Twelve weeks is enough for a small team to build and start operating an ISO 27001 information security management system (ISMS): scope, risk assessment, Statement of Applicability, controls, internal audit and management review. It is not enough to be certified, because the certification body decides audit timing and wants operating records.
What does the 12 weeks include, and what does it leave out?
ISO/IEC 27001:2022 requires an ISMS built from clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement. Annex A lists 93 reference controls in four themes: organizational, people, physical and technological. The standard text is paywalled, so this plan follows widely used structure and should be checked against your copy.
This calendar assumes a company of tens of people, one engineering team, mostly cloud services, and a named owner with several hours a day. Larger or more regulated organisations should scale it. It ends with an internal audit and management review done, controls running, and a certification audit booked. Stage 1 and Stage 2 audit dates belong to the certification body, and Stage 2 expects evidence that controls have operated for some time.
What happens each week?
Week 1: mandate and scope. Secure written management commitment. Pick the ISMS owner. Define scope: products, locations, teams, systems. List interested parties and their requirements, including customers and regulators. Choose a certification body and ask for their audit rules.
Week 2: policy and method. Write the information security policy and objectives. Define the risk assessment method: scales for likelihood and impact, acceptance threshold, who approves. Start an asset inventory.
Week 3: assets and risks. Finish the inventory. Run the risk assessment with system owners, one workshop per area. Record risks in a register.
Week 4: treatment and SoA draft. Decide treatment for each risk. Draft the Statement of Applicability: for each Annex A control, applicable or not, why, and status. Get management to approve the risk treatment plan and accept residual risk.
Week 5: people and access controls. Roll out joiner, mover, leaver steps, MFA, role based access and a first access review. Screening and contract terms for staff. Start the awareness training plan.
Week 6: technology controls, part one. Endpoint baseline, encryption, backup and restore test, logging and monitoring, vulnerability management with targets, change control through code review.
Week 7: technology controls, part two. Secure development steps in CI, secrets handling, network segmentation, cloud configuration baseline, cryptography standard.
Week 8: suppliers and continuity. Supplier inventory with tiers, review of critical suppliers, contract clauses. Incident response procedure and a tabletop. Business continuity and recovery plan.
Week 9: documentation and training. Finish the remaining procedures that your SoA says are applicable. Deliver awareness training and keep attendance. Fill the evidence folder per control.
Week 10: monitor and measure. Define what you will measure: patch time, access review completion, incident count, training coverage. Run the metrics once. Start a corrective action register.
Week 11: internal audit. Have someone independent of the area audit clauses 4 to 10 and a sample of Annex A controls. Record findings and open corrective actions.
Week 12: management review and booking. Hold the management review with defined inputs (audit results, risks, objectives, incidents) and record decisions and resources. Close or schedule the audit findings. Confirm Stage 1 and Stage 2 dates with the certification body.
What mistakes sink the plan?
- Scope too wide. Every extra system adds controls and evidence. Start with the product and the people who run it, and widen later.
- Copying a template SoA. Auditors ask why a control is excluded. A blank justification is a finding.
- Policies without operation. Stage 2 looks for records over time, so start generating them in week 5, not week 12.
- Internal audit by the author. Independence matters.
- No management involvement. Clause 5 and the management review exist to prevent this.
- Ignoring corrective actions. An open register with owners and dates looks healthy. A missing register does not.
Who does what?
- ISMS owner: schedule, documents, audit liaison.
- Engineering lead: weeks 5 to 8 technical controls.
- IT or operations: endpoints, identity, suppliers.
- HR: screening, contracts, training.
- Management: week 1 commitment, week 4 risk acceptance, week 12 review.
- Independent auditor, internal or external: week 11.
What to do
- Get management sign off and name the owner today.
- Fix scope in one page and keep it narrow.
- Choose the certification body early and ask about timing and their evidence expectations.
- Follow the weekly plan, and file one dated evidence item per control as you go.
- Re-plan after week 4 once you know how many gaps the risk work found.
- After week 12, keep running the controls. The audit samples what you did, not what you wrote.
Quick check
Can you get ISO 27001 certified in 12 weeks?
You can build the ISMS in about that time under good conditions, but certification depends on the certification body's audit schedule and on enough operating records for Stage 2. Ask the body what they expect before you promise a date.
How many Annex A controls are there in ISO 27001:2022?
There are 93, grouped into organizational, people, physical and technological themes. You decide which apply and justify exclusions in the Statement of Applicability.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits, which gives the team time for other work. For the technological controls in weeks 6 and 7, technical evidence comes from your real code and dependencies: scans, SBOMs and reachability. Safeguard's agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Safeguard helps prepare and keep evidence ready. The certification body does the certifying. Book a call.
Sources
- ISO/IEC 27001:2022 pages on iso.org returned an access block when fetched and the standard is paywalled, so the structure above (clauses 4 to 10, 93 Annex A controls in four themes) is stated from widely published summaries and should be checked against your licensed copy.
Last reviewed: 18 October 2026.
