How Long Does ISO 27001 Certification Take?
Quick answer. We estimate 5 to 12 months from scratch for up to 250 people, longer for multi-site scopes. NQA says strong projects can certify in 2 to 3 months and requires three months of ISMS operation, with internal audit and management review, first.
Video transcript
Starting from scratch, we estimate five to twelve months for ISO 27001 at up to two hundred fifty people. One rule sets the floor.
NQA requires the ISMS to run for at least three months, with an internal audit and management review, before certification.
Our planning estimates scale with headcount. About five to seven months up to twenty five people, eight to twelve up to two hundred fifty, and a year or more beyond that.
First a gap assessment, then the ISMS build, the slow part. Then three months of operation, Stage 1 and Stage 2 audits, and the certificate decision.
Scope drives the effort. Custody, signing and wallet systems each add controls. Covering just the service your bank partner asked about certifies faster.
Stage 1 checks readiness. Stage 2 tests whether controls work in practice. TÜV NORD expects corrective actions within six weeks.
The certificate lasts three years, with yearly surveillance audits and a full recertification before expiry.
You cannot skip the operating period, but you can stop slippage. Book the certification body early, freeze a narrow scope and collect evidence from day one.
Guardian Managed Security runs continuous pentesting and twenty four seven monitoring. Its records can be part of what an auditor samples, though the certification body decides.
Read the full plan, or talk to Guardian about keeping security running between audits.
The Timeline at a Glance
When a bank partner or regulator asks an exchange, custodian or fintech for ISO 27001, the first question is how long it takes.
NQA, an accredited certification body, says well-managed projects with experienced internal resources can certify in 2 to 3 months. It adds that 6 months or more is not uncommon. NQA
Size, headcount, process complexity, locations and existing security maturity drive the difference.
One rule sets the floor. NQA requires the ISMS to have been fully operational for at least three months, with a management review and a full internal audit cycle, before the certification audit.
The week ranges below are our planning estimates for a firm starting without an ISMS. They are built around the certification bodies' fixed steps, and your scope and auditor calendar will move them.
Scopes above 250 people or with several sites should plan a year or more.
| Phase | Up to 25 people | 26 to 100 | 101 to 250 | What sets it |
|---|---|---|---|---|
| Gap assessment | 1 to 2 weeks | 2 to 3 weeks | 3 to 5 weeks | Scope and current maturity |
| ISMS build | 4 to 6 weeks | 6 to 10 weeks | 12 to 18 weeks | Scope, sites, custody and signing systems |
| Operation, internal audit, management review | 13 to 14 weeks | 13 to 16 weeks | 13 to 16 weeks | NQA: three months fully operational |
| Stage 1 to Stage 2 | 2 to 4 weeks | 3 to 5 weeks | 4 to 6 weeks | Stage 1 findings, auditor dates |
| Nonconformities and certificate decision | 2 to 4 weeks | 2 to 5 weeks | 3 to 7 weeks | TÜV NORD: actions reported in 6 weeks; NQA: majors within 6 months |
| Total | About 5 to 7 months | About 6 to 9 months | About 8 to 12 months | Guardian planning estimate |
Gap Assessment and ISMS Build
A gap assessment compares current controls with ISO/IEC 27001:2022, which replaced the 2013 version and was amended in 2024 for climate action. NQA, International Electrotechnical Commission
Its output should be a scoped control list and a risk register, so the build starts from known gaps rather than a blank page.
The build is the slow part. You fix the scope, run a risk assessment, write the Statement of Applicability and put controls in place.
Scope drives the effort. Custody, signing services, wallet infrastructure and critical vendors each add controls that need owners and evidence.
Keep the first scope tight. A defensible scope that covers the service your bank partner asked about is faster to certify than the whole group.
Firms that already run SOC 2 can reuse much of their control evidence. Our SOC 2 vs ISO 27001 comparison explains where the two overlap.
Internal Audit and Management Review
This phase is the one you cannot shortcut. The ISMS must operate long enough to produce records that an auditor can sample.
For ISO 27001, NQA will not certify until internal audits and management reviews are implemented, effective and maintained. NQA
Plan the internal audit for weeks eight to eleven of operation. That leaves time to fix what it finds and to hold the management review.
Pick an internal auditor who did not build the controls under audit. Small teams often bring in an outside auditor for this step.
Stage 1 and Stage 2 Audits
Initial certification is two audits by a certification body. NQA says only accredited certification bodies can issue ISO 27001 certificates. NQA, BSI
Stage 1 reviews documentation, scope and readiness. TÜV NORD also checks that internal audits and management review are planned and performed. TÜV NORD CERT
Stage 1 findings must be fixed before Stage 2. If readiness cannot be shown, TÜV NORD stops the audit after Stage 1.
Stage 2 tests whether controls work in practice. Auditors sample processes, examine records and interview staff over several days.
NQA audits each additional location in scope at Stage 2. TÜV NORD can sample sites in a multi-site certification.
If Stage 2 finds nonconformities, TÜV NORD expects corrective actions and dates within 6 weeks of the last audit day. Otherwise the audit fails.
NQA adds a hard limit. If corrective action on a major nonconformance takes over 6 months, a new Stage 2 is needed.
Someone at the certification body who did not take part in the audit then reviews the file and releases the certificate.
Certificate Validity and Surveillance
An ISO 27001 certificate is normally valid for three years. The certification body keeps checking it through that cycle. NQA, TÜV NORD CERT
Surveillance audits happen every year except a recertification year. TÜV NORD requires the first within 12 months of the certification decision.
Surveillance audits are partial audits. Their length depends on size, complexity, risk, the number of standards and the number of sites.
A full recertification audit must take place before the certificate expires.
TÜV NORD then allows a tolerance of at most 6 months for corrective actions, re-audits and the decision. Plan the recertification audit early.
At each surveillance audit you must demonstrate continual improvement, NQA says. Keep logs and reviews running between audits, because the auditor samples them.
| When | Audit | What it covers |
|---|---|---|
| Initial | Stage 1 and Stage 2 | Full ISMS, initial certificate |
| Within 12 months of decision | First surveillance | Partial audit, continual improvement |
| Next calendar year | Second surveillance | Partial audit, continual improvement |
| Before expiry | Recertification | Full system audit, new three-year cycle |
How to Compress the Timeline Safely
You cannot skip the operating period, but you can stop the calendar from slipping around it.
Book the certification body early, so audit dates are not what holds you up once the ISMS is ready.
Collect evidence from day one of operation. Logs, access reviews and change records should exist before the auditor asks.
Guardian Managed Security runs continuous pentesting and 24/7 monitoring and response, and reviews every deployment, configuration change and multisig transaction. Guardian Security
Records from that work can be part of what an auditor samples. The certification body makes the decision.
- Freeze a narrow scope before the risk assessment starts.
- Name an owner for every control in the Statement of Applicability.
- Start the three-month clock only once the ISMS is fully operational.
- Schedule the management review after the internal audit closes.
Frequently Asked Questions
How long does an ISO 27001 audit take?
TÜV NORD generally holds both audits at your site and uses Stage 1 to collect headcount, locations and scope for planning Stage 2. Ask the certification body for its audit-day proposal before you set dates. TÜV NORD CERT
How long is ISO 27001 certification valid?
Three years, if surveillance audits pass and you report business changes. NQA says failing to tell it about changes such as new locations, activities or headcount can reduce your scope or lead to suspension or withdrawal of the certificate. NQA, TÜV NORD CERT
Does a certificate from a US certification body count in the UK or EU?
NQA says certificates from bodies accredited abroad, for example by ANSI in the USA, are recognised through the mutual recognition framework UKAS belongs to. It advises checking the accreditation body is an IAF member. Acceptance is the bank or regulator's call. NQA
Related reading
- SOC 2 vs ISO 27001 for Digital Asset Firms
- Blockchain Security Standards: CCSS, SOC 2, ISO 27001, NIST
- SOC 2 for Crypto Companies: What It Covers and Misses
- How Long Does a Pentest Take? Timelines by Test Type
Sources
- NQA: ISO 27001 for Information Security | Get Certified
- NQA: How To Get Certified | NQA Certification Process
- TÜV NORD CERT: Description of the certification procedure: ISO 27001 ISMS
- BSI: ISO 27001 - Information Security Management
- International Electrotechnical Commission: ISO/IEC 27001:2022/AMD1:2024 Climate action changes
- Guardian Security: Managed Digital Asset Security Services
Keep Security Running Between Audits
Guardian Managed Security pairs continuous pentesting and 24/7 monitoring with a hosted trust center, so your security work keeps running between audits.