ISO 27001 certification is third-party proof that your organization runs a robust Information Security Management System (ISMS). It is earned through a structured audit conducted by an accredited certification body, which independently verifies that your ISMS meets the standard. This article walks through the certification process end to end — from choosing a certification body to receiving the certificate — so you know exactly what to expect.
A quick distinction worth making up front: this is organizational certification — certifying your company's ISMS. It is separate from the personal certifications an individual earns by passing an exam, such as Lead Implementer or Lead Auditor.
Step 1: Selecting a Certification Body
Only an accredited certification body can issue a recognized ISO 27001 certificate, so this choice matters. Accredited bodies operate under standards like ISO/IEC 17021-1 and ISO/IEC 27006-1, which govern their competence and impartiality.
Request proposals: Contact several bodies and share your organization's size, locations, and ISMS scope to get accurate quotes.
Evaluate options: Compare cost, sector expertise, and reputation. There is no fixed fee, so accreditation status and terms are what to weigh.
Sign the engagement letter: Formalize the scope and timeline once you have chosen.
For more on how accreditation works and how to vet a body, see our article on Certification Bodies and Accreditation.
Step 2: Optional Pre-Audit
Before the formal audit you can commission an optional pre-audit (sometimes called a readiness assessment) from an independent auditor. It is not mandatory, but it can surface gaps in your documentation or implementation, familiarize your team with how an audit feels, and reduce surprises later — especially valuable for a first-time certification.
Step 3: Stage 1 Audit – Readiness Assessment
The Stage 1 audit is a high-level review of whether your ISMS is ready for full assessment. The auditor checks that your key documentation — the Statement of Applicability (SoA), the ISMS scope statement, and the mandatory documented information — is complete and coherent, gets familiar with your organization, and flags any gaps that would block Stage 2.
You receive a Stage 1 report listing any nonconformities (such as incomplete policies or a missing risk assessment), with time to address them before Stage 2. This stage typically takes one to two days depending on your size.
Step 4: Stage 2 Audit – Full Certification Audit
The Stage 2 audit is the in-depth assessment of whether your ISMS works in practice, not just on paper. Auditors review your implemented processes and controls, interview staff to confirm awareness and adherence, and examine evidence such as logs, training records, and risk treatment plans.
The Stage 2 report classifies what they find:
Conformities: Areas that meet the standard.
Major nonconformities: Significant gaps that block certification until resolved — for example, a critical control that was never implemented.
Minor nonconformities: Smaller issues that do not block certification but must be addressed.
Opportunities for improvement: Areas that already comply but could be stronger.
Step 5: Submit Corrective Action Plan
Where the audit found nonconformities, you submit a Corrective Action Plan (CAP) that includes a root cause analysis, the specific corrective actions, and a timeline — typically up to 90 days for major nonconformities. You then provide evidence that the actions were carried out. Resolving major nonconformities is required for certification; minor ones may be checked at the next audit.
Step 6: Issuance of Certificate
Once nonconformities are resolved, the certification body's decision panel reviews the audit reports and, if satisfied, issues your ISO 27001 certificate — valid for three years. You can then use the certification mark, in line with the body's rules, to demonstrate your achievement to customers and partners.
Practical tips for a smooth certification
Start early: Begin 6–12 months ahead to build a genuine ISMS and close gaps.
Document thoroughly: Make sure the SoA, scope, and policies are clear and accessible.
Run internal audits: Simulate the audit to find and fix issues first.
Engage your people: Train staff on their ISMS roles so they can answer auditor questions confidently.
The work that earns the certificate
Certification is the validation at the end — the real work is building an ISMS that passes. That is a structured project: defining scope, assessing risk, selecting controls, producing auditor-ready documentation, and proving it all works. Done from a blank page, it is where most projects lose months. And it is where judgment matters — an AI can draft a policy, but it cannot scope your ISMS or defend your control choices to the auditor sitting across the table.
Our ISO/IEC 27001 Lead Implementer Toolkit turns that work into a guided system: a 12-step roadmap, a project plan with 400+ sequenced tasks, and 20+ ISO-aligned templates built by a practising ISO 27001 Lead Auditor — the person who sits on the other side of the audit table. It is designed to take you from zero to audit-ready without a consultant. To understand the full implementation journey first, see our guide on How to Implement ISO 27001 in 12 Steps; and once certified, learn what comes next in How to Maintain an ISO 27001 Certification.