ISO 27001 Certification Timeline, Cost Drivers and What Auditors Check

TL;DR: ISO 27001 certification usually takes 3 to 6 months from audit readiness to certificate, after an information security management system (ISMS) has run for at least three months. Vanta gives a wider range of 3 to 12 months. Cost depends on scope, sites, staff time and remediation more than on the standard's 155 Swiss franc price. Stage 1 auditors review documents and readiness. Stage 2 auditors test whether the ISMS works as documented.

What ISO 27001 certification is and the key facts for 2026

ISO/IEC 27001 certification is an outside confirmation that your information security management system (ISMS) meets ISO/IEC 27001:2022. The standard, published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), defines requirements an ISMS must meet. You do not certify yourself. An accredited certification body audits the ISMS, and a pass brings a certificate that holds for three years.

Accreditation matters here. ISO notes that a certificate from an accredited body adds confidence because an accreditation body has provided independent confirmation of the certification body's competence. A certificate that names the year is the first thing to check on a supplier's paperwork.

The key facts for 2026

There is no new ISO 27001:2026 edition. The 2022 edition was published on October 25, 2022, and it remains the version auditors certify against.

In our reading, its practical effect is that auditors now expect the context and interested-parties work in Clauses 4.1 and 4.2 to say whether climate change is relevant to the ISMS.

The transition date has passed. Accredited ISO 27001:2013 certifications were required to expire or be withdrawn at its end. A supplier still showing a 2013 certificate is showing a document that should no longer be valid.

Reading the certificate count

The jump in the survey count needs care. The prior survey reported 47,291 certificates, but ISO changed its survey method and used aggregated IAF CertSearch data instead of voluntary submissions. In our reading, the rise says more about wider reporting than about a doubling of certified organizations, so we would not quote it to a board as a growth trend.

One point for scoping: not every Annex A control is mandatory. The certifiable requirements sit in Clauses 4 through 10, and Annex A serves as a reference set that the risk assessment draws on. A newer overview document, ISO 27000:2026, was published on July 3, 2026 and does not replace ISO 27001.

How long does ISO 27001 certification take

The timeline has three phases: build the system, pass the two audit stages, then keep the certificate alive. The first phase is the one you control, and it sets the date for everything after it.

Phase 1: build and run the ISMS

Before an auditor arrives, your information security management system (ISMS) has to exist and produce records. Elevate notes that most certification bodies want at least one full management review cycle and one internal audit before Stage 2. It also says the ISMS must have operated for at least three months before Stage 2. ISOQAR advises booking Stage 1 only once you have that evidence to show.

In our reading, the three months of operation is the part leaders most often underestimate. The clock starts when controls run and leave records, not when policies are approved.

Phase 2: the Stage 1 and Stage 2 audits

Elevate puts the full process at 3 to 6 months from audit readiness to certificate issuance. Vanta gives a wider range of 3 to 12 months for the initial certification audit, depending on ISMS maturity, documentation quality and readiness.

Two limits shape the schedule. ISOQAR says the two stages should sit no more than six months apart, or Stage 1 may have to be repeated. Elevate says your team will be in audit meetings for a full week during Stage 2, so protect those calendars early.

A major nonconformity at Stage 2 adds time. ISOQAR says these must be fixed before the auditor can recommend certification, which may mean a further site visit.

Phase 3: surveillance and recertification

Issuance starts the cycle the earlier section described. Surveillance audits come each year, with recertification every 3 years. Vanta describes surveillance as covering select areas of the ISMS, while recertification reassesses it from scratch.

A practical step: put both surveillance dates and the recertification window on the security calendar the week the certificate arrives. If you are new in the seat, fold them into your first 90 days plan.

What auditors check in Stage 1 and Stage 2

Both stages test one idea. ISOQAR describes every audit as verifying that the organization is doing what its documented management system says and that it complies with the standard (ISOQAR). Stage 1 asks whether the design is ready. Stage 2 asks whether it works.

Stage 1: documents and readiness

Certification bodies also call Stage 1 the Document Review, Document Audit or Readiness Review (ISOQAR). The auditor reads the information security management system (ISMS) scope statement, the security policy, the risk assessment method and results, the risk treatment plan and the security objectives. Version control and approval dates get checked too (Elevate).

The Statement of Applicability (SoA) draws close attention. The auditor checks that the chosen controls match the risk assessment and that each exclusion is justified for your context, not with generic wording (Elevate).

Stage 1 is also planning work. Its objectives include walking the site, confirming that statutory and regulatory requirements are documented, and setting Stage 2 scope, dates and sites (ISOQAR). It does not produce nonconformities, but it can issue Improvement Requests (ISOQAR). The result is one of three: proceed, proceed with observations, or delay (Elevate).

Stage 2: implementation and effect

Stage 2 moves from paper to practice. Auditors interview management, IT staff, process owners and users (Elevate).

Multi-site organizations do not get every site visited. Bodies accredited by the United Kingdom Accreditation Service (UKAS) use a square root rule: with 25 sites in scope, at least five are audited at the initial audit (ISOQAR).

In our reading, the gap between document and practice is where most findings come from. Vanta lists documentation that specifies a process the organization is not following as a nonconformity risk (Vanta). Each finding describes the issue, gives evidence and cites the clause not met (Vanta). The criteria for major and minor sit in ISO/IEC 17021-1 (Vanta).

What changed in Annex A in the 2022 revision

In our reading, the 2022 revision reorganized the reference control list more than it raised the bar. Annex A now holds 93 controls across four themes, compared with 114 controls across 14 groups in the 2013 edition. The 2013 transition period ended on October 31, 2025, so any certificate issued or renewed now uses the 2022 control set.

Where the 21 missing controls went

The smaller count comes from consolidation, not deletion. According to Secureframe, 57 older controls were merged into 24, and 58 remain mostly unchanged. Bright Defense gives the same split: 11 new controls, 24 formed through mergers and 58 updated.

The 11 new controls cover threat intelligence, cloud services, ICT continuity, physical monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding. ICT stands for information and communications technology.

These controls usually need new operating evidence, not just a rewritten policy. For data leakage prevention (DLP), evidence may include DLP policies, email or endpoint rules, cloud DLP settings, alert records, and incident tickets. For cloud services, it may include cloud security policies, shared-responsibility records, supplier terms, configuration standards, and offboarding procedures.

How ISO/IEC 27002:2022 fits in

ISO 27001 says what an information security management system must contain. Its companion, ISO/IEC 27002, is the reference guide that provides implementation guidance for the controls listed in Annex A. Both are published jointly by the International Organization for Standardization and the International Electrotechnical Commission. The guidance edition came first: it was released earlier on February 15, 2022.

ISO is explicit that ISO/IEC 27002 provides best practice recommendations and cannot be certified to. Auditors certify against 27001, but 27002 is where a team finds the working detail for each control.

The 2022 guidance also tags each control with attributes: control type, information security property, cybersecurity concept, operational capability, and security domain. In our reading, these tags are the practical payoff for a security leader. They let a team sort the 93 controls by function, for example pulling every detective control, and map them to other frameworks the organization already reports against.

Annex A itself works as a reference control set. A sensible first step is to have the control owner for each of the 11 new controls read the matching 27002 guidance. They can then list what evidence already exists before the internal audit.

Which costs vary most

The purchase price of the standards is the only line in an ISO 27001 budget that is printed on a price tag. Almost everything else depends on decisions the organization makes about scope, sites and readiness. In our reading, the fixed lines are small and the variable lines are where budgets go wrong.

The fixed lines

ISO lists ISO/IEC 27001:2022 at CHF155, in Swiss francs. The guidance standard, ISO/IEC 27002:2022, is listed at CHF227. The 2024 amendment, Amendment 1: Climate action changes, is listed at CHF0. These figures stay the same whether a company has one office or many.

The variable lines

Vendor guides describe the overall spend as a price tag that's hard to pin down. The table below separates the lines that move from the ones that do not.

Where the swing comes from

In our reading, scope drives most of the other lines. A tighter boundary means fewer sites, fewer audit days, fewer control owners and fewer gaps to close. Vanta's guide notes that you only need to implement the security controls relevant to your business. In our reading, this is why the risk assessment and the Statement of Applicability shape remediation spend more than the size of Annex A does.

In our reading, Internal staff time is the line most often left out of a budget. It does not appear on an invoice, but it sits with policy owners, engineers producing evidence, and the managers who attend audit interviews. We think finance teams should track it as hours from the start.

The cost also recurs. A certificate holds for three years, so audit days and staff time return across the cycle. For that reason, set the budget for the full certification cycle rather than for the first audit alone.

A practical check before signing with a certification body: ask how it calculates audit days for your scope and site list. Ask too what changes the quote if scope grows mid-cycle.

How certification bodies and accreditation fit together

A certificate on a supplier's trust page comes from a certification body, not from ISO. ISO does not perform certification or issue certificates. The organization chooses its own certification body. That body must be independent, with no prior involvement in building the information security management system (ISMS).

Accreditation sits one layer above. An accreditation body assesses the certification body. A certificate from an accredited body carries independent confirmation of the certification body's competence. In the United States that oversight role belongs to the ANSI National Accreditation Board, and in the United Kingdom to the United Kingdom Accreditation Service.

Accreditation after the 2026 merger

The international tier changed this year. Global ACI began full operations on January 1, 2026 and took over the international accreditation-cooperation role. Since then, accredited certification has sat within the Global ACI mutual recognition system. In our reading, this matters most to buyers with suppliers in several countries, because recognition now runs through one system.

Certification bodies also had their own deadline. The ISO 27006-1:2024 transition for accreditation bodies and certification bodies ended on March 31, 2026.

What to check on a certificate

A certificate that still cites the 2013 edition deserves a question. After the transition deadline covered earlier in this guide, accredited ISO 27001:2013 certifications were required to expire or be withdrawn.

Using public certificate databases

Central databases now carry much of the record. On that basis, the ISO Survey 2024 reported 96,709 valid ISO 27001 certificates covering 179,877 sites.

A practical routine for vendor reviews:

1. Search the certificate number in the issuing body's own register.
2. Search the supplier name in a central database such as IAF CertSearch.
3. Compare the scope and sites listed there with the scope printed on the certificate.
4. If the certificate does not appear, ask the supplier for the accreditation reference before you draw conclusions.

We think a missing listing is a reason to ask, not proof of a problem. Records can lag, and some bodies publish more detail than others. In our reading, the scope comparison is the step that most often surfaces a gap between what a supplier sells and what was audited.

How to keep the certificate after the first audit

Certification starts a cycle rather than closing a project. ISOQAR describes keeping the certificate as a series of connected audits and reviews that check the information security management system (ISMS) stays compliant. Every one of those audits verifies that the organization actually does what its documented system says.

Surveillance and recertification

The cadence, scope and purpose in the table come from Vanta's audit overview.

Surveillance samples the system. It does not cover all of it. Internal audit has a matching rhythm: Vanta says the program only needs to ensure all ISMS controls are reviewed over time, typically within the three-year certification cycle. In our reading, the areas the external auditor skipped this year are a sensible place to point next year's internal audit.

Minor findings do not stay minor forever. Vanta lists unresolved minor nonconformities, and an accumulation of minor nonconformities about one process, among its examples of major ones. The practical step is to close each minor finding with evidence before the next visit.

Clause 6.3: change on purpose

Clause 6.3 requires changes to the ISMS to be carried out in a planned manner. Bright Defense applies it to material changes in scope, technology, suppliers, organizational structure, risk treatment and security processes. A planned change, in its account, defines the change, responsibility, timing and dependencies.

Take a mid-cycle move of a core workload to a new cloud provider. Write down the change, the owner, the date and what it depends on before the work starts. We think change records are easy to keep at the time and hard to rebuild when a surveillance auditor asks for them.

The climate amendment

The 2024 amendment, covered earlier, adds climate-related text to Clauses 4.1 and 4.2. In our reading, the simplest response is to record, in the documents that support those clauses, whether climate change is relevant to the ISMS and the reasoning behind that answer.

Certificates from the 2013 edition

The transition gave certified organizations until October 31, 2025 to move to the 2022 edition. As noted in an earlier section, accredited 2013 certificates had to expire or be withdrawn when it ended.

Our reading is that an organization whose 2013 certificate lapsed that way had nothing to carry forward. To hold a certificate again, it needed a full certification audit against the 2022 edition, starting from Stage 1.

Steps a sitting security leader takes before engaging an auditor

Most of the work that decides a first audit happens before a certification body sees anything. In our reading, five steps belong in the plan before a contract is signed.

1. Set scope on purpose

Scope drives effort, cost and audit days, so treat it as a decision and not a default. Sites are one example. Under the multi-site sampling rule, if 25 sites are in scope, at least five should be audited at the initial audit. We think a scope that follows one business line or one product, with clear boundaries to shared services, is easier to evidence than a company-wide scope on day one.

2. Run a gap analysis against Annex A

Map existing controls, whether formalised or informal, against the 93 controls in the 2022 standard. Then turn the result into the Statement of Applicability. Clause 6.1.3 requires the organization to compare its controls with Annex A so necessary controls are not omitted and to record implementation status. Exclusions are allowed, with the statement recording the relevant justification. Write each justification as if an auditor will read it aloud.

3. Name an owner for every applicable control

A control without a named owner tends to produce no evidence. In our reading, ownership should sit with the person who runs the process, such as the head of platform engineering for configuration baselines, and not with the security team by default. Each owner should know what record proves the control operates and where that record lives.

4. Finish an internal audit and a management review first

Stage 1 is meant to come once you have generated evidence of its effectiveness, such as Internal Audits, Management Reviews. The management review should explicitly address any residual gaps identified during the internal audit. Build the calendar backward. The system should normally have been running for at least three months before Stage 2. Some certification bodies offer an optional pre-assessment that helps identify your strengths, weaknesses and gaps before the formal audit.

5. Connect the ISMS to the board and to disclosure

The information security management system (ISMS) produces records a board already needs: risk treatment decisions, management review minutes, and incident logs. For monitoring, evidence may include incident escalation records. We think the escalation path in those records should match the one your incident disclosure process uses.

For US-listed companies, compare it with the steps in our guide to the Securities and Exchange Commission (SEC) cybersecurity disclosure rules and the Regulation S-K Item 106 entry. If the ISMS and the disclosure process describe different owners or thresholds, fix that before an auditor or a regulator finds it.

A practical test: ask one control owner to show the last three months of evidence for their control. If they can do it in minutes, the program is close to ready for Stage 1.

What this guide does not cover

This guide gives no audit-day quotes or total budget figures. It does not map Annex A to other frameworks in detail. For the rules and the record behind it, see SEC Item 1.05 Materiality Decision Guide: Is This Incident Reportable?.