How to get ISO 27001 certified: a step-by-step guide (2026)

Getting ISO 27001 certified looks daunting from the outside, but the path is well-worn and predictable. You build an information security management system (ISMS), operate it, prove it works, and an accredited auditor signs it off. Here is the whole route in nine steps, what each one involves, and where teams tend to get stuck.

Step 1 — Define your scope

Decide which part of the organisation the ISMS covers: which products, teams, locations and systems. Scope is the single biggest driver of both cost and effort, so make it as tight as it can be while still covering what your customers care about. Everything that follows is bounded by this decision.

Step 2 — Get management commitment and assign ownership

ISO 27001 requires visible leadership involvement (Clause 5). Name an ISMS owner, agree who signs off the policy and risk decisions, and secure the budget and time. Certification stalls most often not on technology but on a lack of a clear, accountable owner.

Step 3 — Run a gap analysis

Compare where you are against the standard's requirements and the 93 Annex A controls. This produces your to-do list and a realistic timeline. You can pay a consultant for this, or start with the free readiness check and a structured review inside a platform, then focus spend on the actual gaps rather than on discovering them.

Step 4 — Do the risk assessment and treatment

This is the heart of ISO 27001 (Clause 6.1.2–6.1.3). Identify the risks to your information, assess them, and decide how to treat each one — reduce, accept, transfer or avoid. The output is a risk treatment plan that justifies which controls you will apply. Auditors look hard here: a control without a risk behind it, or a risk with no decision recorded, is a finding.

Step 5 — Produce the Statement of Applicability

The Statement of Applicability (SoA) lists all 93 Annex A controls and, for each, states whether it applies and why (or why it is excluded). It is the document that ties your risk assessment to your controls, and it is one of the first things an auditor asks for. Keep the justifications short, specific and defensible.

Step 6 — Implement controls and write the policies

Put the applicable controls in place and document the policies and procedures the standard expects — access control, cryptography, supplier management, incident response, business continuity, and the rest. The goal is not a shelf of unread documents; it is a set of practices people actually follow, with the paperwork reflecting reality.

Step 7 — Operate the ISMS and collect evidence

Certification is not a snapshot — the auditor needs to see the system working. Run it for a period (commonly two to three months minimum), and collect the evidence that proves the controls operate: access reviews performed, risks reviewed, incidents handled, training completed. This is where a single evidence store beats screenshots scattered across drives and inboxes. (For what all of this costs, see our ISO 27001 certification cost guide.)

Step 8 — Internal audit and management review

Before the external auditor arrives, audit yourself (Clause 9.2) and hold a management review (Clause 9.3). The internal audit finds gaps while you can still fix them cheaply; the management review is leadership formally looking at how the ISMS is performing and deciding on improvements. Both are mandatory, and skipping them is a guaranteed finding.

Step 9 — The certification audit (Stage 1 and Stage 2)

An accredited certification body assesses you in two stages:

• Stage 1 — a review of your documentation and readiness. The auditor checks your ISMS is designed correctly and you are ready for the real thing. Expect a short list of things to tidy.
• Stage 2 — the main event. The auditor tests whether your controls actually operate, interviews people, and samples evidence. Pass, and they recommend you for certification; the certificate follows.

After certification: surveillance and recertification

The certificate runs on a three-year cycle. The certification body returns for a shorter surveillance audit in years one and two to confirm the ISMS is still operating, and you go through recertification in year three. This is why keeping the system live — evidence current, risks reviewed, controls operating — matters far more than a heroic push before each audit.

How long does it take?

For most organisations, three to twelve months from a standing start. The variables are your starting maturity, how much time the ISMS owner can commit, and how clean your scope is. Teams that use software to instantiate the framework and track evidence tend to reach Stage 2 faster than those assembling the ISMS by hand.

Where teams get stuck

• No clear owner — the work drifts without someone accountable.
• Scope too broad — trying to certify everything at once multiplies the effort.
• Documentation that does not match reality — auditors test what you do, not what you wrote.
• Leaving evidence to the last minute — you cannot retro-fit two months of access reviews the week before Stage 2.

Frequently asked questions

How long does ISO 27001 certification take?

Typically three to twelve months, depending on your maturity, the time you can commit, and how tight your scope is. Well-prepared teams using software often reach the Stage 2 audit in a few months.

Do I need a consultant to get ISO 27001 certified?

No — it is not required. Many organisations certify using compliance software plus an internal owner, sometimes with a light-touch consultant review before Stage 2. A consultant can speed things up but is not mandatory.

What is the difference between Stage 1 and Stage 2 audits?

Stage 1 is a readiness and documentation review — the auditor checks your ISMS is designed correctly. Stage 2 tests whether your controls actually operate in practice. You need to pass both to be certified.

What is a Statement of Applicability?

A document listing all 93 Annex A controls and, for each, whether it applies to you and why. It links your risk assessment to your chosen controls and is one of the first things an auditor reviews.

Turn the checklist into tracked work

Obligara instantiates ISO 27001 with its real clauses and all 93 Annex A controls, runs the risk assessment and Statement of Applicability, and keeps your evidence in one place through Stage 2 and every surveillance audit after. See the ISO 27001 module, start with the free readiness check, or book a walkthrough.

This article is general guidance, not certification advice. Your certification body is the authority on what your specific scope and audit require.