Companies often approach ISO 27001 as a mysterious exam that consultants and auditors somehow solve. In reality, certification follows a predictable sequence of steps. Organisations that understand the sequence plan better, avoid delays and spend less. This roadmap walks through the journey from kickoff to certificate, with realistic expectations at each stage.

ISO/IEC 27001:2022 specifies the requirements for an information security management system (ISMS). The management system clauses (4 to 10) must all be met, and the controls of Annex A are selected based on your risk assessment and documented in a Statement of Applicability.

Phase 1: Prepare and decide (weeks 1 to 3)

Secure leadership commitment. ISO 27001 explicitly requires top management involvement: approving policy, assigning roles, providing resources and reviewing performance. Without a committed executive sponsor, projects stall.

Define your reasons. Are you pursuing certification for customer demand, regulatory alignment, tender requirements or competitive positioning? Clear objectives help decide scope and priorities.

Appoint a project lead and core team. Typically an information security manager or CISO as lead, supported by representatives from IT, HR, Legal, operations and the business units in scope.

Choose a certification body early. Accredited certification bodies differ in availability and price. Booking audit windows early avoids waiting.

Phase 2: Define scope and context (weeks 2 to 5)

Understand your organisation's context: internal and external issues, interested parties and their requirements, including legal, regulatory and contractual obligations. Then define the ISMS scope: which locations, business units, services, systems and data are included.

Scope is the most consequential early decision. Too broad and the effort balloons; too narrow and customers may not accept the certificate as meaningful. A pragmatic scope usually covers the services you sell to customers and the supporting infrastructure and people.

Phase 3: Governance foundations (weeks 4 to 8)

  • Information security policy approved by top management.
  • Roles and responsibilities documented, including who owns the ISMS, risks and controls.
  • Objectives that are measurable and linked to business goals.
  • Risk assessment methodology defining how risks are identified, rated and treated, with clear criteria.
  • Document and record control approach.

Phase 4: Risk assessment and treatment (weeks 6 to 12)

Identify assets and information flows within scope. Identify threats and vulnerabilities, assess likelihood and impact, and rate risks using your methodology. Decide treatment for each: reduce, accept, avoid or transfer. Produce a risk treatment plan with owners and timelines.

From this, select applicable Annex A controls and justify inclusions and exclusions in the Statement of Applicability (SoA). Auditors will examine the SoA closely, since it links risks to controls.

Phase 5: Implement controls and processes (weeks 8 to 24)

This is typically the longest phase. Depending on your starting point, it may involve:

  • Access management, including joiner-mover-leaver processes, MFA and periodic access reviews.
  • Asset inventory and classification.
  • Secure configuration, patching and vulnerability management.
  • Logging, monitoring and incident management.
  • Backup and recovery, business continuity.
  • Supplier security management.
  • Secure development and change management.
  • Physical and environmental security.
  • Security awareness and training.
  • Cryptography and key management.

Many of these may exist informally. The task is to formalise, evidence and make them repeatable.

Phase 6: Document and train (ongoing from week 10)

Write only the documentation the standard requires and that your people will use: policies, procedures and records. Avoid copying large template libraries that do not match how you work. Run awareness training for all staff in scope, and role-specific training for administrators, developers and managers.

Phase 7: Operate and gather evidence (weeks 16 to 28)

An ISMS must operate for some time before the certification audit so that there are records to examine: risk assessments, access reviews, incident logs, training records, supplier reviews. Many certification bodies expect that the ISMS has been running with a completed internal audit and management review before Stage 2.

Phase 8: Internal audit and management review (weeks 22 to 30)

Internal audit. An objective, competent person who is independent of the area audited evaluates the ISMS against the standard and your own requirements. Findings lead to corrective actions.

Management review. Top management formally reviews ISMS performance, audit results, risks, incidents, opportunities for improvement and resource needs, with outputs recorded.

These two activities are mandatory, and auditors check them carefully.

Phase 9: Certification audit (weeks 28 to 36)

Stage 1 is a documentation and readiness review: the auditor checks scope, key documents, the SoA, risk methodology and preparedness for Stage 2. Issues identified must be fixed.

Stage 2 is the main audit: the auditor tests whether the ISMS is implemented and effective through interviews, observation and evidence sampling. Findings are graded as major or minor nonconformities, or observations. Major nonconformities must be resolved before certification is issued; minor ones require a corrective action plan.

After successful completion and a certification decision, you receive the certificate, typically valid for three years.

Phase 10: Sustain (every year)

Certification cycles include annual surveillance audits and a recertification audit before the end of the three-year period. The ISMS must continue to run: risk reviews, internal audits, management reviews, corrective actions and continual improvement.

Realistic timelines

A small to mid-sized company with reasonable security hygiene might need six to nine months. Organisations starting from scratch, with broad scope or limited resources, may need longer. Pressure to compress timelines often results in documentation without operation, which auditors detect.

Resource expectations

Budget for internal time as much as for external fees: the project lead, control owners, technical staff for implementation, and executives for governance activities. Costs include consultancy support if used, tools such as vulnerability scanners or logging platforms, training, and certification body fees.

What derails projects

Weak sponsorship, scope that keeps changing, treating the project as an IT-only task, copy-paste documentation, and leaving the internal audit until the last minute. The next posts in this series cover these in detail.

Download the roadmap

F9 Infotech supports organisations through every phase, from scoping and risk assessment to internal audits and certification readiness. Request our ISO 27001 implementation roadmap with phases, deliverables and a sample timeline.

This article is a general overview; certification requirements are defined in ISO/IEC 27001:2022 and by your chosen certification body.