If your team is planning its first ISO 27001 certification, the most useful thing to understand early is that certification is not a single exam you either pass or fail on the day. It is a two-stage audit that opens a three-year relationship with a certification body. Most teams picture one auditor, one visit, one verdict. The reality is more forgiving in some ways and more demanding in others: you get a structured look at your readiness before the decision audit, but the decision audit itself is a test of whether your information security management system (ISMS) genuinely runs, not just whether it exists on paper. Knowing what each stage assesses lets you prepare for the right thing at the right time.
Certification is a cycle, not a moment
The initial certification audit has two stages, Stage 1 and Stage 2. Clear those, close any nonconformities, and the certification body issues a certificate that is valid for three years. But the certificate is not the end of the process. Within those three years you have surveillance audits in years one and two, which are lighter-scope checks that you are maintaining the ISMS, followed by a recertification audit in year three that reviews the whole ISMS again to renew you for another cycle.
So the mental model to carry into planning is a cycle rather than a milestone. Certification is something you enter and then keep demonstrating. That framing matters because Stage 2 auditors are not looking for a system that was assembled to pass a test. They are looking for one that will still be operating when they come back next year.
One point of vocabulary that trips teams up: your company receives certification, and the certification body itself receives accreditation from a national accreditation body. The two are not interchangeable. You want a certification body that is properly accredited, because that accreditation is what makes your certificate credible to the customers and regulators who will ask to see it.
Stage 1: is the ISMS ready and documented?
Stage 1 is a readiness and documentation review. The certification body looks at whether your ISMS is built well enough to be worth auditing in depth. In practice that means reviewing your ISMS scope, your mandatory documentation, your risk assessment and risk treatment, and your Statement of Applicability (SoA). The auditor is checking that these things exist, that they are coherent, and that they line up with each other.
The purpose of Stage 1 is to surface gaps before the main audit rather than to award anything. It is not a pass or fail certificate decision. If your ISMS is not ready, Stage 1 can defer Stage 2 until it is. That is not a punishment; it is the system working as intended, saving you from walking into the decision audit with problems that were always going to be found.
This is why it pays to reach Stage 1 in genuinely good shape. The clearer your scope, the tighter your SoA, and the more complete your documentation, the more Stage 1 becomes a confirmation rather than a list of things to fix. A structured ISO 27001 readiness assessment before you engage a certification body is the most reliable way to make sure Stage 1 tells you what you already expect to hear.
Between the stages: closing what Stage 1 found
Stage 1 almost always produces observations, and often findings you need to act on. The gap between Stage 1 and Stage 2 is where you close them. Treat this window as real work, not a formality. Anything the Stage 1 auditor flagged as a weakness in your documentation, your scope definition, or your risk treatment is a preview of what the Stage 2 auditor will probe more deeply.
The teams that move smoothly from Stage 1 to Stage 2 are the ones that take the Stage 1 output literally and resolve each item with evidence, rather than assuming a light touch on the day. If Stage 1 raised a question about how your SoA justifies an excluded control, or whether your risk treatment plan actually addresses your top risks, those are exactly the threads Stage 2 will pull. Close them now, while it is cheap to do so.
Stage 2: does the ISMS actually operate?
Stage 2 is the main audit, and its question is different from Stage 1's. Stage 1 asked whether the ISMS is ready and documented. Stage 2 asks whether it is implemented and effective. The certification body samples evidence against the ISO 27001 clauses (4 to 10) and the Annex A controls your SoA says are in scope, and it wants to see the system operating and producing records.
This is the distinction that catches teams out. Having a policy is not the same as being able to show the policy in action. A Stage 2 auditor wants to see that your internal audit was actually carried out, that your management review was actually held, that your risks have actually been treated, and that your controls are actually working and generating the records that prove it. Documentation gets you through Stage 1. Evidence of operation gets you through Stage 2.
The current standard is ISO/IEC 27001:2022, whose Annex A sets out 93 controls across four themes, and Stage 2 tests the ones your SoA brings into scope. Worth flagging for any team that thinks it may already be part-way there: ISO 27001:2013 was withdrawn on 31 October 2025. A company that missed the transition from the 2013 version to the 2022 version is uncertified, and it needs a full initial Stage 1 and Stage 2, not a transition audit. There is no shortcut back into certification from a lapsed 2013 position.
Nonconformities, and what it takes to clear them
When an auditor finds that something required is missing or not working, that is a nonconformity, and nonconformities are graded. A minor nonconformity is a limited or isolated lapse. A major nonconformity is more serious, and it must be corrected, with evidence of the correction, before the certificate can be granted.
The practical consequence is that a major nonconformity at Stage 2 stands between you and your certificate until you fix it and prove you have fixed it. This is not the same as failing outright, but it does mean the decision waits on you. The way to avoid this is not to hope the auditor misses things; it is to make sure that every in-scope control has evidence behind it before Stage 2 begins, so that there is nothing major left to find.
Grading also tells you where to focus. Minor nonconformities are worth taking seriously because a pattern of them signals a system that is not yet embedded, but it is the majors that gate the certificate. Knowing the difference helps you triage sensibly if findings do come up.
The certificate, and the three years after it
Once Stage 2 is complete and any nonconformities are closed, the certification body issues your certificate, valid for three years. That certificate is what your customers and partners actually want to see, and it is the tangible result of the whole exercise.
But remember the cycle. Years one and two bring surveillance audits, lighter in scope, checking that you are maintaining the ISMS rather than re-examining all of it. Year three brings recertification, a fuller audit of the whole ISMS again to renew you for another three-year cycle. The ISMS you build for Stage 2 has to keep running, because you will keep being asked to show that it does. A system that was propped up for one audit will struggle at the first surveillance visit.
What "ready for Stage 2" really means
Pulling this together, being ready for Stage 2 is not about having a full set of documents. It is about being able to show the ISMS operating. Your internal audit has been done. Your management review has been held. Your risks have been treated. Your in-scope Annex A controls are working and producing records an auditor can sample. If those things are true, Stage 2 becomes a demonstration rather than a discovery.
The teams that struggle are the ones that reached Stage 1 with good documents and then assumed Stage 2 would be more of the same. It is not. It is the point where the certification body checks whether the system lives. If you want an honest read on whether your ISMS is at that point before you commit to a certification body, a Mini Gap Review will tell you where the operational evidence is thin while there is still time to build it.
Working on ISO 27001?
From gap assessment and implementation to internal audit and ongoing ISMS support - scoped to where your system actually is.