ISO 27001 Certification Process: 12 Steps to a Smooth Audit

The ISO 27001 certification process is the sequence of steps an organization follows, from setting up an information security management system (ISMS) to the point where a certification body issues the certificate. The process continues after the first audit, because the certificate is maintained through annual audits over a three-year cycle.

The transition period for ISO/IEC 27001:2022 ended on October 31, 2025, and IAF MD 26:2022 requires certificates based on the 2013 version to expire or be withdrawn at that point. Every step below follows the 2022 version.

This article covers the 12 steps of the ISO 27001 certification process in 2 phases, including the documents and evidence auditors check. For the definition and benefits of the standard, see our guide to what ISO 27001 is.

Summary of the ISO 27001 Certification Process

The ISO 27001 certification process has 12 steps in 2 phases: 7 internal preparation steps that the organization carries out, then 5 audit steps with a certification body. After the certificate is issued, surveillance audits and recertification keep it valid.

Phase	Step	Main output
Phase 1	1. Management commitment and scope	Management approval and ISMS boundaries
Phase 1	2. Gap analysis	Gap list and improvement roadmap
Phase 1	3. Risk assessment and treatment	Risk register and risk treatment plan
Phase 1	4. Statement of Applicability (SoA) and ISMS documentation	SoA and supporting ISMS documents
Phase 1	5. Control implementation and employee awareness	Working controls with records as evidence
Phase 1	6. Internal audit	Internal audit report
Phase 1	7. Management review	Minutes and management decisions
Phase 2	8. Choosing an accredited certification body	Application and audit quote
Phase 2	9. Stage 1 audit	Stage 1 report and decision to proceed to Stage 2
Phase 2	10. Stage 2 audit	Audit report with findings
Phase 2	11. Closing nonconformities	Action plan and evidence of correction
Phase 2	12. Certification decision and certificate issue	ISO 27001 certificate valid for 3 years
After issue	Surveillance audits and recertification	Certificate stays valid

Phase 1: Internal Preparation Steps

Internal preparation has 7 steps: management commitment and scope, gap analysis, risk assessment and treatment, the Statement of Applicability (SoA) and documentation, control implementation with employee awareness, an internal audit, and a management review. The organization works through them alone or with a consultant, and the certification body later examines the results.

1. Management Commitment and Scope

The first step is to get top management’s approval of the information security policy and its resources, then decide which parts of the organization fall inside the ISMS. The scope sets what gets audited and what appears on the certificate.

Scope also affects audit length, because freelancers working inside the scope count toward the headcount used to calculate audit time under ISO/IEC 27006-1:2024. A scope that is too narrow can leave out systems customers ask about, while a broader one adds audit days and evidence to prepare.

2. Gap Analysis

A gap analysis is a readiness check that compares the organization’s current state with the requirements of ISO 27001, meaning clauses 4 through 10 and the Annex A controls. It is separate from the certification audit, and the best time to run it is at the start of the project, before the organization commits to an audit date.

According to Elevate Consulting, the output is a gap register that lists each gap against the relevant clause or control, plus a remediation roadmap that sequences the work to close them. A draft SoA is a common and valuable extra.

Assign an owner and a deadline to every gap so the list works as a project plan from day one.

3. Risk Assessment and Treatment

Risk assessment identifies information security risks and rates them against criteria set in advance, while risk treatment chooses how to reduce them. The basics are covered in our guide to risk assessment.

The treatment options are to avoid, reduce, transfer, or accept a risk. Set the risk acceptance criteria before the assessment starts, so decisions to accept or treat a risk stay consistent.

Clause 6.1.3 requires the organization to formulate a risk treatment plan and to obtain the risk owners’ approval of that plan and their acceptance of the residual risk.

4. Statement of Applicability (SoA) and ISMS Documentation

The Statement of Applicability (SoA) records which Annex A controls were selected and whether they are implemented, along with the reasons for excluding the rest. It must trace back to the risk assessment results, so update the risk register before finalizing the SoA.

How to prepare an SoA is covered in our guide to the Statement of Applicability.

Supporting ISMS documents, such as policies and procedures, need clear version numbers and approval dates. The Stage 1 auditor checks this, and the full list of requested documents appears under the Stage 1 audit step.

5. Control Implementation and Employee Awareness

Every control listed in the SoA has to be operating in practice and leave records that can be checked. According to Elevate Consulting, the ISMS should have been operating for at least three months before the Stage 2 audit, so the auditor has a track record to examine.

Physical controls, such as access to buildings and server rooms, need evidence too. They are covered in our guide to physical and environmental security, and evidence handling in general is covered in our guide to evidence management.

The 2022 version of Annex A includes control 5.34 on privacy and protection of personally identifiable information (PII). The control aims to protect personal data in order to meet applicable legal requirements, which for organizations operating in Indonesia includes the Personal Data Protection (PDP) Law.

Employees also need to understand the information security policy and how their own work affects the ISMS (clause 7.3).

According to Advisera, the auditor looks for evidence that the relevant people know why security is needed. Keep training attendance lists and test results, since they can serve as that evidence.

6. Internal Audit

An internal audit is the organization’s own examination of its ISMS, carried out before the certification auditor arrives. ISO/IEC 17021-1 requires the certification body to evaluate, at Stage 1, whether internal audits and management reviews are being planned and performed.

Internal auditors need to be objective, so nobody should audit their own work. The basics are covered in our guide to internal audit.

7. Management Review

A management review is a recurring meeting, led by top management, that assesses ISMS performance and decides on improvements. The standard only says reviews happen at planned intervals, but according to Presencis most organizations hold them at least once a year.

The inputs include the status of actions from earlier reviews, changes in internal and external issues, feedback on information security performance, risk assessment results with the status of the treatment plan, and opportunities for improvement. The meeting produces decisions on those improvement opportunities and on any changes to the ISMS, and the minutes are kept as evidence of the results.

Phase 2: Certification Body Audit Steps

The audit phase has 5 steps: choosing an accredited certification body, the Stage 1 audit, the Stage 2 audit, closing nonconformities, and the certification decision with certificate issue. The organization picks the certification body, and that body runs the audits and decides whether to issue the certificate.

8. Choosing an Accredited Certification Body

ISO 27001 certificates are issued by third-party certification bodies, so the organization should choose one that is accredited. ISO itself only publishes the standard and states that it does not perform certification.

To find an accredited certification body, ISO advises contacting the national accreditation body in your country, and it refers to IAF CertSearch, which aggregates data from accreditation bodies and certification bodies. ISO states that accreditation is not compulsory, and it describes accreditation as independent confirmation that a certification body is competent.

The ISMS consultant should have no ties to the certification body, because ISO/IEC 17021-1 forbids certification bodies from offering management system consultancy. Where a body related to the certification body provided the consultancy, the standard’s recognized mitigation is that the certification body does not certify that system for at least two years after the consultancy ends.

Once you have chosen a body, submit an application and ask for a quote based on the scope and the number of people within it.

9. Stage 1 Audit

The Stage 1 audit checks how ready the documentation and design of the ISMS are, before the Stage 2 audit of how it runs. According to DQS, the auditor evaluates the organization’s documentation, including the results of the management review and internal audits.

Elevate Consulting lists these documents and records as reviewed at this audit:

• The ISMS scope statement and its boundaries
• The information security policy and objectives
• The risk assessment methodology and results, with the risk treatment plan
• An SoA that lists all 93 Annex A controls, with reasons for including or excluding each
• Version control and approval dates on documents
• Evidence that the internal audit and management review have been completed
• Meeting minutes and resource allocation decisions as evidence of management involvement
• Documented reviews of ISMS effectiveness

According to Elevate Consulting, most certification bodies require at least one full management review cycle and one internal audit before Stage 2. Stage 1 can end with a go-ahead to Stage 2 (outright or with observations for minor issues) or a delay until major gaps are fixed.

10. Stage 2 Audit

The Stage 2 audit tests whether the ISMS actually runs and works across the whole scope. DQS says the auditor evaluates the effectiveness of all management system processes, on-site or through suitable remote techniques.

According to Elevate Consulting and BSI, auditors look for this evidence:

• System logs, change tickets, access reviews, and vulnerability scan results
• System configurations, protections, and roles, reviewed with the SoA as reference
• Interviews with management, IT staff, process owners, and users
• Examples of how specific situations are handled, such as employee discipline
• Monitoring, measurement, reporting, and review of performance against objectives
• Internal audits and management reviews already carried out
• Compliance with applicable legal requirements

Elevate Consulting stresses that controls must show consistent operation over time, while one-off evidence or undocumented practices rarely pass. Assign one escort to each area under audit so evidence can be found quickly.

11. Closing Nonconformities

Closing a nonconformity means fixing its cause and sending the certification body evidence of the fix before the deadline. Auditors classify findings as major or minor nonconformities, plus opportunities for improvement that need no mandatory follow-up.

According to Schellman, a major nonconformity affects the management system’s ability to achieve its intended results, while a minor one does not. Two or more minor nonconformities against the same requirement can lead to a major nonconformity.

Deadlines differ between certification bodies, as the examples below show.

Certification body	Minor nonconformity	Major nonconformity
BSI	Written action plan within 5 working days after Stage 2	Additional visit about 30 days after the audit (earlier on request), with a limit of 6 months
Schellman	Action plan 14 days after the review closes, evidence of correction in 30 days, root cause remediation by the next review	Action plan 14 days after the review closes, evidence of correction in 30 days, root cause remediation in 60 days

BSI asks for an action plan that details the finding, its cause, the proposed corrective action, who is responsible, and the implementation date. ISO/IEC 17021-1 sets a general limit: if the certification body cannot verify the correction of a major nonconformity within 6 months after the last day of Stage 2, it must conduct another Stage 2 before recommending certification.

12. Certification Decision and Certificate Issue

After the findings are closed, someone at the certification body other than the audit team reviews the audit results and decides whether to issue the certificate, as ISO/IEC 17021-1 requires. At BSI, for example, a compliance team reviews the auditor’s recommendation before the certificate is awarded.

According to Glocert, this technical review and approval takes 1 to 2 weeks. The certificate is valid for three years as long as the organization maintains its system through surveillance audits.

After the Certificate Is Issued: Surveillance Audits and Recertification

After the certificate is issued, the organization undergoes a surveillance audit in each of the first two years, then recertification before the three-year certificate expires. ISO/IEC 17021-1 sets the first surveillance audit no more than 12 months after the certification decision date, then at least once a calendar year, except in recertification years.

According to Glocert, surveillance audits cover internal audits, management review, follow-up on earlier nonconformities, and changes to the ISMS, among other topics. The guide also says certification can be suspended or withdrawn if surveillance audits are not completed on schedule.

Visit schedules differ between certification bodies. BSI, for example, schedules the first surveillance visit four months after Stage 2 and then one every six months.

The recertification audit, held before the three-year certificate expires, assesses ISMS performance over the certification cycle, including previous audit findings and changes in scope or technology. Glocert recommends planning it 3 to 4 months before the certificate expires to leave time for corrective actions, since a certificate that expires before recertification completes means the organization loses its certification status.

How Long Does the ISO 27001 Certification Process Take?

From audit readiness to certificate, the process usually takes 3 to 6 months according to Elevate Consulting, and DQS gives the same range for Stage 1 and Stage 2 once readiness is reached. The time needed to build the ISMS beforehand depends on the size and readiness of the organization.

Time component	Estimate	Source
ISMS operating before Stage 2	At least 3 months	Elevate Consulting
Stage 1 audit	1 to 2 days	Elevate Consulting
Gap between Stage 1 and Stage 2	4 to 6 weeks, 6 months at most (BSI standard: 4 months)	Elevate Consulting, BSI
Total initial audit days (Stage 1 and Stage 2)	5 to 12 days for 1 to 125 employees	GRC Solutions
Closing major nonconformities	6 months at most after Stage 2	ISO/IEC 17021-1, BSI
Technical review and certificate approval	1 to 2 weeks	Glocert
Surveillance audit	3 to 4 days per year for 100 FTEs	LRQA
Recertification	6 to 8 days for 100 FTEs	LRQA

The initial audit days follow the ISO/IEC 27006 table as summarized by GRC Solutions, which adds that under the standard the minimum audit duration may be 70% of the recommended time. LRQA gives an example of an organization with 100 full-time equivalents (FTEs), which should expect an initial audit of 8 to 12 days.

Conclusion

The ISO 27001 certification process has 12 steps in 2 phases, from management approval to certificate issue, followed by surveillance audits and recertification. The audit result is decided during preparation, because auditors assess the documents and records that already exist when they arrive.

An ISO 27001 certificate shows that an independent party has audited your ISMS, but it does not cover every personal data protection duty in Indonesia’s PDP Law, which applies both domestically and extraterritorially. The law also requires a record of processing activities (Article 31) and breach notification within 3×24 hours (Article 46), while Government Regulation 33/2026, its implementing regulation, takes effect on January 16, 2027.

FAQ