How long does ISO 27001 take for a small UK business?

For a small UK business, getting ISO 27001 usually takes several months from the day you start to the day you hold a certificate. The writing is not what takes the time. The certificate is awarded by an accredited certification body after a two-stage audit, and most bodies want to see your information security management system (ISMS) actually running for a few months first, with real records, an internal audit and a management review, before they do the second stage.

So the honest answer is: the documents can come together quickly, but the clock that matters is how soon you start running the system, and how soon your certification body can fit you in.

Why it takes months, not weeks

Three things set the pace, and only one of them is how fast you write.

1. The audit has two stages. At stage 1, the auditor reviews your documentation: scope, risk assessment, Statement of Applicability (SoA) and policies. At stage 2, they check the system is working: they look at records, talk to your people and sample evidence. Stage 2 follows stage 1, and anything stage 1 raises needs fixing first.
2. The system has to run before stage 2. Many certification bodies like to see the ISMS operating for a few months before stage 2. A policy that says "quarterly access reviews" needs access review records behind it. An internal audit and a management review need to have happened.
3. The certification body has a diary. Bodies book audit days ahead, and the number of days depends mainly on how many people are in your scope. If you ask late, you wait.

What drives the total for your business: how big your scope is, whether someone has time to own the work, how quickly top management makes decisions, and when you book the audit.

The timeline, phase by phase

These phases overlap in practice, but this is the order the work falls into.

1. Scope and risks

Agree why you're doing it and for whom, then set a scope that covers the services and systems your customers care about. A tight, sensible scope is quicker to build and smaller to audit. Then list your information assets, what could go wrong with each, how likely and how bad, and what you'll do about each risk.

2. Statement of Applicability and policies

Go through every Annex A control and record whether it applies, why, and whether it's in place. Write only the policies you need, in words that match what you actually do. Top management approves the information security policy and the risk decisions, so get time in their diaries early.

3. Running the ISMS

This is the phase people underestimate. Training, access reviews, supplier checks, backups and restore tests, incident records: the auditor will sample them at stage 2. Start running the system as soon as the policies are approved, not after.

4. Internal audit and management review

Before the certification audit, audit your own ISMS against the standard and fix what you find. Clause 9.2 needs the internal auditor to be objective and impartial, which in a very small team often means an external person for this one task. Then hold a management review with top management.

5 and 6. Stage 1 and stage 2

Choose a UKAS-accredited certification body and book both stages. Stage 1 reviews the documents; stage 2 tests whether the system works in practice. The certification decision is the certification body's, and nobody can guarantee it.

7. Surveillance and recertification

A certificate lasts three years. There's a surveillance audit in years two and three, then a recertification audit. The ISMS has to keep running between them, so plan for year two from the start.

What speeds it up

• Book the certification body early. Get quotes from two or three UKAS-accredited bodies near the start, and pencil in stage 1 and stage 2 dates. A date in the diary also keeps everyone else moving.
• Name one owner. One person who runs the work week to week, with top management behind them.
• Start from what you already have. Most businesses have some policies, a spreadsheet of risks, or evidence from Cyber Essentials. Reuse it rather than starting again.
• Start from a draft, not a blank page. Writing a risk register and SoA from nothing is where the time goes.
• Start running the system early. The few months the certification body wants to see only start counting once you're actually doing the work.

Where ClearIMS helps with speed

• A step-by-step setup wizard. It shows which step you're on and roughly how many minutes are left, lets you skip optional steps and resumes where you left off. Answer in a form, or chat with the AI. Afterwards, the home page shows one "Next step" card, so it's always clear what to do next.
• Recommended tasks. Got 5 minutes or 5 hours? The Recommended tasks list puts the ISO 27001 work in order, most important first. You work down the list, and every task you finish moves your ISMS forward.
• Import what you already have. Bring in existing policies and evidence from CSV or Excel, with a preview before anything is saved, and import your existing risk register from CSV or Excel too.
• AI drafting, with people approving. On a paid plan, the AI drafts your policies and documents from a plain-English description of your business. A named person reviews and approves every record; the AI never approves anything.
• Optional setup help. If you'd rather have someone alongside you, SW Digital Services offers setup consulting at £500 to £700 a day, quoted per job: for example importing an existing ISMS or spreadsheets, setup sessions with your team, or a gap review before stage 1.

What slows it down

• No named owner. When ISO 27001 is everyone's side job, it becomes nobody's job, and weeks pass between steps.
• Waiting for top management sign-off. The information security policy, the SoA and the management review need top management. If they're hard to reach, everything queues behind them.
• Starting the ISMS late. Polishing documents for months before running anything just pushes back the date stage 2 can happen.
• Booking the certification body late. Even when you're ready, you may wait for audit days. Leaving the booking to the end adds that wait to your timeline.

If you have a tender deadline in weeks

Be honest with yourself and with the buyer: if the tender needs an ISO 27001 certificate in a few weeks and you haven't started, you probably won't have it in time. Stage 2 needs evidence of a system that has been running, and the certification body has to fit you in.

What you can do meanwhile:

• Get Cyber Essentials. It typically takes days to a few weeks, and it's often the minimum for UK public-sector work. It doesn't replace ISO 27001 if the tender asks for ISO 27001, but it shows the basic technical controls are in place. See Cyber Essentials vs ISO 27001 for the difference.
• Have a documented ISMS. An agreed scope, a risk register, a Statement of Applicability and an information security policy approved by top management show the buyer real, checkable progress.
• Book stage 1. A confirmed stage 1 date with a named certification body is a concrete commitment. Say exactly where you are: "working towards ISO 27001, stage 1 booked for [date]". Never say you're certified, or nearly certified, before you are.

Ask the buyer whether they accept "working towards" with evidence. Some do, especially for a contract that runs past your expected certification date.

Frequently asked questions

Can we get ISO 27001 in a month? Very unlikely. The documents might come together that fast, but most certification bodies want to see the system running for a few months before stage 2.

How long is the gap between stage 1 and stage 2? It depends on the certification body and on what stage 1 finds. Ask when you book, and fix any stage 1 findings quickly.

Do we need a consultant to go faster? Not necessarily. A consultant can help with a hard deadline, but the running time before stage 2 still applies. See Can you get ISO 27001 without a consultant?

How long does the certificate last? Three years, with surveillance audits in years two and three, then recertification. For the costs over that cycle, see how much ISO 27001 costs.

How ClearIMS helps

ClearIMS is for businesses that need ISO 27001 but don't want to build a compliance team to get there. It guides you step by step from setup to certification readiness, keeps the system running with owned, dated tasks, internal audits and management reviews, and supports the whole certification cycle: stage 1, stage 2, surveillance and recertification. A named person in your business approves every record; the AI never approves anything.

We make the software. Your certification is yours, awarded by your certification body. The price is £300 a month, monthly with 30 days' notice, with unlimited users and no VAT charged.

Already running ISO 27001 work in spreadsheets? See how to bring it into ClearIMS, or book a 20-minute call.