ISO 27001 Certification: Process, Requirements and Timeline
ISO 27001 certification is the internationally recognised standard for information security management systems. It proves to customers, regulators, and partners that your organisation manages information security systematically, not reactively.
Trusted by 100+ organisations across Europe
Stage 1 & 2 
Accredited body 
3-year cycle 
Surveillance audits What you need to know about iso 27001 certification
- ISO 27001 certification requires a Stage 1 documentation review and Stage 2 operational audit from an accredited certification body.
- The three-year certification cycle includes annual surveillance audits. Missing one suspends your certificate.
- Your Statement of Applicability must justify inclusion or exclusion of all 93 Annex A controls and is the most scrutinised document in any ISO 27001 audit.
- ISO 27001 certification provides direct evidence for NIS2 Article 21 and DORA Article 9 compliance requirements.
- The 2022 update added 11 new controls including threat intelligence, cloud security, and ICT readiness for business continuity.
Sources: ISO/IEC 27001. Last updated May 2026.
What ISO 27001 Certification Actually Involves
ISO 27001 certification is the internationally recognised standard for information security management systems. It proves to customers, regulators, and partners that your organisation manages information security systematically, not reactively. For European companies facing NIS2, DORA, and GDPR, it is no longer a nice-to-have. The certification process involves building, implementing, and evidencing an Information Security Management System (ISMS) that meets the requirements of ISO/IEC 27001:2022.
An accredited certification body then audits your ISMS across two formal stages and issues a certificate valid for three years. Surveillance audits happen annually to confirm you are maintaining, not just claiming, compliance. StartComply was built to close the gap between what ISO 27001 requires and what most compliance teams can actually deliver. If your current approach involves spreadsheets, shared drives, and quarterly manual reviews, this guide is for you. For broader context on the standard itself, read our iso 27001 guide.
Certification is not a one-time audit. It is a programme you build, operate, and continuously improve.
For the full picture, see our ISO 27001 guide and our guide to ISO 27002.
ISO 27001 maps to the regulations that matter in Europe. StartComply links every Annex A control to NIS2 and DORA so one programme covers them all.
How StartComply Keeps You Audit-Ready
Define scope and assess risk Clause 4-6
Define the ISMS boundary and run a repeatable risk assessment that determines which Annex A controls apply.
Implement controls and documents Annex A
Implement controls to treat risk and produce the mandatory documents, each with a policy and operational evidence.
Collect evidence continuously Continuous
Evidence tasks are scheduled per control and reminders fire on review dates, so the audit trail builds itself.
Pass Stage 1 and Stage 2 Certification
Walk into the documentation review and certification audit with genuine evidence ready, not rehearsed answers.
Surveillance and recertification Ongoing
Annual surveillance audits and three-yearly recertification stay easy when evidence is always current.
Iso 27001 Certification: The Essentials
The core of iso 27001 certification, broken down. For related detail, see our guide to ISO 27001 vs SOC 2.
What ISO 27001 Certification Actually Involves
Certification is not a one-time audit. It is a programme you build, operate, and continuously improve.
The ISO 27001 Certification Process Step by Step
Most organisations underestimate the lead time. From the decision to pursue ISO 27001 certification to certificate issuance, expect six to twelve months depending on your starting point, organisational complexity, and internal resource availability.
Choosing the Right Certification Body
Your choice of certification body affects cost, timeline, and the credibility of your certificate. Not all certification bodies carry equal weight across all markets.
How ISO 27001 Certification Supports NIS2 and DORA Compliance
NIS2 Article 21 mandates that essential and important entities implement security measures commensurate with risk. ISO 27001 certification provides a recognised framework for demonstrating this.
Maintaining Certification After the Initial Audit
Getting certified is the easy part. Staying certified is the operational discipline that separates organisations with a functioning ISMS from those that built one for an audit.
Everything Your ISO 27001 Programme Needs. Built Into One Platform.
Annex A Control Mapping
All 93 controls mapped to owners and evidence tasks, with a Statement of Applicability kept current.
Risk Assessment and Treatment
A repeatable risk assessment aligned to ISO 27005, with a risk treatment plan linked to controls.
Continuous Evidence Collection
Scheduled evidence tasks and automated reminders build a timestamped audit trail continuously.
Cross-Framework Mapping
Map ISO 27001 controls to NIS2, DORA, and GDPR so one control produces evidence for several frameworks.
StartComply vs. The Alternatives
Not every approach to ISO 27001 produces the continuous evidence an accredited auditor expects.
StartComply was built for European organisations navigating ISO 27001:2022, NIS2, and DORA.
ISO 27001 Timeline: From 2013 to 2022
ISO 27001:2013 published with 114 controls across 14 domains.
ISO 27001:2022 published. Annex A reorganised into 93 controls across four themes, with 11 new controls.
Transition deadline. Organisations on the 2013 version had to migrate to ISO 27001:2022.
All new certification works to the 2022 standard. NIS2 and DORA enforcement makes a recognised ISMS baseline more valuable than ever.
Still on the 2013 version? Align your Statement of Applicability and Annex A controls to ISO 27001:2022 before your next surveillance audit.
Who Needs ISO 27001?
ISO 27001 applies to organisations of any size. Two groups feel the strongest pull: those facing regulatory pressure and those facing enterprise procurement pressure.
The distinction is narrowing. Even where certification is not mandatory by law, NIS2 and procurement increasingly make it mandatory in practice.
Frequently Asked Questions About Iso 27001 Certification
How long does it take to get ISO 27001 certified?
Most organisations take six to twelve months from decision to certificate, depending on their starting point and internal resources. A mature organisation with existing security controls and documentation can move faster. One starting from scratch will need longer. The biggest variable is how quickly you can complete a gap assessment, build or update your ISMS, run an internal audit, and conduct a management review before engaging a certification body for Stage 1.
How much does ISO 27001 certification cost?
Certification costs vary significantly based on organisational size, scope, and certification body. Expect to budget for certification body fees, internal staff time, any tooling or platform costs, and potentially external consultancy if you lack internal expertise. Certification body fees alone typically range from £5,000 to £30,000 for the initial certification cycle. For a full breakdown, read our iso 27001 certification cost guide.
Does ISO 27001 certification prove NIS2 compliance?
Not automatically, but it covers the majority of NIS2 Article 21 requirements. NIS2 mandates security measures commensurate with risk across access control, incident handling, business continuity, supply chain security, and cryptography. ISO 27001 addresses all of these. The gap between a certified ISO 27001 ISMS and full NIS2 compliance is manageable. The gap between zero and NIS2 compliance is not. ISO 27001 is the most efficient starting point for NIS2 compliance in most organisations.
What is the difference between ISO 27001 certification and compliance?
ISO 27001 compliance means your organisation operates in accordance with the standard’s requirements. ISO 27001 certification means an accredited third-party auditor has independently verified that claim. Compliance without certification is self-declared and carries limited weight with customers or regulators. Certification is the only externally evidenced form of ISO 27001 conformity. Many procurement processes and enterprise contracts require certification specifically, not self-declared compliance.
Can a small company realistically achieve ISO 27001 certification?
Yes. ISO 27001 is scalable. A company of 20 people with a well-defined scope can achieve certification. The standard does not require a large security team or expensive tooling. It requires a functioning ISMS proportionate to the organisation’s risk profile. Smaller companies often have an advantage: their scope is narrower, their decision-making is faster, and their internal audit programme is simpler to run. The challenge is staff bandwidth, not complexity.
What happens if we fail the Stage 2 certification audit?
A failed Stage 2 audit results in nonconformities, either minor or major. Minor nonconformities can usually be resolved with a corrective action plan accepted by the auditor, without requiring a full re-audit. Major nonconformities require evidence of resolution before certification can be issued, often requiring the auditor to return and verify closure. A failed audit is not unusual. It is an opportunity to address genuine gaps before your certificate is issued and your ISMS is under ongoing scrutiny.
ISO 27001 Certification Requires Evidence, Not Paperwork
A documented, evidenced, continuously audited ISMS
- 93 Annex A controls across four themes
- Mandatory documents including the Statement of Applicability
- Two-stage audit by an accredited certification body
- Annual surveillance audits and three-yearly recertification
The 2022 reality: all new certification works to ISO 27001:2022 from day one.
Spreadsheets, shared drives, pre-audit panic
- Evidence scattered, with no continuous monitoring
- Risk assessments out of date by audit time
- Statements of Applicability with unjustified exclusions
- Internal audits that exist on paper but never ran
- Management reviews that were never documented
The audit reality: auditors do not count pages. They check whether the evidence exists.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
