ISO 27001 guide

ISO 27001 Certification: Plan Your Journey

Get ISO/IEC 27001 certified without guessing. Build a personalised roadmap, end date and audit-fee range in two minutes, then follow the 12 steps with the checklist, templates and cost guide linked below.

Plan your ISO 27001 journey

Answer five quick questions and get a phased roadmap, a realistic end date, your audit-fee range and where your time will go. Free, runs in your browser, no signup to see the plan.

1. How big is your company?

2. What will the certificate cover?

3. What do you already have? (tick all that apply)

4. When do you need to be certified?

5. Will you use a compliance platform for evidence and documents?

Pick a company size and a target date to continue.

The 12 steps to ISO 27001 certification

ISO 27001:2022 certifies your Information Security Management System (ISMS) against 93 Annex A controls in four themes: Organizational, People, Physical and Technological. Certification lasts three years, with annual surveillance audits. The path is the same for everyone; the effort differs.

  1. 1Leadership buy-in and an ISMS owner
  2. 2Define the ISMS scope
  3. 3Risk assessment
  4. 4Risk treatment plan
  5. 5Select Annex A controls
  6. 6Statement of Applicability
  7. 7Implement controls and policies
  8. 8Collect operating evidence
  9. 9Security awareness training
  10. 10Internal audit
  11. 11Management review
  12. 12Stage 1 and Stage 2 certification audits

Everything for your ISO 27001 journey

What it costsAudit fees, tooling and the internal time that is usually the biggest line.The 12-step checklistWork through certification step by step.Risk assessment templateScoring matrix, treatment options and a register structure.Statement of Applicability templateAll 93 Annex A controls with status columns.Readiness checkScore where you stand today and list your gaps.Automate itContinuous evidence, a generated SoA and the Annex A library.

ISO 27001 FAQ

How long does ISO 27001 certification take?

Manually, most organizations take 6–12 months. The planner above turns that into an estimate for your size, scope and what you already have in place. Larger companies and whole-company scopes take longer; a compliance platform shortens the repetitive steps but not the audit lead time.

How much does ISO 27001 certification cost?

For a small-to-mid company, the Stage 1 and Stage 2 certification audits are roughly $8,000–$25,000 and annual surveillance audits roughly $4,000–$10,000, plus tooling and internal time. Internal time is usually the biggest cost.

What are the steps to get ISO 27001 certified?

Secure leadership buy-in, define the ISMS scope, run a risk assessment and treatment plan, select Annex A controls, write the Statement of Applicability, implement controls and policies, collect evidence, train staff, run an internal audit and management review, then pass the Stage 1 and Stage 2 certification audits.

How many controls are in ISO 27001:2022?

ISO 27001:2022 has 93 Annex A controls across four themes: Organizational, People, Physical and Technological.

Do I need a risk assessment before the Statement of Applicability?

Yes. The SoA records which Annex A controls apply and why, and that decision comes from your risk assessment and treatment plan. Start with the risk assessment template, then build the SoA.

Is the journey planner a quote?

No. It is a planning estimate based on typical durations for each step, adjusted for your answers. Your certification body and scope decide the final dates and fees.

Related reading

ISO 27001 vs SOC 2Which to get first.Best ISO 27001 softwareCompared on automation, cost and fit.Compliance cost calculatorYour first-year cost vs automation.Automate evidence collectionContinuous, audit-ready evidence from your stack.ISO 42001 for AI governanceThe AI management system standard.PricingCompliance platform from $149/mo.