ISO 27001 implementation takes most SMBs 3–6 months and follows nine steps: define scope, run a gap analysis, assess risks, write the Statement of Applicability, implement Annex A controls, document policies, train staff, pass an internal audit, then the two-stage certification audit.
This guide gives you the full plan with realistic timelines and costs — the same sequence we run for clients across the US, EU and Nordics. If you want the short version of what the standard is, start with our ISO 27001 services page or the ISO 27001 vs SOC 2 comparison.
The 9-step ISO 27001 implementation plan
| Step | What happens | Typical duration |
|---|---|---|
| 1. Scope definition | Decide which entities, locations, systems and data the ISMS covers. Narrow scope = faster, cheaper certification. | 1 week |
| 2. Gap analysis | Compare current controls against the 93 Annex A controls (2022 revision). Output: prioritized remediation list. | 1–2 weeks |
| 3. Risk assessment | Build the asset register, identify threats, score likelihood × impact, choose treatment for each risk. | 2–3 weeks |
| 4. Statement of Applicability | Document which Annex A controls apply and justify every exclusion. The SoA is the document auditors read first. | 1 week |
| 5. Control implementation | Close the gaps: MFA, logging, backup, vendor management, access reviews, incident response. Usually the longest phase. | 4–10 weeks |
| 6. Policy & documentation | ISMS manual, risk methodology, ~15–25 policies. Write them to match reality — auditors test practice, not prose. | 2–4 weeks (parallel) |
| 7. Training & awareness | All-staff security awareness plus role-specific training, with attendance evidence. | 1–2 weeks (parallel) |
| 8. Internal audit + management review | Mandatory before certification. An independent internal auditor tests the ISMS; management review closes findings. | 2 weeks |
| 9. Certification audit | Stage 1 (documentation review) then Stage 2 (implementation evidence) by an accredited certification body. | 4–6 weeks incl. scheduling |
How long does ISO 27001 implementation take?
| Organization | Realistic timeline |
|---|---|
| Startup / SMB up to 50 staff, cloud-native | 3–4 months |
| 50–250 staff, mixed infrastructure | 4–6 months |
| 250+ staff or regulated sector | 6–12 months |
The single biggest accelerator is an experienced implementer who brings pre-built policy templates and knows what certification-body auditors actually check. The single biggest delay is starting control implementation before the risk assessment is done — you end up implementing the wrong controls.
What does it cost?
For an SMB, budget three buckets: implementation support (US/EU consultancies typically charge $15,000–40,000; our fixed-fee remote model runs 30–50% below that), the certification body audit ($5,000–15,000 for Stage 1+2 depending on scope and headcount), and tooling (often near zero — most SMBs certify on Microsoft 365/Google Workspace plus an EDR and a password manager they already own). Annual surveillance audits after certification run $3,000–8,000.
Where implementations fail
Four patterns cover almost every failed or stalled project we inherit: scope set too wide (certify the product platform, not the whole company); policies copied from templates that describe controls nobody runs; no evidence habit (auditors want tickets, logs and minutes — not assurances); and treating the internal audit as a formality instead of a dress rehearsal.
Free gap review
30-minute call. We map where you stand against the standard and what closing the gap costs.
Fixed-fee quote
Implementation at 30–50% below US/EU consultancy rates — same auditors, same certificate.
FAQ
Can we implement ISO 27001 ourselves?
Yes — the standard does not require a consultant. Teams that self-implement typically spend 200–400 internal hours and 6–12 months. Most SMBs use outside help for the risk assessment, SoA and internal audit because those are where inexperience costs certification attempts.
Is ISO 27001 certification mandatory?
No law mandates it, but enterprise procurement increasingly does — it is the most requested security certification in EU and UK vendor assessments, and it satisfies large parts of NIS2 and GDPR Article 32 evidence requirements. See our NIS2 hub.
ISO 27001 or SOC 2 first?
Sell mainly to US customers → SOC 2 first. Sell to EU/UK/global enterprise → ISO 27001 first. The control overlap is roughly 80%, so doing the second one after the first is a small increment — full breakdown in ISO 27001 vs SOC 2.
What changed in the 2022 revision?
Annex A was restructured from 114 controls in 14 domains to 93 controls in 4 themes, adding 11 new controls (threat intelligence, cloud security, data leakage prevention, secure coding among them). All new certifications are issued against ISO/IEC 27001:2022.
ITSECOPS implements ISO 27001 end-to-end — gap analysis to certificate — with a Norway entity and 24/7 India SOC. This article is general guidance, not audit or legal advice.