ISO 27001 Certification Timeline: What Australian SMEs Should Expect
For a small or medium business in Australia, getting ISO 27001 certified often takes somewhere between five and ten months. That starts at the first gap check and ends when the certificate lands. Treat it as a planning guess. No ISO rule sets this number. The real figure turns on a few things: how much of the business is covered, what gaps turn up, how many hours staff can give, and how soon an auditor can start.
ISO’s own help centre says it can’t advise on how long certification takes or what it costs. It sends people to certification bodies, so read every range below as rough. An ISO 27001 consultant can look at the actual business and say if these numbers fit, ideally before any dates are booked.
Building the system versus passing the audit
Plenty of owners think certification is a single job. It is two.
The first is building an information security management system. Most people shorten that to ISMS. Think of it as the business’s own way of looking after information: policies, a risk list, controls and records. The business has to build it, then use it.
The second is the audit. A certification body carries it out. ISO doesn’t, because ISO never certifies anyone. What ISO does suggest is checking that the certification body is accredited, which means another group has already checked the body itself. In Australia that is JAS-ANZ, which the Australian and New Zealand governments set up.
The building is where most of the hours go, so plan around it. Book the audit too soon and the business ends up rushing.
What makes it slower or quicker
Four things have the biggest pull.
Scope. A single office or one product is quicker to cover than a business with a pile of sites.
Gaps. Some businesses have no risk list, no access rules and no incident plan. The Australian Signals Directorate (ASD) provides a free Small Business Cyber Security Guide with practical steps such as using multi-factor authentication, updating software and keeping backups. These are useful starting points when preparing for ISO 27001 certification.
Staff time. Many small businesses have one IT person, or an outside firm. Security work has to fit around daily jobs.
Audit dates. Certification bodies run their own calendars. Audit length also grows with the number of people in scope.
The main stages
Today’s version is ISO/IEC 27001:2022. Certificates for the 2013 version ran out on 31 October 2025, which means any new project follows the 2022 one.
Stages 1 to 4: the build phase
Scope and gap check. The business decides what the ISMS will cover, then sets what it does today next to the standard.
Risks and controls. Risks get listed and scored. Controls get chosen and written into a document called the Statement of Applicability.
Policies and controls in place. Policies are written and the controls are set up. Staff are trained.
Running the system. Records pile up as the system gets used. The business also runs an internal audit and a management review, since certification bodies want both finished before the main audit.
Stages 5 and 6: the audit
Stage 1 audit. The auditor goes through the way the ISMS is set up. That covers the scope, the risks and the main policies. Anything missing goes back to the business to sort out.
Stage 2 audit and decision. Now the auditor wants proof that the controls work day to day. When the findings are closed, the certification body decides.
Here are rough times for each stage. They are planning estimates only, and some stages run side by side.
Since stages overlap, the rows added together can be more than the real total.
Getting the certificate isn’t the finish line. It usually runs for three years, with lighter check-up audits (called surveillance audits) in between and a full re-audit at the end.
Want to cut wasted effort in daily work? Read our blog on how Melbourne firms use business process improvement to cut waste.
Where the delays come from
Most late projects trip over the same things.
The scope starts large or keeps moving.
Templates are used as they are, so policies don’t fit the business.
Nobody takes charge, or the senior people stay away. The standard expects leaders to be involved.
The internal audit and management review get shoved to the end.
Fixing the Stage 1 findings takes longer than anyone allowed for.
Now and then the trouble isn’t security at all. Roles can be fuzzy and sign-offs can crawl. In that case organizational consulting might help a business look at how decisions and jobs pass between teams.
Getting ready and cutting delays
Early moves help most. None needs a big budget. Each needs someone senior to say yes.
Fix the scope early, and don’t make it bigger than the business needs.
Give the project one owner, and have that person catch up with a senior leader every so often.
Sort the basics first. The ASD guide is free.
Keep records from the very first day, because the auditor has to see the system in use.
Do the internal audit well before the main one. Then any problems it finds can be fixed in time.
Call a few accredited certification bodies early and ask how far ahead they are booked.
Start with a gap review from an ISO 27001 consultant. It shows the scope and the workload before anyone puts an audit date in the diary.
Write short policies. A small business process improvement consultant can trace how work actually gets done, so the controls suit what staff already do and don’t add silly extra steps.
Where outside help fits
6 Sigma Consulting follows four steps: gap assessment and risk analysis, policy and controls design, implementation with coaching and internal audit, and certification readiness. A Master Black Belt leads the project and acts as a part-time Information Security and Compliance Officer.
A good ISO 27001 consultant can save a business from redoing work. Scope, risks and records get checked before the auditor arrives. ISO 27001 consulting might suit a business with a client or tender deadline, not much spare staff time, or nobody who has been through an audit.
Outside help can’t replace the certification body or promise a result. The ISMS still belongs to the business.
A realistic ISO 27001 certification timeline starts with a straight look at scope and security gaps. Owners and managers who’d like an ISO 27001 consultant to review theirs can book a free Business Discovery consultation with 6 Sigma Consulting. The aim is a clear recommendation for the business. It costs nothing and there is no obligation.
Frequently asked questions
How long does ISO 27001 certification take for a small business?
Several months, as a rule. Five to ten is a fair guess, but scope, gaps and audit dates set the real number.
Can a business finish in a few weeks?
That is hard to plan around. The ISMS has to be built and working first, and the internal audit and management review must be done before the main audit.
What happens if the audit finds problems?
The business fixes each finding, and the certification body checks the fixes before it decides. Leave some spare weeks in the plan for this.
How long does the certificate last?
Usually three years, with surveillance audits in between.
Does ISO hand out the certificate?
No. An outside certification body does. ISO doesn’t certify businesses.
Comments