Table of Contents
- Why Firms Apply for ISO 27001 Certification
- ISO 27001 Implementation Steps Before You Apply
- Choosing an Accredited Certification Body
- How to Apply: The Stage 1 and Stage 2 Audit Process
- ISO 27001 Certification Cost: What to Budget
- ISO 27001 Certification Timeline: From Kick-Off to Certificate
- Your ISO 27001 Audit Checklist
- Common Mistakes to Avoid When You Apply
- Frequently Asked Questions
Last Updated: 18 October 2026
Why Firms Apply for ISO 27001 Certification
Applying for ISO 27001 certification has moved from a nice-to-have to a board-level priority.
The reason is simple: clients, tender panels and insurers now ask for proof of information security management, not just a promise. ISO 27001 is the international standard for an information security management system (ISMS). It is a documented, auditable framework for protecting data, and certification means an accredited body has verified yours.
A common mistake is treating certification as an IT project. It isn’t. It touches contracts, HR, suppliers and facilities, which is why firms that run it as a compliance programme finish faster than those that hand it to one overstretched engineer.
Below, we’ll show you exactly how to apply and where the process usually stalls.
ISO 27001 Implementation Steps Before You Apply
Before any auditor sees your organisation, you need a working ISMS. The ISO 27001 implementation steps follow a predictable order: define scope, assess risk, select controls, document, then operate the system long enough to generate evidence.
Most organisations need a few months of operation before an audit makes sense. Auditors want to see records, not intentions. A risk register that was written last week and never reviewed tells them the system isn’t live.
The sequence we recommend to clients:
- Secure executive sponsorship and agree a budget
- Define the ISMS scope and boundaries
- Run a risk assessment and build the risk register
- Draft the Statement of Applicability
- Write the core policies and procedures
- Train staff and run at least one internal audit
- Hold a management review
- Close the gaps before booking your certification body
Skipping step 6 is the single most common cause of a failed Stage 1.
Scoping, Risk Assessment and the Statement of Applicability
The Statement of Applicability (SoA) is the document that lists every control in Annex A of the standard and states whether you apply it, and why. Auditors treat the SoA as the spine of your ISMS, so a vague one damages credibility fast.
Scope is where firms get caught out. If you exclude a subsidiary, a data centre or a remote team, say so explicitly and justify it. Auditors test the boundary. A scope that says “all operations” but excludes the warehouse server room will not survive scrutiny.
For the risk assessment, use a consistent scoring method and record the owner of every risk. The ISO/IEC 27001 standard sets the requirements; you can choose your risk-scoring method, but it must be repeatable.
Choosing an Accredited Certification Body
An accredited certification body is an organisation approved by a national accreditation service to audit and certify management systems. In the UK, UKAS provides that approval. If your chosen body is not UKAS-accredited for ISO 27001, your certificate carries little weight with clients and tender panels.
Ask three questions before you sign: which accreditation body accredits you, who will actually conduct the audit, and what happens if we need to reschedule. The UKAS accredited bodies directory lets you verify accreditation status directly.
For ISO 27001, certification bodies can travel to you. Do not pick on price alone. A cheap audit that misses gaps leaves you paying twice.
How to Apply: The Stage 1 and Stage 2 Audit Process
The application itself is short. The audit that follows is where the work happens. You submit an application form, agree on scope and audit dates, and pay a deposit or the full fee, depending on the body.
Stage 1 is a documentation review. The auditor checks that your ISMS is designed correctly and ready for a full assessment. Expect findings and a written report. You then fix the gaps.
Stage 2 is the certification audit. The auditor tests whether the system actually works: sampling records, interviewing staff, checking evidence. Pass, and you receive your certificate, valid for three years, with surveillance audits in years one and two.
A compliance manager and an external auditor reviewing documentation together at a meeting table in a bright office, laptop and printed policy folders open between them
|
Stage |
What Happens |
Typical Duration |
Output |
|---|---|---|---|
|
Application |
Scope agreed, dates booked, fees paid |
1-2 weeks |
Audit scheduled |
|
Stage 1 |
Documentation and readiness review |
1 day |
Findings report |
|
Gap closure |
Fix Stage 1 findings |
2-8 weeks |
Corrective actions |
|
Stage 2 |
Full certification audit |
2-5 days |
Certificate decision |
|
Surveillance |
Annual surveillance check in years 1 and 2 |
1-2 days |
Continued certification |
ISO 27001 Certification Cost: What to Budget
ISO 27001 certification cost in the UK depends on your headcount, scope and how much of the ISMS you build in-house. There is no fixed price, and any provider quoting a flat figure before scoping your organisation is guessing.
Budget for three cost lines: certification body fees, any consultancy or vCISO support, and internal staff time. The last is the one firms forget, and it is often the largest.
Certification body fees scale with audit days, which scale with employee numbers. A small firm will sit at the lower end; a multi-site operation with complex scope will pay considerably more. Ask for a written quote against a defined scope.
For organisations without an in-house security lead, an outsourced model can provide the security leadership an ISMS needs without the expense of a full-time executive salary. TrustedIA offers vCISO advisory and 24/7 SOC monitoring.
ISO 27001 Certification Timeline: From Kick-Off to Certificate
The ISO 27001 certification timeline typically runs from three to nine months for a prepared organisation, and longer if the ISMS has to be built from scratch. The audit itself is quick; the readiness work is not.
A realistic breakdown for a mid-sized firm:
- Months 1-2: scoping, risk assessment, SoA
- Months 2-4: policies, training, controls in place
- Months 4-5: internal audit and management review
- Months 5-6: Stage 1 and gap closure
- Months 6-7: Stage 2 and certification
Compressing this is possible but risky. Rushing the operating period means thin evidence, and thin evidence means findings.
Your ISO 27001 Audit Checklist
Use this ISO 27001 audit checklist to test readiness before you book Stage 1. If you cannot tick most of these, you are not ready.
- ISMS scope documented and approved by leadership
- Risk assessment completed with scored, owned risks
- Statement of Applicability signed off
- Core policies written, published and acknowledged by staff
- Asset register covering hardware, software and data
- Access controls and leaver process evidenced
- Supplier and third-party risk reviews recorded
- Incident response procedure tested
- Staff security awareness training completed
- Internal audit carried out with findings logged
- Management review held with minutes
- Corrective actions tracked to closure
The NCSC guidance on cyber security for business is a useful cross-check for the technical controls behind these items.
Common Mistakes to Avoid When You Apply
The most frequent mistake is applying too early. Firms book an audit to create deadline pressure, then fail Stage 1 and lose the fee and the momentum.
Second is treating documentation as the goal. A beautiful policy pack with no evidence of operation is worse than a plain one that is actually followed. Auditors sample reality.
Third is scope creep in reverse: quietly excluding the parts of the business that are hardest to secure. That undermines the certificate’s value and often surfaces during client due diligence.
Finally, many firms go it alone when they lack a security lead. Bringing in vCISO support early usually shortens the timeline and reduces rework. TrustedIA can work alongside in-house IT teams.
Certification is a project with a deadline, a budget and a paper trail, and most firms underestimate the internal effort it takes. If your team has no dedicated security lead, that effort lands on people who are already stretched. TrustedIA provides on-demand vCISO advisory, 24/7 SOC monitoring and incident response, and a partnership model that integrates with your existing IT setup, so you can pursue ISO 27001 without hiring a full-time executive. Explore how TrustedIA can support your certification and strengthen your security posture.
Frequently Asked Questions
How do I apply for ISO 27001 certification?
You apply directly to an accredited certification body, not to ISO itself. First complete your implementation: define the scope, run a risk assessment, write your Statement of Applicability and put the required policies and controls in place. Then request a quote from a UKAS-accredited body and book a Stage 1 documentation review followed by a Stage 2 audit. Once you close any non-conformities, the body issues your certificate, which is valid for three years with annual surveillance audits.
How long does ISO 27001 certification take?
Most SMEs need six to twelve months from kick-off to certificate. The ISO 27001 certification timeline depends on your current security maturity, the size of your scope and how quickly your team can produce evidence. Stage 1 and Stage 2 audits are usually booked several weeks apart, and you should allow time to fix any non-conformities raised. Organisations with existing policies and a managed IT provider often move faster than those starting from scratch.
How much does ISO 27001 certification cost?
ISO 27001 certification cost has two parts: the certification body’s audit fees and your internal or consultancy costs. Audit fees scale with the number of employees in scope and the complexity of your operation. Consultancy, tooling and staff time usually make up the larger share. Request quotes from two or three accredited bodies and ask exactly what is included before you commit.
Can a small business get ISO 27001 certified?
Yes. The standard is written to scale, and many small firms certify successfully by keeping the scope tight, for example covering only the systems that hold client data. You still need a risk assessment, a Statement of Applicability and evidence that controls operate, but you do not need a large security team. Working with an external adviser for the implementation steps and audit checklist is a common route for SMEs without in-house compliance staff.
,
