Organisations usually pursue ISO 27001 because a customer asked. That is a legitimate reason. It is worth understanding what you are agreeing to before the deadline is set.
What the standard actually requires
It requires a management system, not a set of controls. The controls in Annex A are selected based on your risk assessment — you justify what you applied and what you did not. Auditors examine the system that produces those decisions far more than any individual control.
This surprises people expecting a checklist.
The evidence trail is the real work
Certification asks you to demonstrate the system has been operating, which means records: risk assessments reviewed on a schedule, management reviews held, incidents logged and closed, access reviews performed and signed off.
You cannot produce twelve months of evidence in the month before the audit. Everything else is negotiable; this is not.
A realistic sequence
- Gap analysis against the standard — four to six weeks
- Scope definition, honestly drawn; over-scoping is the most common self-inflicted wound
- Risk assessment and Statement of Applicability
- Remediation of the gaps that matter
- Operate the system for a minimum of three months, generating records
- Stage 1 audit (documentation), then Stage 2 (implementation)
Twelve to eighteen months end to end is normal. Anyone promising three months is planning to fail the Stage 2.