How long the road takes and what it costs depends mainly on three things: the scope, the size of your organization and what you already have in place. This guide shows the process, the effort drivers, typical findings and a preparation checklist. The standard is described in our own words, and the example is invented.
Who sets the rules
ISO/IEC 27001 defines what an ISMS must achieve. It does not say how certification works. That is set by the standards for certification bodies: ISO/IEC 17021-1 for management systems in general and ISO/IEC 27006-1 as the ISMS supplement. The usual practice described in this guide follows from them. Your certification body sets the details.
One point matters when you choose: pick a body accredited for ISO/IEC 27001, in Germany by DAkkS, or by the national accreditation body in your country. Customers and supplier assessments generally recognize only accredited certificates.
The process in six stages
- Preparation. You set the scope, policy and risk method, assess risks, write the Statement of Applicability and implement controls. Then you run the ISMS and collect evidence.
- Internal audit and management review. Both must have taken place at least once before the stage 2 audit, in practice already before stage 1.
- Stage 1 audit. The auditor reviews the documentation, gets an overview of sites and processes and checks whether you are ready. The report names points that could lead to nonconformities in stage 2.
- Stage 2 audit. The audit team checks on site whether the ISMS works: interviews at every level, samples, site walks. In practice there are usually a few weeks between stage 1 and stage 2, exactly for follow-up work.
- Certification decision and certificate. After a positive decision you receive the certificate with your scope, valid for three years.
- Surveillance and recertification. In years one and two, surveillance audits check parts of the ISMS. In year three the recertification looks at the whole system again.
A pre-audit is optional. ISO/IEC 27001 does not provide for it. The certification body may only assess you, not advise you: advice on building the ISMS has to come from someone else.
The stages at a glance
| Stage | What is checked | What you provide | Result |
|---|---|---|---|
| Stage 1 audit | Readiness, documentation, scope | Mandatory documents, a short introduction to the company, scope and ISMS | Report with points for stage 2 |
| Stage 2 audit | Implementation and effectiveness | Evidence from operation, interview partners, access to sites | Findings and recommendation for certification |
| Surveillance audit | Selected parts of the ISMS, handling of earlier findings | Current evidence, results of internal audit and management review | Confirmation or findings |
| Recertification | The whole ISMS across the cycle | Evidence from three years of operation | New certificate for three years |
What drives timeline and effort
None of the standards involved gives fixed figures for your project. The drivers are well known, though:
- Scope. It sets what you protect, document and have audited. A clear scope with described interfaces saves time at every stage.
- Size and sites. ISO/IEC 27006-1 gives certification bodies rules for calculating audit days. They depend mainly on the number of people in scope, the sites and the complexity.
- Existing maturity. If backup, access rights, supplier management and contingency planning are already in place, your work is mostly documentation and evidence. If you start from zero, you implement first.
- Existing management systems. With ISO 9001 or ISO 14001 you can reuse document control, the audit process and the management review. A combined audit can save effort.
- Time in operation. The auditor wants to see that the ISMS has actually run for some months. You cannot shorten this time, only use it well.
- Internal capacity. What slows projects down most is rarely the standard, but lack of time among departments and owners.
Compare offers from certification bodies across the whole three-year cycle, not only the initial audit. Request the offer early, because a fixed date gives the project a clear rhythm.
How findings are graded
ISO/IEC 17021-1 sets the grading, in summary:
- Major nonconformity: a requirement is not met, and this affects the ability of the ISMS to achieve its intended results. The certification body must review your correction and corrective actions and confirm them as effective before the decision.
- Minor nonconformity: a requirement is not met, but the ISMS still achieves its results. The body accepts your plan and usually checks the implementation in the next audit.
- Observation or opportunity for improvement: not a nonconformity, a recommendation.
Typical findings
Most nonconformities do not come from missing technology, but from missing evidence and gaps in the cycle:
- Outdated risk assessment: done once, not repeated after changes.
- Statement of Applicability without justification: exclusions or status cannot be traced.
- Incomplete internal audit: not all clauses and applicable controls in the program, or auditors check their own work.
- Patchy management review: inputs missing, decisions and owners not recorded.
- "We already do that" without proof: access reviews, restore tests or training happen, but cannot be shown.
- Service providers not managed: remote maintenance or cloud services in scope, but without assessment and agreements.
- Corrective actions without an effectiveness check: reported as done, but nobody checked whether they worked.
An example from industry
The example is invented. A manufacturer of drive components with two plants needs a certificate for a key customer.
- Start: The gap analysis shows that backup and physical access are well managed. Missing are the risk assessment, the Statement of Applicability and an overview of remote maintenance access in production.
- Scope: Development, manufacturing and sales at both sites, including IT and OT. The rented warehouse stays out, with a documented reason.
- Date: The certification body is engaged early. Stage 1 is scheduled after the first internal audit and the first management review.
- Stage 1: The report names two points, among them missing justifications in the Statement of Applicability. Both are resolved before stage 2.
- Stage 2: On the shop floor the auditor asks to see how a machine supplier accesses the plant. Result: one minor nonconformity on approving remote access, plan accepted, certificate issued.
Preparation checklist
- Reason, goal and budget are approved by management.
- The scope is documented, with interfaces and justified exclusions.
- Policy, risk method, risk register and risk treatment plan are approved.
- The Statement of Applicability justifies every Annex A control.
- Objectives are set and measured.
- At least one internal audit covering the whole ISMS is complete.
- At least one management review has taken place and is recorded.
- Corrective actions from the internal audit are under way.
- Evidence from some months of operation is available.
- An accredited certification body is engaged and the date is fixed.
- An annual calendar for surveillance audits and recurring tasks is in place.
Certification in Complass
A project plan in a spreadsheet, documents on a shared drive and findings in email threads: that turns every audit into a search. In Complass everything sits in one project:
- Guided path: The ISO 27001 module leads you through nine phases from the project brief to preparing the certification audit.
- Gap analysis: You assess today's maturity per measure and move gaps into the action plan as tasks.
- Audit dates: Dates sit in the project plan, and the dashboard shows how many days remain until the audit and whether you are on track.
- Findings: Every finding gets a root cause, corrective actions as tasks and an effectiveness check.
- Invite your auditor: You invite your auditor to an audit free of charge, time-limited, limited to that audit and with every access logged.
Complass does not certify. An accredited certification body does that. Complass prepares you with documents, the Statement of Applicability and evidence.
Frequently asked questions
How long does ISO 27001 certification take?
That depends on scope, size and starting point. As a planning value, our ISO 27001 module gives about 9 to 15 months to certification readiness for a mid-sized industrial company without an existing ISMS. This is a value from experience, not a requirement of the standard.
What does certification cost?
There is no figure that fits everyone. The certification body calculates the audit days under ISO/IEC 27006-1. Your internal effort and any consulting come on top. Compare offers across the whole three-year cycle.
Do we need a pre-audit?
No, it is optional. It can remove uncertainty before the first audit. The certification body only assesses and does not advise.
What happens with a major nonconformity?
Certification is decided only once the certification body has reviewed your correction and corrective actions and confirmed them as effective. Plan time for this.
Does the certificate also cover NIS2?
Not automatically. A certificate applies to the chosen scope, while the BSIG looks at the whole entity. Our guide on ISO 27001 and NIS2 has the details.
In a demo we use the demo company to show you how to get from project brief to an audit-ready ISMS in Complass.
Request a demo Try it for 14 days
Read more
- Guide "Defining the ISMS scope: steps and example"
- Guide "ISO 27001 mandatory documents at a glance"
- Guide "Creating the ISO 27001 Statement of Applicability (SoA), with a template"
- Guide "Preparing an ISO 27001 internal audit"
- Guide "ISO 27001 management review with a template"
- Whitepaper on the road to ISO 27001 certification
- ISO/IEC 27001 in Complass: from project brief to certification audit
Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. Your licensed editions of the standards and the rules of your certification body are authoritative. As of November 2026.