If an enterprise customer has asked for ISO 27001, you can realistically get certified in around six months with a focused plan. The first move is to talk to the customer about timing and what they actually need, then scope a tight ISMS, run the risk assessment, implement controls, operate the system to generate evidence, and pass the two-stage audit. Engage a certification body early.
First, do not panic
Being asked for ISO 27001 by an enterprise customer is a good problem. It means a valuable deal is on the table, and the customer wants assurance you take security seriously. It feels urgent, but urgency handled well leads to certification and a stronger business. Handled badly, it leads to rushed, superficial work that fails an audit. The difference is a clear plan.
The realistic timeline for most organisations is around six months. That may be longer than the customer hoped, so the first step is a conversation, not a scramble.
Talk to the customer first
Before committing to anything, talk to the customer about two things: timing and requirements. On timing, find out their actual deadline. Some will accept a credible plan and a target date rather than needing the certificate in hand immediately. Being able to show a serious, structured path to certification often keeps the deal alive while you work toward it.
On requirements, confirm what they actually need. Is it specifically ISO 27001, or would another form of assurance satisfy them? Do they need the full certificate, or would evidence of a genuine, in-progress programme suffice for now? Understanding exactly what unlocks the deal prevents you from over-committing or solving the wrong problem.
Scope a tight ISMS
With the customer conversation done, scope becomes the critical decision. Keep it tight, focused on the product, systems and data relevant to what you deliver to that customer and others like them. A contained scope is what makes six months achievable. Trying to certify the whole business at once is the most common reason these deadline-driven projects slip.
The 6-month plan
A focused plan looks like this:
- Month 1: secure leadership support, appoint an owner, define scope, run a gap analysis, and start engaging a certification body.
- Month 2: run the risk assessment and treatment plan, and produce the Statement of Applicability.
- Month 3: write the required policies and document how each applicable control is implemented.
- Month 4: implement and roll out the controls, and run staff awareness training.
- Month 5: operate the ISMS to generate evidence, then conduct the internal audit.
- Month 6: hold the management review, close corrective actions, and undergo the Stage 1 and Stage 2 certification audits.
This is a demanding but realistic schedule. The two things most likely to derail it are scope creep and leaving the certification body booking too late, both of which the plan guards against.
Keep the customer updated
Throughout, keep the customer informed of progress against the plan. A customer who can see steady movement toward certification is far more likely to stay patient than one left in silence. Milestones like completing the risk assessment, implementing controls and booking the audit are worth communicating, because they demonstrate the seriousness that made them ask for ISO 27001 in the first place.
Get help to hit the deadline
A deadline-driven certification is exactly the situation where experienced help pays for itself. A consultant or virtual CISO who has run ISO 27001 projects to tight timelines knows how to scope sensibly, move quickly through the risk assessment and documentation, and prepare for the audit without the mistakes that cost weeks. When a real deal depends on hitting six months, that expertise is an investment, not a cost.
If an enterprise customer is waiting on your certification, our virtual CISO services can lead the programme to the deadline, and a security risk assessment front-loads the risk work the whole plan depends on.
For the standard, see the official ISO/IEC 27001 page.
Frequently asked questions
How fast can you get ISO 27001 if a customer asks for it?
For most organisations, around six months with a focused plan, a tight scope and good support. It may be longer than the customer hoped, so the first step is a conversation about their actual deadline and whether a credible plan toward certification keeps the deal alive.
What is the first thing to do when a customer asks for ISO 27001?
Talk to the customer about timing and requirements before committing. Find out their real deadline and confirm exactly what they need, whether the full certificate, another form of assurance, or evidence of a genuine in-progress programme. This prevents over-committing or solving the wrong problem.
How do you certify quickly without cutting corners?
Keep the scope tight and focused on what you deliver to that customer, run the project on a disciplined month-by-month plan, engage a certification body early, and bring in experienced help for the risk assessment, documentation and audit preparation. Do not skip requirements, which causes audit failures.
Will the customer wait for certification?
Often, yes, if you show a serious, structured plan and communicate progress. Many enterprise customers accept a credible path and target date rather than needing the certificate immediately, particularly when they can see steady movement toward it.
