritised closing these operational gaps, assigning control owners and generating evidence of consistent implementation. The difference was not how much documentation it had, but whether the management system worked in practice.
Certification is not the finish line
An organisation can obtain certification and then lose the effectiveness of its system if it stops monitoring risks, reviewing controls and improving. The certificate records a point in time. The habit is what keeps it true.
