Download Free ISO 27001 Certification Process from CyberSapiens
Quick answer: ISO 27001 certification follows nine steps, from setting your scope to passing a two-stage audit by an accredited certification body. This free two-page PDF sets them out for the 2022 edition, with a typical consultant-led engagement alongside.
The ISO 27001:2022 Certification Process
Many teams start certification without a clear picture of the sequence. The guide below is plain English and takes about five minutes to read. It is based on the 2022 edition including Amendment 1:2024. Certificates issued to the 2013 edition stopped being valid after 31 October 2025.
The guide is general information. The certification decision is made by an accredited certification body, not by CyberSapiens.
The Nine Steps at a Glance
The standard sets no fixed duration. How long each step takes depends on your scope, your existing controls and how quickly you can gather evidence.
1. Preparation and scope
Decide which services, sites, systems and data the ISMS covers, and who your interested parties are.
2. Leadership and policy
Top management approves the information security policy and assigns roles, resources and objectives.
3. Risk assessment and treatment
Identify and rate risks, choose treatments and select the Annex A controls you need.
4. Statement of Applicability
Record each Annex A control as applicable or not, with the reason, and link it to your risk treatment.
5. Implementation and records
Put the controls into operation, write the procedures you need and keep the records that show they work.
6. Awareness and training
Make sure staff know the policy, their roles and how to report incidents, and keep training records.
7. Internal audit
Impartial auditors test whether the ISMS meets your own requirements and the standard. Record findings and fix root causes.
8. Management review
Top management reviews audit results, incidents and objectives, and records decisions for improvement.
9. Certification audit
An accredited certification body runs Stage 1 (documentation and readiness) and Stage 2 (controls working in practice).
After certification: the certificate lasts three years. Expect annual surveillance audits and a recertification audit before it expires.
Use a consultant to prepare you and a separate certification body to audit you, because accredited certification bodies must stay impartial. See our ISO 27001:2022 certification and implementation services for how we support steps 1 to 8.
Download the Free Guide
A two-page PDF with two parts: the nine-step process above, and how a typical guided engagement runs from onboarding to surveillance. It ends with three checks to make before you start: use the 2022 edition, confirm your certification body is accredited by an IAF member, and keep your consultant and certifier separate.
Who it is for: founders, IT and security leads and compliance managers who are planning a first certification. No sign-up is needed.
Download the PDF (2 pages)Content Reviewed By
Ketki Tidke
Cyber Security and GRC Lead Auditor
ISO 27001 Lead Auditor
Ketki is a certified ISO 27001 Lead Auditor specialised in Governance, Risk and Compliance, with experience consulting public, private, and government clients. She evaluates threats, risk impacts, and regulatory requirements across multiple industry frameworks.
ISO 27001 Certification Process: Frequently Asked Questions
Is this ISO 27001 guide based on the 2022 edition?
Yes. It is based on ISO/IEC 27001:2022 including Amendment 1:2024. Certificates issued to the 2013 edition stopped being valid after 31 October 2025.
How long does ISO 27001 certification take?
There is no fixed duration. It depends on your scope, how mature your controls already are and how quickly you can produce evidence, so ask your consultant for a plan based on a gap assessment.
What happens in Stage 1 and Stage 2 of the audit?
In Stage 1 the certification body reviews your documentation and readiness. In Stage 2 it checks that your controls work in practice. You must close any findings it raises.
Can my consultant also certify me?
No. Accredited certification bodies are bound by impartiality rules, so use a consultant to prepare you and a separate body to audit you.
How long does the certificate last?
Three years. Expect annual surveillance audits and a recertification audit before the certificate expires.
Want Help With Your ISO 27001 Plan?
Talk to CyberSapiens about a gap assessment or readiness review. We will tell you where you stand and scope the work with you.
Email us
[email protected]Our head office
Lvl 1 206 Lorimer St, Port Melbourne, 3207
