How Long ISO 27001 Certification Takes in Australia
Most Australian businesses reach ISO 27001 certification in six to twelve months from a standing start. A small, focused organisation with clean systems and a decisive owner can do it in four to six. A business with a complex environment, scattered documentation or a committee making decisions will take twelve to eighteen. The single biggest variable is not your size. It is how quickly you make decisions, and how early you book your certification body.
Below is a realistic phase by phase breakdown, what drives each phase, and the two parts of the timeline that cannot be shortened no matter what you spend.
What is the realistic ISO 27001 certification timeline in Australia?
ISO 27001 certification runs through seven phases: defining scope, building the information security management system, operating it long enough to produce evidence, running an internal audit and management review, then Stage 1 and Stage 2 audits with a certification body. Phases overlap, so the total elapsed time is less than the sum of the individual ranges.
Two phases in that chart do most of the damage to an optimistic plan. Building the ISMS and writing policies is the one businesses underestimate, because writing a policy is quick and agreeing a policy is not. Operating the ISMS to collect evidence is the one businesses try to skip, and it is the one an auditor will not let you skip.
How long does ISO 27001 certification take by business size?
Size matters less than complexity, but it is a reasonable first estimate. The figures below assume you start with no formal information security management system and you are working with external support.
| Business profile | Typical elapsed time | What usually sets the pace |
|---|---|---|
| Under 20 staff, single office, cloud only | 4 to 6 months | Owner makes decisions directly, scope is small |
| 20 to 100 staff, one or two locations | 6 to 9 months | Policy sign-off and getting evidence from busy teams |
| 100 plus staff, multiple sites or products | 9 to 15 months | Scope definition and coordinating across departments |
| Any size with on-premise legacy systems | Add 2 to 4 months | Technical remediation the gap analysis uncovers |
| Any size already running SOC 2 | Subtract 2 to 3 months | Much of the evidence and control work transfers |
The last row is worth noting if you already hold a SOC 2 report. The two frameworks are not interchangeable, but the overlap in control work is substantial, and a business that has run a Type 2 observation period already understands what operating evidence looks like.
What can you compress, and what can you not?
Businesses often assume that paying for help compresses the whole ISO 27001 timeline proportionally. It does not. Consulting support compresses the parts that depend on expertise and writing. It does nothing to the parts that depend on time passing or on somebody else’s calendar.
The evidence period cannot be compressed
ISO 27001 certification requires that your information security management system is operating, not merely documented. A certification body auditor needs to see records produced by controls running in the real world: access reviews that actually happened, incidents that were logged and closed, risks that were assessed and treated, a management review that took place with the right people in the room.
Most auditors want to see at least two to three months of that running record before Stage 2. You cannot generate it retrospectively, and attempting to is the fastest way to turn a certification audit into a major nonconformity.
Certification body lead time cannot be compressed
Your certification body is an independent organisation with its own audit schedule. In Australia, booking Stage 1 and Stage 2 frequently means waiting weeks, and in busy periods months, for the dates you want. Accredited bodies are listed through the International Accreditation Forum and its member accreditation bodies, and the good ones are busy.
This is the most common avoidable delay in an Australian ISO 27001 project: a business finishes its ISMS, feels ready, then discovers the earliest Stage 2 slot is eleven weeks away. Contact certification bodies while you are still building, not when you think you are finished. Choosing an ISO 27001 certification body in Australia covers what to ask them.
What happens in each phase of an ISO 27001 project?
Knowing what each phase produces makes it easier to see where your own project is likely to stall.
- Scope and gap assessment, 2 to 6 weeks. Define what the ISMS covers and measure where you stand. Getting scope wrong here costs months later. See how to define your ISMS boundary and running an ISO 27001 gap analysis.
- Build the ISMS, 4 to 16 weeks. Risk assessment, risk treatment, policies, and the Statement of Applicability. This phase has the widest range because it depends entirely on how fast your organisation agrees things.
- Operate and collect evidence, 8 to 12 weeks. Run the controls. Log the incidents. Hold the meetings. This is the phase that cannot be shortened.
- Internal audit and management review, 2 to 4 weeks. Both are mandatory before certification. See how to run an ISO 27001 internal audit.
- Stage 1 audit, 1 to 2 days on site. A documentation review. The auditor checks your ISMS exists and is coherent, and raises findings to close before Stage 2.
- Gap to Stage 2, 2 to 8 weeks. Time to close Stage 1 findings, plus the certification body’s availability.
- Stage 2 audit and certificate, 2 to 6 weeks. The full audit, then the certification decision and paperwork. The certificate does not arrive on the last day of the audit. See what to expect at Stage 1 and Stage 2.
What makes an ISO 27001 timeline blow out?
Certification projects rarely fail. They drift. The causes are consistent enough to list.
- Scope indecision. Reopening the scope question in month four resets most of the work that followed it.
- No named owner. A project split across three people who each have a day job moves at the pace of the busiest one.
- Technical debt found late. A gap analysis that surfaces unsupported systems or no central identity management adds remediation work nobody budgeted for.
- Evidence collected too late. Starting the clock on your evidence period after the ISMS is finished, rather than as soon as each control goes live.
- Booking the certification body last. Covered above, and the most common of the lot.
How long does ISO 27001 certification last once you have it?
An ISO 27001 certificate is valid for three years, subject to surveillance audits. Most certification bodies run a surveillance audit annually, in years one and two, then a full recertification audit in year three. A surveillance audit is narrower than the original Stage 2 and typically runs one to two days.
| Year | What happens | Typical effort |
|---|---|---|
| Year 0 | Stage 1 and Stage 2 audits, certificate issued | The full project |
| Year 1 | First surveillance audit | 1 to 2 audit days, plus preparation |
| Year 2 | Second surveillance audit | 1 to 2 audit days, plus preparation |
| Year 3 | Recertification audit, new three-year cycle | Closer to a Stage 2 in scope |
The ongoing commitment is real but modest compared with the first push. What catches businesses out is letting the ISMS go quiet between audits, then rebuilding twelve months of evidence in the fortnight before a surveillance visit. ISO 27001 surveillance audits in Australia covers keeping it ticking over.
Common questions about ISO 27001 timelines
How long does ISO 27001 certification take for a small business?
A small Australian business of under twenty staff, running on cloud services with a single decision maker, can realistically certify in four to six months. The advantages are a narrow scope, few systems and no committee. The constraint is capacity, because the same person usually runs the project alongside their actual job. ISO 27001 for small business in Australia covers what changes at that size.
How long does an ISO 27001 audit take?
Stage 1 is usually one to two days. Stage 2 is typically two to five days for a business of twenty to one hundred staff, and longer for larger or multi-site scopes. Certification bodies calculate audit duration from your headcount and scope complexity using accreditation rules, so the number is not negotiable in the way a consulting quote is. Ask for the audit day calculation in writing when you request a proposal.
How long is ISO 27001 certification valid?
Three years from the certification decision, provided you pass your surveillance audits. If you miss a surveillance audit or fail to close a major nonconformity in time, a certification body can suspend or withdraw the certificate before the three years are up. The certificate is a statement about an ISMS that is still running, not a one-off award.
How long does it take to implement ISO 27001 without a consultant?
Expect to add three to six months, and accept more risk of a nonconformity at Stage 2. Doing it in house is entirely possible, and plenty of Australian businesses have. What external help buys is mostly speed and fewer wrong turns on scope, risk methodology and the Statement of Applicability, which are the three places first-time projects most often go sideways.
Can you get ISO 27001 certified in three months?
Only if you already have an operating security management system and simply have not had it audited. From a genuine standing start, three months does not leave enough evidence for an auditor to conclude that controls are operating effectively. Any provider promising certification in three months from nothing is either describing readiness rather than certification, or setting you up for a nonconformity.
Planning your own ISO 27001 timeline
Work backwards from the date you actually need the certificate. If a customer contract or a tender sets that date, count back nine months and start there rather than hoping six will be enough. If no external date is driving it, nine to twelve months is a comfortable plan that absorbs the usual surprises.
Then do two things in week one that most businesses leave until month six: fix your scope in writing, and start conversations with certification bodies. Those two decisions determine more of your timeline than anything else you will do. The standard itself is available through Standards Australia if you want to read the requirements directly.
Siege Cyber helps Australian businesses plan and deliver ISO 27001 certification, from gap analysis to Stage 2. If you want a realistic timeline for your own scope rather than a generic one, see our ISO 27001 services or get in touch.