Audit-ready in 8 to 12 weeks for a single entity with up to 50 people in scope and a named owner giving about four hours a week. Larger or multi-entity scopes typically take 12 to 24 weeks to audit-ready. The certification body then sets its own Stage 1 and Stage 2 dates.
What audit-ready means
Audit-ready means your information security management system is running and you can show it. The scope is defined, the risks are assessed and treated, the Statement of Applicability is written, the policies are in use, and the internal audit and management review have both been carried out. Those two steps are requirements of the standard (clauses 9.2 and 9.3), and certification bodies expect to see them before they audit.
It does not mean certified. An accredited certification body decides that, after its own Stage 1 and Stage 2 audits. Goldline gets you ready for the audit and does not certify.
What the 8 to 12 weeks assumes
The range is a typical duration for a defined scope, not a guarantee. It assumes:
- a single legal entity;
- up to 50 people in scope, on one site or cloud hosted;
- a named owner inside your company who gives about four hours a week;
- decisions made within days, not weeks.
If those four hold, the fixed-fee ISO 27001 Sprint is built for it. The fee is on the pricing page (£7,000 fixed, plus VAT) and covers the same scope.
What moves you to 12 to 24 weeks
Larger or multi-entity scopes typically take 12 to 24 weeks. Five things move a project from the first range to the second:
- Starting position. A company with nothing written down has more to build than one whose informal controls already work.
- Internal capacity. Work that sits inside someone's day job takes longer than work a named person owns.
- Scope. More processes, more systems, more in-house software development, and more suppliers all add evidence to collect.
- Legal entities. Each entity carries its own evidence, so entities add together and do not share.
- Deadline pressure and overlays. A customer deadline, or a second regime such as DEFCON 658, can compress the plan or add work.
The audit time itself follows the number of people doing work inside the boundary, not the number on the payroll, as set out in ISO/IEC 27006. A narrow scope helps, but the standard still requires the interfaces with everything outside it to be addressed, and certification bodies challenge scopes that carve out most of the business.
For the fees that go with each range, read what ISO 27001 costs.
What happens after audit-ready
The certification body sets its own Stage 1 and Stage 2 dates, and the gap between them is not in anyone else's control. For that reason, on the Sprint we request quotations and Stage 1 and Stage 2 dates from three UKAS-accredited certification bodies in week 1, so you know your audit dates early. Ask for the earliest available dates from each, and check each body's accreditation on the UKAS register before you sign.
How to test any timeline you are quoted
Ask four questions of any firm, including us:
- What scope does the number assume: how many people, how many entities, how many sites?
- How many hours a week does it expect from your team?
- What counts as finished: audit-ready, Stage 1 passed, or a certificate in hand?
- Is the number a typical duration or a commitment, and what happens to the fee if the scope turns out larger?
A shorter number is not wrong. A number that cannot answer the first three is a guess.
To see where you stand before you ask, take the free ISMS maturity self-assessment.
Frequently asked questions
How long does ISO 27001 take for a small company?
Audit-ready in 8 to 12 weeks for a single entity with up to 50 people in scope and a named owner giving about four hours a week. That is a typical duration, not a guarantee.
How long does it take for a larger company?
Larger or multi-entity scopes typically take 12 to 24 weeks to audit-ready. The certification body then sets its own Stage 1 and Stage 2 dates.
What does audit-ready mean?
The management system is running and evidenced, the internal audit and management review have been done, and the certification body can audit it. It does not mean certified.
Who decides the audit dates?
The certification body. We request quotations and dates from three UKAS-accredited bodies in week 1 so you know them early.
Can a consultant certify us?
No. Certification is decided by an accredited certification body, not by the consultant who prepared you. Goldline gets you ready for the audit. The internal audit is carried out by an independent internal auditor appointed by Goldline, never by the team that built your system. In week 1 we request quotations and Stage 1 and Stage 2 dates from three UKAS-accredited certification bodies, so you know your audit dates early. The body sets its own dates.