reconn is a PECB Authorized Titanium Partner

orbit by reconn.Quick answers on ISO 27001 and information security

How do you get ISO 27001 certification, and how long does it take?

The route is the same for every organization. The time it takes is not.

  • By Shenoy
  • Updated

Every great mission starts with reconn.

To get ISO 27001 certification, you build and run an ISMS against the standard, then an accredited certification body audits it. After the first certificate, annual surveillance audits follow, with a re-assessment in the third year. How long it takes depends on your scope and readiness, so no fixed timeline applies to every organization.

Certification is the end of a project, not the start. The work before the audit is where most of the time goes.

The steps

  1. Define the scope and the context of the ISMS: what is covered, who cares and which requirements apply.
  2. Assess information security risks, decide how to treat them and record the controls you apply.
  3. Implement the controls and the documented information the standard requires.
  4. Run an internal audit and a management review, and fix what they find.
  5. Choose an accredited certification body and complete its certification audit.
  6. Keep the ISMS running. Surveillance audits follow each year, and a re-assessment audit normally falls in the third year.

How long it takes

Neither ISO nor PECB publishes a standard duration, and the honest answer is that it varies. ISO's SC 27 journal notes only that the ISMS takes time to mature. Scope, the number of sites, existing controls and management support are what move the timeline, so be wary of anyone who quotes the same number for every company.

Practitioner note: Choose the certification body early. Ask for its accreditation details and its scope rules before you finalize your own scope.

How reconn helps

reconn's ISO 27001 implementation services take you from gap assessment to audit readiness, and your team can build the skills with the PECB ISO 27001 Lead Implementer course. For the internal audit step, the PECB ISO 27001 Lead Auditor course covers how an ISMS audit is planned and run.

Source

Back to blog