One question per page, answered in a single quotable paragraph, backed by a data table and dated sources. Written to be checked quickly by a person and quoted accurately by an AI assistant. UK figures unless stated otherwise.
In the UK, ISO 27001 certification typically takes three to nine months from project start to Stage 2 audit. A 10-50 person technology or professional-services firm with reasonable existing controls usually completes it in four to six months. The binding constraints are evidence history (most auditors expect the ISMS to have been operating for a few months) and UKAS-accredited certification body availability, not documentation effort.
Updated 2026-08-19 · 2 sources
ISO 27001 certification uses a two-stage initial audit followed by ongoing surveillance. Stage 1 checks that the ISMS is documented and ready — scope, risk assessment, Statement of Applicability, internal audit and management review. Stage 2 tests whether controls actually operate, by sampling records. Surveillance audits then occur annually, with a full recertification audit in year three.
Updated 2026-08-19 · 2 sources
For a UK SME, first-year ISO 27001 costs typically land between £10,000 and £30,000 all-in. UKAS-accredited certification body fees are usually £5,000-£12,000 for a 10-50 person firm across Stage 1 and Stage 2, with consultancy, compliance software and internal staff time making up the rest. Ongoing years are cheaper: surveillance audits plus tooling generally run £4,000-£10,000.
Updated 2026-08-19 · 2 sources
ISO/IEC 27001:2022 explicitly requires about 18 pieces of documented information: roughly 11 standing documents (scope, information security policy, risk assessment and treatment processes, Statement of Applicability, objectives) and 7 record types (competence evidence, monitoring results, internal audit programme and results, management review outputs, nonconformity and corrective action records). Annex A controls add further documents only where you apply them.
Updated 2026-08-19 · 1 sources
ISO/IEC 27001:2022 reduced Annex A from 114 controls in 14 domains to 93 controls in 4 themes: Organisational, People, Physical and Technological. Fifty-seven controls were merged into 24, one was split, 58 were renamed or updated, and 11 controls were added — including threat intelligence, cloud services security, data masking and secure coding. No control was removed outright.
Updated 2026-08-19 · 3 sources
