Compliance › ISO 27001 › Certification process
ISO 27001 certification processISO 27001 certification process: the steps, the two audits and what happens after
You know you need ISO 27001. This guide walks the whole route in order: building the management system, choosing a certification body, the Stage 1 and Stage 2 audits, how findings are handled and how the three-year certificate is kept alive.
Free for buyers · provider-funded introductions · Updated October 2026
How does ISO 27001 certification work?
ISO 27001 certification has two halves. First you build and run an information security management system (ISMS): set the scope, assess risk, choose and implement controls, train people, run an internal audit and hold a management review. Then an accredited certification body audits it in two stages, Stage 1 on documentation and readiness and Stage 2 on implementation and effectiveness, and issues a certificate valid for three years, subject to annual surveillance audits.
- The standard sets the requirements. It does not set a timetable, so any fixed duration you read online is an estimate.
- Only an accredited certification body can issue the certificate. ISO itself does not.
- The certificate is not the finish line. Surveillance audits and recertification keep it valid.
The ISO 27001 certification process in 10 steps
You lead the build. The certification body leads the audits. Both sides keep it going afterwards.
Steps 1 to 6: build the ISMS
This is the part you own. Most of the effort sits here, not in the audit.
Get leadership commitment and name an owner
Clause 5 expects top management to lead: approve the information security policy, assign roles and provide resources. Name one project owner so every question has an answer.
Define the scope
Clause 4 asks you to understand your context and set the ISMS scope: which services, sites, systems and people are in. A narrow, honest scope is easier to audit than a broad one you cannot evidence.
Assess and treat risk
Clause 6 requires a repeatable risk assessment and a risk treatment plan. The results decide which controls you choose, so this step shapes everything after it.
Select controls and write the Statement of Applicability
Compare your risks with the 93 Annex A controls. Record which apply and why in the Statement of Applicability, then implement the ones you select. Excluding a control needs a recorded reason.
Put policies, training and records in place
Clause 7 covers competence, awareness and documented information. Staff must know the policy and their role, and you must keep records that prove it.
Run an internal audit and a management review
Clause 9 requires both. The internal audit tests your own ISMS against the standard and the management review has top management examine how it is performing. Certification bodies generally expect both to have happened before the certification audit.
The clause numbers are a map, not a checklist. For what each clause demands, read our ISO 27001 requirements guide. For the shape of the standard now, see the ISO 27001 hub.
Steps 7 to 9: the certification audit
The certification body leads. Your job is to show evidence, not to present it perfectly.
Choose a certification body and apply
Pick a body accredited for ISO/IEC 27001 and agree scope and the audit plan in writing. Check accreditation in the accreditation body directory, such as ANAB in the US. Under accreditation rules a certification body should not also consult on the ISMS it certifies, so ask how yours handles that.
Stage 1 audit: documentation and readiness
The auditor reviews your scope, documented information and readiness for Stage 2. They may raise areas of concern or nonconformities. Fix what is raised before Stage 2.
Stage 2 audit: implementation and effectiveness
The auditor tests whether controls work in practice, through interviews, observation and records, against clauses 4 to 10 and the Annex A controls in your Statement of Applicability. Findings are graded and dealt with before the certificate is issued.
Stage 1 vs Stage 2: what each audit checks
The two audits answer different questions. Knowing which is which removes most of the fear.
| Question | Stage 1 | Stage 2 |
|---|---|---|
| Purpose | Checks the design of your ISMS and your readiness | Checks the ISMS is implemented and effective |
| What is reviewed | Scope, policies, documented information, risk and Statement of Applicability work | Clauses 4 to 10 and the Annex A controls in your Statement of Applicability, in operation |
| How evidence is gathered | Mostly document review and walkthroughs | Interviews, observation and sampling of records |
| What can come out | Areas of concern or nonconformities to fix | Graded findings: major, minor and opportunities for improvement |
| Certificate issued | No | After findings are dealt with |
| Where it happens | Varies by certification body, on site or remote | Varies by certification body, on site or remote |
| Gap between the audits | Agreed with your certification body | Agreed with your certification body |
Stage descriptions follow common practitioner explanations, such as the Cloud Security Alliance overview. Certification bodies differ on detail, so ask yours for its audit plan.
What happens when the auditor finds a problem
Audits rarely finish with nothing to fix. What matters is how findings are graded and closed.
| Finding | What it means | What usually happens |
|---|---|---|
| Major nonconformity | Affects the ability of the ISMS to achieve its intended results, for example a required clause not met, or several minor ones that point to a systemic failure | A corrective action plan and evidence of correction before the certificate is issued |
| Minor nonconformity | A gap that does not affect the ability of the ISMS to achieve its intended results | A corrective action plan is agreed. The fix is checked, often at the next surveillance audit |
| Opportunity for improvement | Not a failure. The auditor suggests a way to improve | No required action, but record that you considered it |
| Area of concern, often raised at Stage 1 | Evidence is thin and it may become a nonconformity at Stage 2 | Address it before Stage 2 |
Terms and deadlines differ by certification body. Ask for its rules on raising and closing findings before you sign, because they decide how a bad day affects your date.
After the certificate: surveillance and recertification
The certificate lasts three years, but only if the audits in between go well.
- Surveillance audits happen annually in the two years after certification. They look at part of the ISMS rather than all of it, and check that earlier findings were closed.
- Recertification happens before the certificate expires and covers the whole ISMS again.
- In between, you keep running the ISMS: internal audits, management reviews and corrective actions are ongoing, not one-off.
What auditors ask to see, clause by clause
The standard names the records it expects you to keep. These are the ones auditors most often ask for first.
| Clause | Record | Typical form |
|---|---|---|
| 4.3 | The scope of the ISMS | Scope statement |
| 5.2 | Information security policy | Approved policy |
| 6.1.2 and 8.2 | Risk assessment process and results | Risk register |
| 6.1.3 | Risk treatment plan and Statement of Applicability | Plan and SoA with reasons |
| 6.2 | Information security objectives | Objectives with owners |
| 7.2 | Evidence of competence | Training and awareness records |
| 9.1 | Monitoring and measurement results | Metrics and reports |
| 9.2 | Internal audit programme and results | Audit reports |
| 9.3 | Results of management reviews | Minutes and decisions |
| 10.2 | Nonconformities and corrective actions | Corrective action log |
Clause references are to ISO/IEC 27001:2022, summarised on the ISO standard page. Read the standard itself for the exact wording.
How long does ISO 27001 certification take?
There is no fixed duration. Published estimates run from a few months to more than a year, and none of them comes from the standard.
| Factor | Shortens it | Lengthens it |
|---|---|---|
| Scope | Narrow and clearly bounded | Many sites, services or legal entities |
| Existing maturity | Policies, owned risks and kept evidence already exist | Starting from nothing |
| Capacity | A named owner with real time | A part-time owner competing with other work |
| Findings | Few, closed quickly | Major nonconformities that need a plan |
| Auditor availability | Stage 1 and Stage 2 booked early | Late booking, long gaps between audits |
When you apply, ask the certification body for its Stage 1 and Stage 2 availability. A date you cannot book is the most common hidden delay.
Who does what in the process
Four parties are involved. Mixing up their roles is how people buy the wrong thing.
| Role | What they do | What they do not do |
|---|---|---|
| You | Build and run the ISMS, own the risks, keep the records | Certify yourself |
| Consultant | Help with design, gap review, training and audit preparation | Issue the certificate, or under accreditation rules certify an ISMS they helped build |
| Compliance platform | Track tasks and collect evidence | Issue a certificate. No tool does |
| Certification body | Audit, grade findings, issue the certificate, run surveillance audits | Build the ISMS for you |
| Accreditation body | Accredit certification bodies | Audit your organisation |
Picking the certification body and any consultant is its own decision. Our guide to choosing one is on the way. Meanwhile, see the ISO 27001 consultants page.
Six ways the certification process goes wrong
- A scope too broad: you cannot evidence what you cannot control. Start with what customers actually ask about.
- A Statement of Applicability that does not match reality: auditors test what it says. Claiming a control you do not run creates a finding.
- Skipping or rushing the internal audit: it is the cheapest place to find problems and the standard requires it.
- No management review record: leaders who did review the ISMS still need minutes to prove it.
- Treating Stage 1 as paperwork: Stage 1 findings carry into Stage 2. Fix them in the gap.
- Forgetting year two and three: surveillance audits and recertification arrive on a schedule. Plan the owner, the evidence and the budget.
ISO 27001 certification process: common questions
What are the steps in the ISO 27001 certification process?
What is the difference between Stage 1 and Stage 2?
How long does ISO 27001 certification take?
What happens if I fail the Stage 2 audit?
What is a nonconformity?
Who issues the ISO 27001 certificate?
How long is the certificate valid?
What is a surveillance audit?
What is recertification?
Do I need a consultant to get certified?
Can I run the internal audit myself?
What does ISO 27001 certification cost?
Know the process? Now get matched with the right provider.
Free for buyers · provider-funded introductions · Reviewed October 2026 by the ZCyberSecurity compliance team