How long does ISO 27001 take? A phase-by-phase plan for small businesses
For a company of 20 to 100 people, implementing ISO/IEC 27001:2022 and reaching the certification audit usually takes 4 to 9 months. The NexoDocs kit reference plan reaches certification stage 2 in week 30 (about 7 months): 2 weeks of preparation, 2 of context and scope, 6 of risk work, about 8 of control implementation, about 12 of operation with evidence (partly overlapping with implementation), and the internal audit and management review before stage 1. What stretches the project most is not writing documents but people's availability and the time controls need to run before they can be audited.
The 8 phases and how long they take
These are the phases of the project plan with a Gantt chart in the NexoDocs ISO 27001 toolkit (ISMS-PRJ-01). The weeks are a reference for a company of 20 to 100 people and adjust when you enter the start date:
| Phase | What happens | Plan weeks |
|---|---|---|
| 1 · Preparation | Gap self-assessment, business case and sponsorship, appoint the ISMS manager and committee | 1-2 |
| 2 · Context and scope | Context (including climate change from the 2024 amendment), interested parties, scope and process map | 3-4 |
| 3 · Policy and objectives | Approve the information security policy and objectives | 5 |
| 4 · Risks | Asset inventory, methodology, risk assessment workshops, treatment plan and Statement of Applicability | 5-10 |
| 5 · Implementation | Annex A policies, priority technical controls, suppliers and cloud, awareness, document control | 10-17 |
| 6 · Operation and measurement | Run the controls, record evidence and incidents, measure indicators and hold committee meetings | 14-25 |
| 7 · Internal audit | Full internal audit, corrective actions and management review | 24-27 |
| 8 · Certification | Contract an accredited certification body (from week 20), stage 1 and stage 2 audits | 20-30 |
Phases 5 and 6 overlap on purpose: each control starts producing evidence as soon as it is in place, instead of waiting for all of them. That is why the plan is not a simple sum of sequential phases.
Why it cannot be squeezed into a few weeks
Documents can be ready in a few weeks, especially when you start from templates. What cannot be rushed as much is what the auditor wants to see working:
- Operating records: evidence that controls are applied (access reviews, tested backups, logged incidents), not just approved policies.
- Monitoring and measurement (clause 9.1): indicators measured for at least a few cycles.
- A complete internal audit (9.2) and management review (9.3), with corrective actions under way, before the certification audit.
- Awareness (7.3) reaching everyone in scope, not only the IT team.
- The certification body's calendar, which is best booked weeks in advance.
ISO 27001 ISMS documentation toolkit
84 files to document your ISMS based on ISO/IEC 27001:2022.
See the ISO 27001 documentation toolkitWhat makes the project longer or shorter
| Factor | Effect on the timeline |
|---|---|
| Wide scope (several sites, many systems or services) | Extends risk work, implementation and audits |
| Time the ISMS manager can dedicate | With less than one day a week, the plan stretches by several months |
| Real sponsorship from top management | Without it, approvals, budget and process changes stall |
| Missing technical controls (MFA, tested backups, logging) | Usually the longest stretch of implementation |
| Another ISO management system already in place | Shortens clauses 4 to 10 (documents, internal audit, management review) |
| Starting from templates with worked examples | Shortens the writing; it does not replace operation or evidence |
How to estimate your own timeline
- Run a gap analysis: the percentage by clause and by Annex A theme shows how much work there really is.
- Agree the scope with top management: it is the decision that changes the timeline most.
- Enter the start date in the plan and adjust task durations where the gap analysis came out red.
- Reserve the operation-with-evidence stretch and the internal audit from day one: they are what is most often underestimated.
- Review progress every two weeks and move dates based on data, not optimism.
Template: the project plan in the ISO 27001 toolkit
The NexoDocs ISO 27001 toolkit includes the ISMS-PRJ-01 project plan: a macro-free Excel file with the 23 tasks of the 8 phases already loaded, a suggested owner, start week and duration, a Gantt chart that recalculates from the start date, the status of each task (late, in progress, done) and weighted overall progress. The first task is the gap self-assessment in the same kit, and each task names the kit document it uses. If you want to see the format first, you can download the free internal audit checklist sample.
Next step
Try it free or go straight to the complete solution.
ISO 27001 ISMS documentation toolkit
84 files to document your ISMS based on ISO/IEC 27001:2022.
See the ISO 27001 documentation toolkit
Free sample
Download a reduced version of the toolkit's risk matrix for free (Excel, 10 scenarios, heat map). See how it calculates risk level and category before you decide.
Get the free sampleFrequently asked questions
Can you get ISO 27001 certified in 3 months?
It is unusual. With a very narrow scope, technical controls already running and high internal commitment it may come close, but the certification audit needs evidence of operation and a completed internal audit and management review.
How long between stage 1 and stage 2?
The certification body decides. In practice it is usually a few weeks, to fix what stage 1 finds; the reference plan allows two.
How many internal hours does it take?
It depends on the scope. As a reference, the ISMS manager needs a significant part of their week during the project, and process owners and IT take part in workshops and in implementing controls.
Does the 2022 edition change the timeline?
Not fundamentally. The 2022 edition reorganized Annex A into 93 controls and added some new ones, which usually need extra technical work for organizations coming from the 2013 edition.
Does a template kit ensure you finish on time?
No. A kit shortens the writing and organizes the work, but the timeline depends on scope, internal time and how long controls need to produce evidence.
Related guides
ISO 27001 gap analysis: how to find out how far your ISMS is from the standard
How to run an ISO/IEC 27001:2022 gap analysis: the requirements of clauses 4 to 10, the 93 Annex A controls, how to score them and what to do next.
Read the guide →How much does ISO 27001 cost? Toolkit, consultant or software
Real costs to implement and certify ISO 27001 in a small business: audit, consultant, compliance software or a template toolkit, compared in one table.
Read the guide →ISO 27001:2022 mandatory documents and records: checklist by clause
Checklist of the documents and records ISO/IEC 27001:2022 requires, clause by clause, which Annex A documents apply and common audit gaps.
Read the guide →Updated: 2026-10-29