Your ISO 27001 Certification Roadmap: From Gap Assessment to Stage 2
by Blake Reid, Senior Risk Advisor
ISO 27001 certification follows a well-defined arc, but the time and cost it takes vary enormously depending on how the work is organized. Teams that treat it as a linear documentation marathon often spend 12–18 months. NOXMON clients move faster because the RISKMON platform turns risk assessment, control selection, and evidence collection into parallel, continuous activities.
Here is the roadmap we use.
Phase 1: Gap Assessment and Scoping
We benchmark your current state against ISO 27001:2022, define a defensible ISMS scope, and identify the shortest credible path to certification. RISKMON quantifies the risk behind each gap so remediation is prioritized by exposure, not by whoever shouts loudest.
Phase 2: Risk Assessment and Treatment
Using RISKMON, we model threats against your assets and existing controls, producing a risk register expressed in financial terms. Treatment decisions and the Statement of Applicability flow directly from this analysis.
Phase 3: Implementation and Documentation
Policies, procedures, and Annex A controls are implemented with owners and review cadences tracked in the platform. Because evidence accumulates as you operate, you're never reconstructing it the week before the audit.
Phase 4: Internal Audit and Management Review
We run a full internal audit and management review to surface and close nonconformities before the certification body ever arrives—the single biggest factor in a clean Stage 2.
Phase 5: The Certification Audit
| Stage | Focus | What the Auditor Wants |
|---|---|---|
| Stage 1 | Documentation readiness | A complete, coherent ISMS: scope, policies, risk methodology, SoA |
| Stage 2 | Operating effectiveness | Evidence that controls are implemented and working as designed |
| Surveillance | Continual improvement | Proof the ISMS keeps running between certifications |
Top tip
Don't book Stage 1 until your internal audit is clean. RISKMON's readiness view tells you objectively when the ISMS is mature enough to pass—removing the guesswork from scheduling the certification body.
The Bottom Line
A successful ISO 27001 program is sequenced, evidence-driven, and risk-led. NOXMON combines hands-on advisory with the RISKMON platform to guide you from gap assessment to certificate—then keep you there. Certification becomes the milestone, not the mountain.
Start your roadmap with NOXMON and reach Stage 2 with confidence.