ISO 27001
How long does ISO 27001 take?
Short answer
For most SMBs, ISO 27001 certification takes roughly 3 to 9 months from a standing start: a few weeks to months to build the ISMS, run a risk assessment, and implement controls, then the certification body’s Stage 1 and Stage 2 audits. Companies with an existing security program (or a SOC 2) can move faster.
What drives the timeline
The main factors are scope, how much of a security program you already have, the time to run a real risk assessment and implement Annex A controls, the mandatory internal audit and management review, and the certification body’s availability for the two-stage audit.
A typical path
Scoping and the ISMS foundation take a few weeks; risk assessment and control implementation are the bulk of the work; then internal audit and management review; then Stage 1 (documentation review) and Stage 2 (effectiveness audit). Three to nine months is common for SMBs.
How to move faster
Reuse an existing control set (for example, crosswalk from SOC 2), keep the scope tight, and collect evidence continuously. Keel’s crosswalk maps one control set across frameworks so ISO 27001 work builds on what you already have.
FAQ
-
Can I get ISO 27001 certified faster if I already have SOC 2?
- Usually yes. In Keel's open control library, 64% of the controls that map to SOC 2 also map to ISO 27001, so that implementation and evidence carries over. Those shared controls are 38% of what ISO 27001 draws on, so the rest of ISO 27001, including its ISMS clauses, is still new work.
-
Does the certificate last?
- ISO 27001 certificates run on a three-year cycle with annual surveillance audits, so it is an ongoing program rather than a one-time event.
Next step
Get audit-ready with Keel
The AI-native GRC platform for SMBs: one control-and-evidence graph across SOC 2, ISO 27001, HIPAA, PCI DSS, NIST CSF, and more. Start free, no credit card.