Figures as read on 19 October 2026
Short answer. From about two or three months for a well-managed project to twelve months. NQA says well-managed projects with experienced internal resources can reach certification in 2 to 3 months, and that six months or more is not unusual. DNV: "as little as 3 months" for one location and a small system. Bureau Veritas: most organisations "take up to 12 months".
What each source says
| Source | Statement |
|---|---|
| NQA | Well-managed projects with experienced internal resources can achieve certification in 2 to 3 months; six months or more is not unusual. |
| DNV UK | For organisations with one location and small systems, it can take as little as 3 months. |
| Bureau Veritas UK | Most organisations take up to 12 months to get ISO 27001 certified. |
| Citation ISO Certification | Realistic timeframe from project start to certification is typically 3 to 6 months. Also claims 12 weeks for organisations that follow its support. |
What makes it quicker or slower
- One narrow scope rather than the whole organisation.
- One location rather than several.
- Existing documented controls and a risk assessment you can already show.
- Experienced internal people, or the budget to buy time.
The cycle after you pass
An accredited certificate lasts three years. Surveillance audits happen at least annually, and a recertification audit closes the cycle. Amtivo says the certificate lasts three years from the start date and that you undergo an annual surveillance audit; TUV Rheinland UK lists annual surveillance and recertification within three years. Budget for the later years, not just the first audit.