ISO 27001 implementation, step by step

An implementation is eleven phases in a fixed order. The order is not a preference: doing the Statement of Applicability before the risk assessment produces a control set you cannot defend, and it is the single most common way a project loses a quarter.

Last reviewed 2026-08-31Written by Jacob Masse, TrazTech Inc.

A first ISO 27001 implementation takes a Canadian company nine to fifteen months and runs through eleven phases in a sequence that is largely fixed. Each phase depends on the one before it, and the dependency is what tells you when you can compress and when you cannot.

What decides the schedule is not effort. Clause 9 requires an internal audit and a management review before certification, and both need a system that has been running long enough to have something to review. That is the floor under every timeline on this page.

1. Confirm in writing what the buyer actually asked for.
2. Write the scope statement.
3. Name the accountable executive and the person who runs the system.
4. Build the asset, data and supplier inventory.
5. Run the risk assessment.
6. Decide treatment, then write the Statement of Applicability.
7. Implement the controls and the 25 clause requirements together.
8. Run the system for at least three months so it produces records.
9. Complete an independent internal audit.
10. Hold the management review.
11. Go through stage 1 and stage 2.

Steps 5 and 6 are the pair that gets reversed, and step 8 is the one that cannot be bought. Each phase below expands one of those steps. If you would rather work item by item, with the condition that makes each one done and the evidence the audit team asks for, the ISO 27001 checklist covers the same ground in that form.

Phase 1: confirm what was asked for

Get the wording in writing before spending anything. A large share of requests that arrive as "we need you ISO certified" turn out to be a security questionnaire, a SOC 2 report request, or a clause pasted from another contract. This is a five to six figure decision in Canadian dollars. Send the email asking the customer to confirm. If the answer names a report rather than a certificate and the buyer is North American, read the comparison with SOC 2 before continuing.

Phase 2: define the scope

Clause 4.3 asks for a documented scope, and the wording is printed on the certificate your customer will read. Write it in terms of services, systems, locations and legal entities, not departments. Narrow beats broad for a first certification: you can widen at recertification and you cannot narrow without looking like you retreated. And it has to be defensible to a customer, because a certificate covering a subsidiary nobody has heard of answers nothing.

Scope also prices the audit. Audit days are derived from effective headcount adjusted for sites, environments and complexity, so every system you pull in costs money for three years, not once.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

Phase 3: leadership accountability

Clause 5 wants an accountable executive, a policy signed at the top, and resources committed. That means two named people: someone accountable and senior enough to make a spending decision, and someone who runs the management system in the working week. Companies without a security executive commonly fill the first with a fractional CISO. Projects that skip this phase fail at management review, because nobody has standing to hold it.

Phase 4: the inventory

Systems, the data in them, where that data physically sits, who has access, and which suppliers touch it. This is the phase most worth doing yourself. A consultant builds it by interviewing your people, the slowest and most expensive way to get information your people already have. It also decides whether personal information governed by PIPEDA or a provincial statute is in scope, which shapes the boundary and the privacy work that sits beside the certification rather than inside it.

Phase 5: the risk assessment

Clause 6.1.2 requires a documented method, applied consistently, producing risks with owners and assessed levels. The method matters less than applying the same one twice and getting comparable answers. Auditors reject a register that arrived as a template, has no owner names and no dates, and bears no relationship to the inventory from phase 4. The risk assessment methodology page sets out a workable method and the register structure.

Phase 6: treatment and the Statement of Applicability

Decide what to do about each risk, then record a decision on every one of the 93 Annex A controls: applicable or not, why, and how it is implemented. The Statement of Applicability is the first document a stage 1 auditor reads, and it reveals whether the project was done in the right order. Written before the risk assessment, it reads as a shopping list: the justification column can only say "good practice", which the standard does not accept.

Phase 7: implementation

The longest phase, three to six months for most companies, and the one where budget goes. Two workstreams run in parallel: closing control gaps, which is technical and procurement work, and putting the 25 clause requirements into operation, which is process work and includes documented information control, competence and awareness, communication, and the nonconformity process.

Teams underestimate the second workstream because it produces nothing visible. A company can close every technical gap and still fail stage 2 with no evidence that anyone was trained, that documents are controlled, or that a nonconformity has ever been raised and closed.

Phase 8: run it

Three months minimum, and a full cycle of the periodic activities is better. An access review completed and signed. A supplier review. A restore tested rather than a backup job reported as successful. An incident logged and closed, even a trivial one, because an incident register with no entries tells an auditor the process is theoretical. This phase cannot be shortened by spending money. Start it earlier than most plans assume. What ready looks like covers the checkpoints in detail.

Phase 9: internal audit

Clause 9.2, and it has to cover the entire management system, not a sample of favourite controls. Independence is the constraint: whoever built the system cannot audit it, which means small teams either buy an independent internal audit from a firm, at $6,000 to $15,000 CAD, or find someone uninvolved internally. Log real findings. An internal audit report with no nonconformities is a finding in itself at stage 2. It tells the auditor the internal audit was not real.

Phase 10: management review

Clause 9.3 lists the inputs the meeting must consider, including the status of previous actions, changes in risk, audit results, objective performance and opportunities for improvement. Hold it as a real meeting with the accountable executive present, and minute the decisions rather than the discussion. Auditors check the inputs against the clause line by line, so structure the agenda the same way.

Phase 11: stage 1 and stage 2

Stage 1 is a documentation and readiness review, usually one to two days and often remote. Expect a list of what will fail at stage 2, and take four to twelve weeks to close it. Stage 2 is three to eight days of interviews, sampling and evidence, on site or remote depending on the body and the scope. Major nonconformities must be closed before a certificate issues; minor ones get a corrective action plan. The certificate then runs three years with surveillance audits in between, described on the certification page.

Where the months go

The third column is cumulative and accounts for the overlap, which is why it lands at nine to fifteen months rather than the sum of the second column. Two things compress: running implementation and the operating period together, by turning controls on as they are built rather than at the end, and booking the certification body early, since scheduling a stage 2 can take two months on its own.

Common questions