How long from Stage 1 to the ISO 27001 certificate?
About 8 weeks (fast 3 weeks, slow 23 weeks), for 11-50 people with remote audits. A major nonconformity at Stage 2 adds about 2 weeks. The audits take days; the waits take weeks.
Certificate, typical case
26 Apr 2027
8 weeks after the end of Stage 1.
- Fast case
- 23 Mar 2027
- Typical
- 26 Apr 2027
- Slow case
- 11 Aug 2027
Add your deadline. See if this date is in time, and what you can show on the day.
Check these dates against your deadlineSteps to the certificate
Every date as a list
- Fix Stage 1 findings, wait for Stage 21 Mar 2027 – 29 Mar 2027
- Stage 2 audit29 Mar 2027 – 1 Apr 2027
- Answer the audit findings1 Apr 2027 – 15 Apr 2027
- Review and certification decision15 Apr 2027 – 26 Apr 2027
Step by step
| Step | Fast | Typical | Slow |
|---|---|---|---|
| Fix Stage 1 findings, wait for Stage 2 | 14 | 28 | 84 |
| Stage 2 audit (audit days) | 3 | 4 | 6 |
| Answer the audit findings | 3 | 14 | 42 |
| Close a major nonconformity | 14 | 30 | 90 |
| Review and certification decision | 3 | 10 | 30 |
- Gap: the step you control most. Ask for the Stage 2 date when you book Stage 1. Certification bodies cap the gap, often at 6 months: Stage 2 starts no later than 180 days after the last day of Stage 1.
- Findings: One body requires the client to report corrective actions within 6 weeks after the last day of the audit.
- Decision: a person outside the audit team decides. The certificate carries this date, not the Stage 2 date.
A major nonconformity
The body must verify the fix of each major nonconformity within 6 months after the last day of Stage 2. The body runs a new Stage 2 before it can recommend certification.
A finding is major when a requirement is not met at all, or the system's ability to work is in doubt. A missing internal audit or management review before Stage 2 are common examples. While it is open, give the buyer the slow-case date.
Certificate date with and without a major finding
| Case | Minor findings | One major | Delay |
|---|---|---|---|
| Fast | 11 Mar 2027 | 22 Mar 2027 | 11 days |
| Typical | 29 Mar 2027 | 14 Apr 2027 | 16 days |
| Slow | 17 May 2027 | 5 Jul 2027 | 49 days |
Audit days by size
| People | Stage 1 | Stage 2, 27001 | Stage 2, 42001 | Stage 2, both |
|---|---|---|---|---|
| 1-10 | 1 (1-1) | 3 (2-3) | 3 (2-4) | 5 (3-7) |
| 11-50 | 1 (1-2) | 4 (3-6) | 4 (3-6) | 7 (5-12) |
| 51-200 | 2 (1-2) | 7 (5-9) | 6 (4-9) | 12 (7-18) |
| 201+ | 2 (2-3) | 10 (7-14) | 9 (6-12) | 17 (10-26) |
Remote audits need the agreement of both sides. They remove travel costs. They do not make the audit shorter, and bodies publish the same booking times for remote and on-site audits.