Most “ISO 27001 in 90 days” promises fail because certification requires the information security management system to operate long enough to produce evidence, plus a mandatory internal audit, a management review and a two-stage external audit that must be scheduled in advance. In 90 days you can realistically reach audit readiness, not certification.
Where the 90-day claim comes from
The “90 days to ISO 27001” promise is a marketing line, usually attached to a compliance platform or a fast-track service. It is appealing because it answers exactly what a pressured buyer wants to hear: certification, quickly. The problem is that it quietly redefines what certification means, or glosses over the steps that make the timeline what it is.
To be fair, a lot can be achieved in 90 days. The issue is not that the number is useless. It is that it is often presented as certification when it really describes readiness, and the gap between those two things is where the promise breaks.
What 90 days usually skips
ISO 27001 has requirements that take time by design, and a 90-day certification claim typically skips or compresses them past the point of credibility:
- An operating period, because the ISMS must actually run and generate evidence that controls are working, not just exist on paper
- The internal audit, a mandatory requirement that checks the ISMS against the standard before the external auditor sees it
- The management review, where leadership formally reviews the ISMS and its performance
- The two-stage external audit, where Stage 1 reviews documentation and Stage 2 tests implementation, usually separated by weeks
- Certification body scheduling, which often needs weeks of lead time to book
Each of these is a real step with a real duration. Removing them does not speed up certification. It removes the things that make certification meaningful.
What is actually achievable in 90 days
Here is the honest version. In 90 days, a focused organisation with good support can genuinely reach audit readiness. That means the scope is set, the risk assessment is done, the Statement of Applicability is complete, policies are written, controls are implemented, and the ISMS has started operating. That is a lot, and it is the hardest part of the work.
What 90 days does not reliably deliver is the certificate itself, because the ISMS still needs to operate long enough to prove itself, the internal audit and management review need to happen, and the external audit needs to be booked and completed. Reframed honestly, 90 days is a strong target for readiness, and readiness is the milestone that actually depends on you.
The risk of rushing to hit the number
Chasing a 90-day certificate creates real risks. Documentation gets copied rather than tailored, so it describes controls that do not match how the business works. Controls get implemented on paper but not embedded, so they fail under an auditor’s questions. Evidence is thin because the system has not run long enough to produce it. The result is often a failed audit or a certificate that does not reflect genuine security, which is worse than taking the time to do it properly.
An auditor is trained to find the gap between what is written and what is done. Rushing widens that gap. So does treating certification as a paperwork sprint rather than the establishment of a working management system.
A realistic alternative
The better framing is to aim for readiness in around three months and certification in around six. Use the first phase to do the hard preparation quickly and well, then let the ISMS operate, complete the internal audit and management review, and move through the external audit. You still move fast, but you arrive with a system that passes and holds.
If you want an experienced team to hit an ambitious but realistic timeline, our virtual CISO services can lead the implementation, and a security risk assessment front-loads the risk work that the rest of the ISMS depends on.
For the requirements, see the official ISO/IEC 27001 page.
Frequently asked questions
Can you really get ISO 27001 in 90 days?
Usually not the certificate itself. In 90 days a focused organisation can reach audit readiness, with scope set, risk assessed, policies written and controls implemented. But the ISMS still needs to operate to produce evidence, and the internal audit, management review and external audit take additional time.
Why do 90-day ISO 27001 promises fail?
They skip or compress required steps: an operating period to generate evidence, the mandatory internal audit and management review, and the two-stage external audit that must be scheduled in advance. Removing these does not speed up genuine certification, it undermines it.
What can you achieve in 90 days?
Audit readiness, which is the hardest part of the work: a set scope, a completed risk assessment and Statement of Applicability, written policies, implemented controls, and an ISMS that has started operating. Readiness is the milestone that genuinely depends on your effort.
What is a realistic ISO 27001 timeline?
Aim for readiness in around three months and certification in around six. Do the preparation quickly and well, then let the ISMS operate, complete the internal audit and management review, and move through the external audit with a system that passes and holds.
