ISO 27001 in 6 months is achievable for most small and mid-sized organisations that have management support, a dedicated project owner and a sensibly scoped information security management system. The 26 weeks break down into foundation, risk assessment, building the ISMS, implementation, operating it to gather evidence, and the certification audit. Book your certification body early.
Can you really get ISO 27001 in 6 months?
Yes, for many organisations, but only with honesty about what the timeline assumes. Six months works when three things are true. Someone owns the project and can give it real time each week. Leadership genuinely backs it, because ISO 27001 touches every part of the business. And the scope is sensible rather than sprawling, covering the systems and information that matter without trying to include everything at once.
Where those conditions are missing, the timeline stretches. A part-time owner with no authority, a scope that keeps growing, or an organisation that treats certification as a paperwork exercise will all push six months into nine or twelve. The plan below is realistic, not optimistic, and it assumes you start booking your external certification body early, because audit slots often need weeks of lead time.
A quick note on the standard itself. This timeline is built for ISO/IEC 27001:2022, the current version, which sets out the requirements for an information security management system, or ISMS, and lists the controls you select from in Annex A.
Month 1 (Weeks 1 to 4): Foundation and scope
The first month is about direction, not documents. Getting this right saves months later.
- Weeks 1 to 2: Secure leadership sponsorship and appoint a project owner with the authority to make decisions. Define the scope of your ISMS, the boundaries of what you are certifying, including which locations, systems and information are in and out. Agree the business reasons for pursuing certification, since these shape every later decision.
- Weeks 3 to 4: Run a gap analysis against ISO 27001 to see where you already meet the requirements and where you do not. This becomes your project plan. Start engaging certification bodies now to understand availability and lead times, so the audit at the end is not delayed by scheduling.
By the end of month one you should know exactly what you are certifying, where the gaps are, and roughly who is auditing you.
Month 2 (Weeks 5 to 8): Risk assessment and treatment
Risk is the engine of ISO 27001. The standard does not tell you which controls to apply. It tells you to assess your risks and treat them, and to justify your choices.
- Weeks 5 to 6: Agree a risk assessment methodology, so risks are scored consistently. Build or confirm an inventory of your information assets, since you cannot assess what you have not identified.
- Weeks 7 to 8: Carry out the risk assessment, identifying threats to your information and rating them. Then create a risk treatment plan that decides how each significant risk is handled. From this, produce your Statement of Applicability, the document that lists which Annex A controls you are applying and why, and justifies any you have excluded.
A structured security risk assessment at this stage does a lot of the heavy lifting, because the assessment output feeds directly into the treatment plan and the Statement of Applicability.
Month 3 (Weeks 9 to 13): Build the ISMS
With risks understood, month three is about writing the policies and procedures that define how you manage information security.
- Weeks 9 to 10: Draft the core mandatory documents, including your information security policy, and the procedures the standard requires around the ISMS itself.
- Weeks 11 to 13: Work through the controls in your Statement of Applicability, documenting how each one is implemented. These span the four control themes in the 2022 standard: organisational, people, physical and technological. Keep documents practical and aligned to how the business actually works, because policies no one follows will fail an audit and, more importantly, will not protect you.
Resist the temptation to copy a generic policy pack. Auditors and attackers both find the gap between what is written and what is done.
Month 4 (Weeks 14 to 17): Implement and roll out
Documentation describes your controls. Month four is about making them real across the organisation.
- Weeks 14 to 15: Put the controls into practice, closing the gaps the earlier analysis found. This might mean tightening access control, improving logging, formalising supplier management or hardening systems, depending on your risks.
- Weeks 16 to 17: Roll out awareness training so staff understand their responsibilities. ISO 27001 depends on people following the ISMS, and training is both a requirement and a genuine control. This is the month where security stops being a document and becomes how the organisation behaves.
Month 5 (Weeks 18 to 21): Operate and gather evidence
An auditor needs to see the ISMS working, not just written down. That means letting it run and collecting evidence.
- Weeks 18 to 19: Operate the ISMS, generating the records that prove your controls are active, from access reviews to logs to supplier checks. Certification requires evidence that controls have operated over a period, so this operating window matters.
- Weeks 20 to 21: Conduct an internal audit, a mandatory requirement, to check the ISMS against the standard and find issues before the external auditor does. Log any nonconformities and begin corrective action.
The internal audit is your dress rehearsal. Every problem you find here is one the certification auditor does not.
Month 6 (Weeks 22 to 26): Management review and certification audit
The final month brings everything together and takes you through certification.
- Weeks 22 to 23: Hold a management review, another mandatory requirement, where leadership formally reviews the ISMS, its performance and its risks. Complete any corrective actions from the internal audit.
- Weeks 24 to 26: Undergo the certification audit, which happens in two stages. Stage 1 is a review of your documentation and readiness. Stage 2 is the main audit, where the auditor tests whether your ISMS is genuinely implemented and effective. Address any findings, and on success you achieve certification.
Because Stage 1 and Stage 2 are usually separated by a few weeks, and because auditors book up in advance, the early engagement from month one is what makes finishing inside six months possible.
What can slow you down
Being honest about the risks to the timeline helps you protect it. The common causes of delay are a scope that keeps expanding, a project owner without the time or authority to drive it, weak management engagement, controls that need significant technical work, and certification body availability. None of these is unusual, and all of them are manageable if you plan for them from week one.
How to keep to the timeline
Sustaining six months comes down to momentum. Keep the scope fixed once agreed. Protect the project owner’s time. Make decisions quickly rather than perfectly. And bring in experienced help where it saves weeks, particularly around the risk assessment, the Statement of Applicability and audit preparation, which are where inexperienced teams lose the most time.
If you want experienced hands guiding the programme, our virtual CISO services can lead an ISO 27001 implementation end to end, and a security risk assessment gives you the risk foundation the whole ISMS is built on.
For the requirements themselves, refer to the official ISO/IEC 27001 standard.
Frequently asked questions
How long does ISO 27001 take?
For most small and mid-sized organisations, ISO 27001 takes around six months with a dedicated owner, management support and a sensible scope. Larger or more complex organisations often take nine to twelve months. The certification audit stages and internal audit evidence period set a practical minimum.
Can you get ISO 27001 in 6 months?
Yes, six months is realistic for many organisations that keep scope focused, give the project genuine time and leadership backing, and engage a certification body early. It becomes difficult when scope expands, the owner lacks authority, or significant technical control work is needed, all of which push the timeline out.
What is the hardest part of ISO 27001?
The risk assessment and Statement of Applicability tend to be hardest, because they require you to assess your risks properly and justify every control decision, rather than copying a template. The internal audit and management review also catch out teams that treated certification as a documentation exercise.
Do you need a consultant for ISO 27001?
You can achieve ISO 27001 without a consultant, but experienced help usually saves time and reduces risk, especially around the risk assessment, Statement of Applicability and audit preparation. A virtual CISO or advisor can lead the programme, keep it on schedule, and prevent the common mistakes that stretch six months into twelve.
