Audit & Certification Services Pty LtdScope Your Certification

ISO management systems

How long does ISO/IEC 27001 certification take?

The answer depends mostly on one thing: whether your information security management system is already running.

Building a system from nothing usually takes months, because certification needs evidence that the system operates, including at least one internal audit and one management review. Once the system is running, the certification process is much shorter, and much of its timing is in your hands.

What are the steps from quote to certificate?

  1. Scoping and quote. You describe your scope, sites and number of people. We reply with one fixed three-year price within one business day of a complete scoping request.
  2. Application review. We confirm the scope, the audit time and an audit team with the right competence.
  3. Stage 1 audit. Auditors review your scope, risk assessment, Statement of Applicability, internal audit and management review, and confirm you are ready for stage 2.
  4. Time to act on stage 1. Stage 2 is scheduled once you have had time to address any concerns raised at stage 1.
  5. Stage 2 audit. Auditors test whether the system is implemented and effective across your scope.
  6. Audit report. You receive the report within 10 business days of the closing meeting.
  7. Corrective action. Any major nonconformity must be corrected, and the correction verified, before certification can be granted.
  8. Decision and certificate. A person independent of the audit makes the certification decision within 15 business days of nonconformity close-out, and the certificate is issued the same day as a positive decision.

What usually causes delays?

  • The system has not yet completed an internal audit and a management review.
  • The scope is unclear, for example shared services or cloud providers that sit partly outside it.
  • The Statement of Applicability does not match the risk assessment.
  • Controls are described in policy, but few records show that they operate.
  • Major nonconformities at stage 2 take longer than expected to fix.

Is there a limit on how long corrections can take?

Yes. Under ISO/IEC 17021-1, if the certification body cannot verify the correction of major nonconformities within six months of the last day of stage 2, it must carry out another stage 2 audit before certification can be recommended.

How long is the certificate valid?

Three years. A surveillance audit takes place in each of the first two years, and a recertification audit before the certificate expires. We book the dates for the whole cycle when you sign, so your certificate does not lapse while waiting for an audit.

Discuss your proposed scope

Tell us your scope, locations and approximate headcount, and the date you need the certificate by. We will tell you whether that date is realistic and what it depends on.

Related information:

Sources