ISO 27001 certification process: from Stage 1 to your certificate

The customer contract says "ISO 27001 certified by Q3". You have a policy set, a risk register and a calendar invite from a certification body, and no clear picture of what happens between now and the certificate.

This guide walks through the ISO 27001 certification process step by step, for founders and compliance leads at UK firms with 25–250 staff. It covers choosing a certification body, the Stage 1 and Stage 2 audits, how findings are graded and closed, and what the three-year cycle asks of you afterwards.

The process is more predictable than its reputation. Every stage has a defined purpose, and almost every surprise is visible in advance.

How does the ISO 27001 certification process work?

The ISO 27001 certification process is a two-stage external audit run by an independent certification body.

• Stage 1 reviews your documented ISMS and readiness.
• Stage 2 tests whether the ISMS operates in practice.

If no major nonconformity remains open, the body issues a certificate valid for three years, with surveillance audits in between.

ISO writes the standard but never certifies anyone. Certification bodies do the auditing. The rules they follow come from ISO/IEC 17021-1, the general standard for bodies that certify management systems. ISO/IEC 27006-1:2024 adds the rules specific to information security.

Those scheme rules are why the process looks broadly the same whichever reputable body you choose. The sequence below is the shape almost every UK certification follows:

How do you choose a certification body for ISO 27001?

Choose a certification body accredited for ISO 27001 by UKAS, the UK's national accreditation body, or by an equivalent body recognised internationally. Accreditation means the auditor's competence and impartiality are themselves checked. Then compare audit days, auditor experience in your sector, scheduling and how the body handles remote auditing.

Outside the UK, look for a national accreditation body that has signed the Global Accreditation Cooperation's Multilateral Recognition Arrangement. That arrangement replaced the International Accreditation Forum's own on 1 January 2026, and accreditations issued under the old arrangement are still recognised. Examples you may meet as a UK firm include:

• ANAB in the United States
• DAkkS in Germany
• COFRAC in France
• INAB in Ireland
• RvA in the Netherlands
• JAS-ANZ in Australia and New Zealand

Accreditation from any signatory is recognised as equivalent under the arrangement. That matters when your preferred certification body is based overseas, or when a buyer abroad asks who accredited your certificate.

The difference between certification and accreditation trips up many first-time buyers. UKAS describes the relationship simply: certification bodies are the checkers, and UKAS checks the checkers. Only the certification body is "accredited". Your organisation holds certification, and when the body is accredited for ISO 27001, you hold accredited certification.

That distinction matters commercially. Enterprise procurement teams and public-sector buyers often specify accredited certification, and they verify it.

A certificate nobody can verify is a claim, not evidence.

Buyers can check a UK certificate on UKAS CertCheck, a free public database for verifying UKAS-accredited management system certification. Internationally, IAF CertSearch, set up by the former International Accreditation Forum, lets anyone search by company name or certificate number to confirm that a certificate is valid and issued under accreditation. Run your shortlisted bodies through the same check before you sign.

Once you have a shortlist of accredited bodies, these questions separate them:

• Audit days. How many days will Stage 1, Stage 2 and each surveillance audit take for your headcount and scope? Audit time is set by scheme rules, so a quote far below the others deserves a question.
• Auditor fit. Has the lead auditor worked with cloud-native or software businesses at your scale?
• Remote auditing. Which activities can run remotely, and which need someone on site?
• Scheduling. How far ahead are auditors booked, and how quickly can a major nonconformity be re-verified?
• Transfer terms. What happens if you need to move to another body mid-cycle?

Cost is a fair comparison point too, but it follows audit days more than anything else. Our ISO 27001 certification cost guide breaks down what drives the fee.

What happens at the ISO 27001 Stage 1 audit?

The ISO 27001 Stage 1 audit is a readiness review, mostly of documented information. The auditor confirms your scope, reads the risk assessment, Statement of Applicability and core policies, and checks that an internal audit and management review have taken place. Serious gaps are recorded as areas of concern and can delay Stage 2.

Stage 1 is where the auditor learns what your ISMS claims to be. Expect a review of:

• the ISMS scope statement, and whether it matches the services you sell;
• the information security policy and objectives;
• the risk assessment method, the latest risk assessment and the risk treatment plan;
• the Statement of Applicability, with a justification for every included and excluded Annex A control;
• the records of at least one internal audit and one management review;
• the evidence that documents are controlled, approved and current.

Our list of ISO 27001 mandatory documents sets out exactly what the standard requires you to hold.

Stage 1 does not formally raise nonconformities. A gap that would grade as a major at Stage 2, such as a missing risk assessment, is logged as an area of concern instead. Enough of them, or one serious enough, and the body will not schedule Stage 2 until they are resolved.

Stage 1 isn't a rehearsal. It's the auditor deciding whether Stage 2 is worth scheduling.

The gap between the stages exists so that you can close what Stage 1 found. Treat the Stage 1 report as a precise work list, and plan the interval so there is time to act on it. How long that interval is depends on the body and on what was found.

What happens at the ISO 27001 Stage 2 audit?

The ISO 27001 Stage 2 audit is the main certification audit. The auditor tests whether the ISMS you documented at Stage 1 operates in practice: sampling records, interviewing control owners and observing how work is done. Findings are graded as major nonconformities, minor nonconformities or opportunities for improvement.

Stage 2 moves from what your documents say to what your organisation does. Auditors gather evidence in three ways:

• Interviews. Leaders, control owners and staff explain how a process runs. The auditor listens for whether the answer matches the written procedure.
• Record sampling. The auditor picks real items from a population, such as a handful of joiners and leavers, a set of changes or an incident, and traces each one through its records.
• Observation. The auditor watches practice where it can be seen, from how a screen is locked to how a production change is approved.

At a firm of 25–250 people, the samples are small. A handful of joiners or two incidents is a visible fraction of the whole, so one missing record stands out.

An auditor can't sample a control that only exists in a policy.

The questions follow a simple pattern. First the auditor asks what you do, then how you do it, then for the evidence that you did it.

Typical questions sound like these:

• "Walk me through how a new risk gets onto the register and who decides what to do about it."
• "Show me the last three people who left, and when their access was removed."
• "How do staff report a security event, and what happened to the last one reported?"

Short, honest answers backed by a record beat long explanations. Auditors aren't trying to catch you out. They need enough evidence to support their recommendation.

The phrase "ISO 27001 audit" covers two different things, and both appear in the certification process. The Stage 2 audit is an external certification audit run by the certification body. Your ISO 27001 internal audit is a Clause 9.2 requirement you run yourself, and the external auditor will sample its programme and results.

At the closing meeting, the auditor presents the findings and a recommendation. The certification body then makes the certification decision, based on the audit report and your response to any findings.

How are nonconformities handled in an ISO 27001 audit?

Nonconformities are graded by severity. A major nonconformity is a missing or broken requirement that means the ISMS cannot be relied on, and it blocks certification until it is closed and verified. A minor nonconformity is an isolated lapse, accepted with a corrective action plan. Opportunities for improvement carry no obligation.

The grades come from scheme rules, not auditor style, so reputable bodies apply them in much the same way. Auditors still differ at the margins, most often on record-keeping findings.

Minors are graded one by one but read together. Several minors against the same requirement, or the same kind of failure across different controls, can be rolled up into a major, because the pattern shows the system is failing rather than an individual.

Closing a finding takes three steps:

1. Correction. Fix the specific instance the auditor found.
2. Root cause analysis. Establish why it happened, past "human error" to the process that allowed it.
3. Corrective action. Change the process so the failure cannot recur, and check for the same weakness elsewhere.

Auditors reject closures that fix the instance without addressing the cause. A major typically has to be closed with evidence within a window the certification body sets, often around 90 days, sometimes with a follow-up visit. The discipline is the same one ISO 27001 asks of you every day under Clause 10.2 nonconformity and corrective action.

What happens after ISO 27001 certification?

After certification, the certificate is valid for three years. The certification body returns for surveillance audits in years two and three, which sample the ISMS and always cover incidents, corrective actions, internal audit and management review. Before the certificate expires, a recertification audit reassesses the whole system and starts a new three-year cycle.

Surveillance audits are shorter than Stage 2, but they use the same grading scale. A major nonconformity found at surveillance can lead to suspension of a certificate you already hold, and an unresolved minor from a previous visit is itself graded up.

The areas a surveillance auditor always looks at are the ones that prove the system is alive:

• the internal audit programme and what it found since the last visit;
• the minutes and outputs of your management review;
• how incidents were handled and what was learned;
• whether corrective actions from earlier findings were completed and verified;
• changes to the business, the scope or the technology estate.

Scope changes need attention between audits. If you add a service, acquire a company or move to a new platform, tell the certification body before the next visit, because the certificate only covers what its scope says.

A certificate is a three-year commitment, not a one-day pass.

Some firms run the ISMS as part of daily work, with evidence produced by the tools they already use. For them, surveillance becomes routine. Firms that rebuild their evidence each spring find every visit feels like Stage 2 again.

How long does the ISO 27001 certification process take?

For a firm that already operates its ISMS, the external certification process typically takes two to four months from booking Stage 1 to receiving the certificate. The larger variable is readiness before Stage 1: building and running the ISMS long enough to produce records usually takes a further three to nine months.

The audit stages themselves are short. The time goes on the weeks between them and on the readiness work before them. The table below shows typical durations by starting point.

Booking matters more than most firms expect. Certification bodies schedule auditors weeks or months ahead, so contact them as soon as the ISMS is running, not when it is finished.

If you don't yet know which row describes you, an ISO 27001 gap analysis will tell you. Our ISO 27001 implementation roadmap then shows how to sequence the readiness work so the audit stages follow without a rush.

Frequently asked questions