The ISO 27001 Certification Process and Timeline, Stage by Stage
The five implementation phases, the two audit stages and what each actually tests, the nonconformity classifications that move your date, and honest elapsed timelines for Philippine organisations.
Short answer
A first ISO/IEC 27001:2022 certificate takes most Philippine organisations six to twelve months of elapsed time, and the binding constraint is almost never the paperwork. It is that clauses 9.1, 9.2 and 9.3 have to have produced real records before a Stage 2 auditor can test them. You cannot monitor something that has not run, audit a process that has never operated, or hold a management review with nothing to review. Documentation can be accelerated. Operating history cannot.
The audit itself is two stages, governed by ISO/IEC 17021-1:2015. Stage 1 tests whether your ISMS is designed and whether you are ready to be audited. Stage 2 tests whether it is implemented and effective. They are separate audits with separate purposes, and treating Stage 1 as a formality is the single most reliable way to lose a month.
Typical first cycle
6–12 months
Elapsed, from kickoff to certificate. Sterling project experience.
Audit stages
Two
Stage 1 design and readiness; Stage 2 implementation and effectiveness.
Minimum operating period
Not set by 27001
The standard sets none. Real records for 9.1, 9.2 and 9.3 are the gate.
Certificate validity
3 years
With surveillance audits, then recertification before expiry.
This page is the process companion to our full guide on ISO 27001 certification in the Philippines. For what it costs, see the cost breakdown; for who is allowed to issue the certificate, see accredited certification bodies.
The whole route on one page
Nine steps, five of them yours and two of them the certification body’s. The column that matters is the last one: what has to exist before the next step is possible. Most delayed projects are not delayed because a step was done badly. They are delayed because a step was started before its precondition existed.
| Step | Who runs it | Output that must exist before the next step |
|---|---|---|
| 1. Scope, context and gap assessment | You, or your consultant | A defined scope statement, the clause 4.1 and 4.2 determination (including the climate-change question added by Amendment 1:2024), and an honest gap list against all of clauses 4–10. |
| 2. Risk assessment and treatment | Risk owners, facilitated | A risk register with named owners and evaluated levels, a treatment plan, and a Statement of Applicability with a real justification against every line. |
| 3. Documentation | Process owners | The fifteen mandatory items plus whatever else you have determined necessary under clause 7.5.1 b). |
| 4. Implementation | Everyone in scope | The controls in your SoA actually operating, and generating records as they run. |
| 5. Operation | Everyone in scope | Monitoring and measurement results under clause 9.1. This is the phase that consumes calendar time and cannot be bought. |
| 6. Internal audit and management review | Internal auditor; top management | A completed internal audit covering the ISMS scope, its findings actioned, and a management review that produced decisions. |
| 7. Stage 1 audit | Certification body | A Stage 1 report, and the certification body’s confirmation that you are ready for Stage 2 — with any areas of concern closed. |
| 8. Stage 2 audit | Certification body | A Stage 2 report. Any major nonconformity cleared and verified before a certification recommendation can be made. |
| 9. Certification decision | Certification body, by someone not on the audit team | The certificate. Under ISO/IEC 17021-1:2015 the decision must be made by a person or committee that did not conduct the audit. |
Phase 1 — Scope, context and gap assessment
Typical duration: 2 to 4 weeks. This phase decides the cost of every phase after it, which is why rushing it is expensive rather than efficient.
Scope is not a marketing decision. Clause 4.3 requires you to determine the boundaries and applicability of the ISMS considering the external and internal issues from 4.1, the requirements of interested parties from 4.2, and the interfaces and dependencies between what you do yourself and what other organisations do for you. A scope that reads “all operations of the company” is easy to write and expensive to audit. A scope that carves out a delivery centre, three systems and one client contract is harder to write and much cheaper to certify — provided the interfaces are stated honestly.
Two scope errors dominate in this market. The first is excluding something the auditor will encounter anyway: the payroll system sits outside scope, but it runs on the same domain, on the same network, administered by the same two people. The second is scoping in a client whose contract you have not read, and discovering at Stage 2 that the contract imposes controls your SoA does not contain.
| Deliverable | What good looks like | What we usually find |
|---|---|---|
| Clause 4.1 issues | Named, specific and dated. Regulatory (Data Privacy Act), commercial (client security schedules), operational (attrition, grid stability), and the climate-change relevance determination that Amendment 1:2024 added. | A generic PESTLE table copied from a template, with no evidence anyone in the business was asked. |
| Clause 4.2 interested parties | Parties named, their requirements stated, and which of those requirements the ISMS will address. | A list of stakeholder categories with no requirements attached — which fails, because the clause is about requirements. |
| Scope statement | Boundaries, locations, systems, and the interfaces and dependencies with other organisations spelled out. | One sentence naming the company and the word “information”. |
| Gap assessment | Every clause from 4 to 10 and every applicable Annex A control rated against current reality, with the effort to close each. | A checklist rated by the person who would have to do the work, marked mostly green. |
Phase 2 — Risk assessment, treatment and the SoA
Typical duration: 3 to 6 weeks for a first assessment, most of it spent in workshops with the people who own the risks rather than in a spreadsheet.
Clause 6.1.2 requires risk criteria — including acceptance criteria — before you assess anything, and requires the process to produce consistent, valid and comparable results when it is repeated. Clause 6.1.3 then requires you to select treatment options, determine all controls necessary to implement them, and only then compare that set against Annex A to verify that no necessary control was omitted. The SoA is the record of that comparison. It is an output.
The failure mode is universal and easy to spot: a team downloads a 93-line SoA template, marks most controls applicable, and then writes risks backwards to justify what they have already decided. The tell at Stage 2 is that no line in the SoA traces to a line in the risk register, and the auditor only has to pull one thread.
This phase has its own full treatment: see ISO 27001 risk assessment and the Statement of Applicability for the clause-by-clause requirements, the column structure of a defensible SoA, exclusion justifications that pass versus fail, and one risk traced end to end.
Phase 3 — Documentation and control implementation
Typical duration: 6 to 12 weeks, running in parallel. Documentation is the part clients fear and the part that matters least; implementation is the reverse.
ISO/IEC 27001:2022 requires fifteen items of documented information. Not fifty, not a 200-page manual, and not a procedure for each of the 93 Annex A controls. Our mandatory documents checklist lists all fifteen with the clause reference, the owner and what a Stage 2 auditor asks to see for each.
Implementation is where the elapsed time actually goes. Rolling out multi-factor authentication, cleaning up a decade of access rights, closing off local administrator accounts, getting logging into a place someone reviews, running the first phishing simulation, and getting suppliers to sign revised security schedules are not documentation tasks. They involve other people’s calendars, and they are the reason six-month projects become nine-month projects.
| Work type | Elapsed time driver | Can it be compressed? |
|---|---|---|
| Policies, procedures, registers | Author availability and review cycles. | Yes — substantially, with an experienced facilitator and disciplined review deadlines. |
| Technical controls in systems you own | Change windows, testing, and user disruption. | Partly. Change freezes and client release calendars set a floor. |
| Controls that depend on third parties | Supplier legal review, contract renewal dates, cloud provider configuration. | Rarely. Start these in week one; they are the classic critical path. |
| Awareness and competence (clause 7.2, 7.3) | Headcount, shift patterns, and how often you can take agents off the floor. | Partly, with e-learning — but records of competence, not attendance, are what clause 7.2 requires. |
| Operating records (clause 9.1) | Calendar time. Nothing else. | No. This is the hard floor under every ISO 27001 timeline. |
Phase 4 — Operating the ISMS (the phase everyone tries to skip)
Typical duration: 2 to 3 months minimum in Sterling projects, and this is the phase that clients ask us to delete from the plan.
Be precise about what the requirement is, because there is a lot of confident misinformation on this point. ISO/IEC 27001:2022 does not state a minimum period for which the ISMS must have operated before certification. There is no clause that says three months. What the standard does require is evidence: clause 9.1 requires monitoring and measurement results with the methods defined before the numbers were produced; clause 9.2.2 requires a completed internal audit programme and its results; clause 9.3.3 requires the documented results of management review. A Stage 2 auditor samples records. If the records span two weeks, the sample is two weeks, and the finding writes itself.
Certification bodies apply their own expectations on top of this, and those expectations vary. That is a certification body policy question, not a requirement of the standard, and you should ask your chosen body directly during quotation rather than assume. Anyone who tells you the standard mandates a fixed operating period is reciting folklore.
What has to be genuinely running by the end of this phase:
- Monitoring and measurement producing at least two cycles of actual results, with the analysis and evaluation clause 9.1 requires.
- The risk treatment plan progressing, with evidence of progress rather than a plan with all dates in the future.
- Incident management having handled something — even a minor incident, closed properly, beats a pristine empty register.
- Access reviews, backup restoration tests, supplier reviews and change approvals actually performed at the frequency your own documents promise.
- Awareness delivered and competence evidenced for people in security-affecting roles.
Phase 5 — Internal audit and management review
Typical duration: 3 to 5 weeks including corrective action on what the internal audit finds.
Both are mandatory before Stage 2 and both are non-negotiable. The internal audit must cover the ISMS scope, be conducted by someone independent of the area audited, and produce findings that were acted on. The management review must be held by top management and must cover every input clause 9.3.2 lists — including the status of actions from previous reviews, changes in external and internal issues, performance feedback, results of risk assessment and risk treatment plan status, and opportunities for continual improvement — and must produce decisions.
Two patterns fail here with tiresome regularity. The first is an internal audit report with zero findings, which tells an experienced auditor that the internal audit was not real. The second is management review minutes that record attendance and a slide deck but no decision. Clause 9.3.3 requires the results of the review; a meeting that decided nothing produced no results.
Full detail is on our page covering the ISO 27001 internal audit and management review, including the agenda structure that maps one-to-one onto clause 9.3.2.
The Stage 1 audit: what it is and what it is not
Typical duration: 1 day for a small scope, 2 days for a larger one, on site or remote depending on the certification body’s policy and the scope.
Under ISO/IEC 17021-1:2015 the Stage 1 audit exists to evaluate your documented information, understand your site-specific conditions, review your scope and how the ISMS is designed, discuss whether the internal audit and management review have been planned and performed, evaluate the statutory and regulatory context you operate in, and confirm that resources are allocated for Stage 2 and that Stage 2 can be sensibly planned.
What Stage 1 is not: a gap assessment you outsource to your certification body, a consulting engagement, or a formality. Stage 1 findings are raised as areas of concern that must be resolved before Stage 2, and a certification body that finds your ISMS is not ready will say so and reschedule. That is the system working, not a failure of service.
| Stage 1 asks | You pass by showing | You fail by |
|---|---|---|
| Is the scope defensible? | A scope statement whose interfaces and dependencies match how the business actually runs. | Excluding something the auditor can see is inside the boundary. |
| Does the documented information exist? | The fifteen mandatory items, present and approved. | Draft documents with no approval date, or a document list that does not match the documents. |
| Has the ISMS been designed against your risks? | A risk register with owners, and an SoA whose justifications reference real risks. | A template SoA with every control marked applicable and no justification text. |
| Have 9.2 and 9.3 happened? | A completed internal audit report and management review minutes with decisions. | Both scheduled for next month. This alone will move your Stage 2. |
| Can Stage 2 be planned? | Site list, headcount in scope, shift coverage, system inventory, availability of the people who will be interviewed. | Key personnel on leave, or a site the auditor was not told about. |
Between Stage 1 and Stage 2
ISO/IEC 17021-1:2015 requires the interval between the two stages to be determined with the client’s needs in mind and to allow enough time to resolve the areas of concern Stage 1 raised. It also requires the certification body to consider whether the Stage 1 results still hold if a significant period passes — if too long elapses, part or all of Stage 1 may have to be repeated.
In practice this window is 2 to 8 weeks. Use it to close the areas of concern properly, not to write new documents that have no operating history. Adding an untested procedure two weeks before Stage 2 creates an obligation you cannot yet evidence, which is a strictly worse position than not having written it.
The Stage 2 audit: how an auditor actually spends the days
Typical duration: 2 to 6 days on site for most Philippine organisations, with the number derived from the effective number of personnel in scope. Under ISO/IEC 27006-1:2024 audit time is calculated from that base and adjusted for factors including the number of sites, the complexity of the information systems, the regulatory context and the extent of outsourcing. Your certification body will show you the calculation; ask for it.
Stage 2 evaluates implementation and effectiveness. The auditor is not reading your policies again — that was Stage 1. They are testing whether what the policies claim is what happens, by sampling records and interviewing the people who generate them.
| Typically | What is examined | What is being tested |
|---|---|---|
| Opening meeting | Scope confirmation, audit plan, logistics, safety. | Whether the scope you signed up for is still the scope. |
| Top management interview | Clause 5 leadership, policy, objectives, resourcing, and the management review decisions. | Whether leadership can describe the ISMS without reading from a document someone else wrote. |
| Performance evaluation | Clause 9.1 monitoring results, internal audit programme and reports, management review inputs and outputs. | Whether the ISMS is measured, audited and reviewed — or merely documented. |
| Risk and SoA trace | The risk register, treatment plan, residual risk acceptance and the SoA. | Whether each control in the SoA traces to a risk, and each risk to a named owner who approved the treatment. |
| Control sampling | Access reviews, joiner-mover-leaver records, backup restore tests, change approvals, logging and monitoring, supplier reviews, physical entry records, incident tickets. | Whether controls operated at the frequency your own documents promise, across the whole sample period. |
| Staff interviews | Awareness, competence, and what people do in practice. | Whether the ISMS reaches the floor. Agents who have never heard of the incident process is a finding about the process, not about the agents. |
| Closing meeting | Findings presented and classified, with the auditor’s recommendation. | Nothing — but this is where you clarify a finding you believe is wrong. Do it here, courteously, with evidence. |
Major and minor nonconformities, and what each costs you
The classification matters more than the count. Five minors is an ordinary result. One major moves your certificate date.
| Classification | What it means in practice | Effect on the date |
|---|---|---|
| Major nonconformity | A requirement of the standard is not addressed at all, a whole process is absent, or the failure is systemic enough to raise doubt that the ISMS can achieve its intended outcomes. No internal audit, no management review, an SoA with no justifications, or a control claimed as implemented that demonstrably is not. | Certification cannot be recommended until it is corrected and the correction is verified. Verification often requires a follow-up or special audit, which is chargeable and has to be scheduled. Expect 4 to 12 weeks. |
| Minor nonconformity | A single lapse against a requirement that does not raise doubt about the system as a whole: one access review missed in the sample, one supplier not reviewed on time, a record with the wrong retention date. | Usually closed on documented evidence of correction, root cause and corrective action within the period the certification body sets, then verified — often at the next audit. Normally does not delay certification. |
| Opportunity for improvement | Not a nonconformity. An observation the auditor thinks is worth your attention. | None. But recurring OFIs that are ignored have a way of becoming minors at the next surveillance. |
Certification bodies set the response period for nonconformities within the framework of ISO/IEC 17021-1:2015 — it is a policy of the body, not a fixed number in the standard, and it will be in your contract. Read it before Stage 2 rather than after.
What actually determines how badly a major hurts is the root cause analysis you submit. A correction that fixes the sampled instance and nothing else invites the auditor to find the same failure elsewhere. Address the cause, show the systemic fix, and evidence that it operated.
After the certificate: the three-year cycle
An accredited ISO/IEC 27001 certificate is valid for three years and is maintained by surveillance audits, not by filing it. Under ISO/IEC 17021-1:2015 the first surveillance audit following initial certification must be conducted within twelve months of the certification decision date — not twelve months from the audit, and not twelve months from the certificate print date. Diarise the decision date.
| Event | When | What it covers |
|---|---|---|
| Certification decision | Typically 2–6 weeks after a clean Stage 2. | Independent review of the audit evidence and the team’s recommendation. Starts the three-year clock. |
| Surveillance audit 1 | Within 12 months of the certification decision date. | A subset of the ISMS: internal audit, management review, complaints, changes, progress on findings, and a sample of controls. Shorter than Stage 2. |
| Surveillance audit 2 | Year 2. | A different subset, chosen so that the whole ISMS is covered across the cycle. |
| Recertification audit | Before the certificate expires, allowing time for any nonconformities to be closed. | The whole ISMS again, plus the effectiveness of the system over the full cycle. Leaving this to the last month is how organisations end up with a gap in certification. |
Realistic elapsed timelines, by organisation
These are Sterling project ranges from Philippine implementations, not a claim from any standard. They assume a project sponsor who attends, a nominated ISMS manager with real time allocated, and no change freeze in the middle.
| Organisation | Kickoff to Stage 2 | What sets the pace |
|---|---|---|
| Startup or small SaaS, 10–50 people, single site, cloud-only | 4–6 months | Short decision chains and a small system estate. The floor is the operating window, not the work. |
| BPO delivery centre, 100–500 seats, one or two sites | 6–9 months | Client security schedules, shift coverage for awareness and interviews, physical security controls, and joiner-mover-leaver volume at high attrition. |
| Financial services or fintech, regulated | 7–12 months | Regulatory requirements layered on top, change control on production systems, and third-party and outsourcing governance. |
| Manufacturer or enterprise with legacy IT | 9–15 months | Technical remediation on systems nobody wants to touch, and access rights accumulated over a decade. |
| Multi-site group, several legal entities | 10–18 months | Scope architecture, whether multi-site sampling is available, and the slowest entity. A group moves at the pace of its worst site. |
On multi-site: sampling may be available, but eligibility and sample size are determined by the certification body under IAF MD 1 and the ISMS scheme requirements in ISO/IEC 27006-1:2024. Do not build a plan that assumes one site covers ten until your certification body has confirmed it in writing.
Budget runs on the same axis as time. Our ISO 27001 certification cost breakdown for the Philippines sets out the consulting corridor, certification body audit fees and the internal cost organisations routinely forget to count.
What genuinely compresses the timeline — and what does not
| Lever | Real effect | Verdict |
|---|---|---|
| Start supplier and contract work in week one | Removes the most common critical path. Legal review of security schedules routinely takes longer than the entire documentation phase. | Works. Do this first. |
| Run implementation and documentation in parallel | Saves 4–8 weeks. The controls need to be operating anyway; writing the procedure after the control is running produces a better procedure. | Works. |
| Narrow the initial scope honestly | A defensible single-site, single-service scope certifies months earlier than an all-operations scope, and can be extended at surveillance. | Works — if the interfaces are stated honestly. |
| Appoint an ISMS manager with allocated time | The single strongest predictor of on-time certification in our project history. A part-time owner with a full-time day job produces a part-time ISMS. | Works. |
| Buy a documentation toolkit | Saves days of typing and creates weeks of rework, because the documents describe a business that is not yours and the auditor samples against them. | Net negative in most projects. |
| Book the certification body earlier | Does nothing to the constraint. The auditor still samples the records that exist on the day. | No effect. Book realistically instead. |
| Skip or shorten the operating window | Guarantees findings against clauses 9.1, 9.2 and 9.3, which are the clauses most likely to be classified major. | Costs more time than it saves. |
| Buy a certificate from an unaccredited body | Fast, cheap, and worthless the first time a client checks the accreditation mark against a live directory. | Do not. See our page on how to verify a certificate. |
Philippine scheduling realities
Timelines built without these slip, and they slip in ways that are entirely predictable.
| Factor | Effect on the plan |
|---|---|
| Typhoon season, roughly June to November | On-site audits get cancelled and rescheduled, sometimes at a day’s notice, and rescheduling depends on auditor availability rather than yours. Build float into any Stage 2 booked in this window, and confirm your certification body’s remote-audit policy in advance. |
| Holiday clustering | Late December through early January, and Holy Week, remove usable weeks from both your project and your certification body’s audit calendar. Regular and special non-working days are proclaimed annually, so check the current proclamation rather than assuming last year’s dates. |
| BPO attrition and shift patterns | Awareness coverage and competence records are moving targets at 40 per cent-plus annual attrition. Interviews have to be arranged across shifts, and the auditor will ask for night shift as readily as day shift. |
| Data Privacy Act obligations | Registration with the National Privacy Commission where required, the DPO appointment, privacy manual, breach notification and records of processing sit alongside the ISMS and are audited by a different authority. Certification does not discharge them, and they are not among the fifteen mandatory ISO 27001 documents. |
| Client-mandated security schedules | Offshore clients frequently impose controls beyond Annex A. These belong in the risk assessment and the SoA from the start; discovering them at Stage 2 because nobody read the master services agreement is a self-inflicted delay. |
| Grid and connectivity instability | Availability controls, UPS and generator testing, and backup connectivity are not theoretical here. Test records — not equipment invoices — are what the auditor samples. |
Sterling Academy · e-learning for your people
Training that stands up in your ISO 27001 audit
Sterling consulting clients benefit from preferential course access and special pricing on Sterling Academy through their Sterling consultant, including complimentary ISO 27001 awareness training for your people as part of your engagement. Your consultant sets up your client administrator, you add your people, and every learner who completes a course and its final exam receives a numbered Certificate of Completion, verifiable online.
Completion records and certificates are your evidence for ISO/IEC 27001:2022 clauses 7.2 (competence) and 7.3 (awareness) and for Annex A control 6.3, information security awareness, education and training — the items a certification auditor tests by interviewing your staff.
Courses for an information security management system
End to end with Sterling: your ISO 27001 engagement includes
- Implementation consulting through Design™ (guided) or Drive™ (fully managed), up to the certification audit
- Sterling Academy e-learning for your people: preferential course access and special pricing, with complimentary ISO 27001 awareness training
- Live internal auditor training for your audit team
- Effivity ISMS software subscription
- Vulnerability assessment by Cyber Vantage 360
- Sustain™ post-certification support: internal audits, management reviews and surveillance preparation
List price from US$19 per learner per course (51–200 learners) · 12 months’ access · final exam included
Contact usSee the course on Sterling AcademyWatch the sample video →
Certificate of Completion issued after the final exam, numbered and verifiable online · Sterling consultant, client administrator and learner roles as on Sterling Academy
Certification process and timeline: frequently asked questions
1. How long does ISO 27001 certification take in the Philippines?
Six to twelve months of elapsed time is the realistic range for a first certificate in most Philippine organisations. A small cloud-native company with a single site and an engaged sponsor can reach Stage 2 in four to six months. A multi-site group with several legal entities and legacy systems takes ten to eighteen. The constraint is rarely the documentation; it is the operating history that clauses 9.1, 9.2 and 9.3 require before an auditor has anything to sample.
2. Does ISO 27001 require the ISMS to run for three months before certification?
No. ISO/IEC 27001:2022 sets no minimum operating period, and any clause reference offered for one does not exist. What the standard requires is evidence: monitoring and measurement results under clause 9.1, a completed internal audit under 9.2, and documented management review results under 9.3.3. In practice that takes two to three months to generate honestly. Certification bodies may also apply their own expectations, which is a policy of the body rather than a requirement of the standard — ask yours during quotation.
3. What is the difference between a Stage 1 and a Stage 2 audit?
Stage 1 tests design and readiness: your documented information, your scope, the site-specific conditions, your statutory and regulatory context, and whether internal audit and management review have been planned and performed. Stage 2 tests implementation and effectiveness by sampling records and interviewing staff. They are separate audits under ISO/IEC 17021-1:2015 with separate purposes, and Stage 1 findings must be resolved before Stage 2 proceeds.
4. Can Stage 1 and Stage 2 be done in the same week?
It is a bad idea and most accredited bodies will resist it. ISO/IEC 17021-1:2015 requires the interval between the stages to allow time to resolve the areas of concern Stage 1 raises. Compressing them into one visit means any Stage 1 concern becomes a Stage 2 nonconformity, because there was no window in which to fix it. The two to eight week gap is the cheapest insurance in the project.
5. What happens if we get a major nonconformity at Stage 2?
Certification cannot be recommended until the major is corrected and the correction verified, which frequently requires a chargeable follow-up audit that has to be scheduled around auditor availability. Realistically this adds four to twelve weeks. Minor nonconformities are normally closed on documented evidence of correction, root cause and corrective action within the period your certification body sets, and usually do not delay the certificate.
6. How long is an ISO 27001 certificate valid?
Three years, maintained by surveillance audits. Under ISO/IEC 17021-1:2015 the first surveillance audit after initial certification must be conducted within twelve months of the certification decision date — not twelve months from the audit date or the certificate print date. A recertification audit is required before expiry, and it should be booked early enough that any nonconformity can be closed before the certificate lapses.
7. How many days will the certification body spend on site?
Two to six days at Stage 2 for most Philippine organisations. Under ISO/IEC 27006-1:2024 the audit time is derived from the effective number of personnel within the ISMS scope and then adjusted for factors including the number of sites, the complexity of the information systems, the regulatory environment and the extent of outsourcing. Ask your certification body to show you the calculation behind the quotation; a body that will not is telling you something.
8. Do we need an internal audit before Stage 2, even for a brand new ISMS?
Yes, and there is no exemption for a first certification. Clause 9.2 requires internal audits at planned intervals, conducted by auditors independent of the area being audited, with results reported to relevant management. Arriving at Stage 2 without one is a major nonconformity against a clause, not an administrative oversight, and it is one of the most common causes of a delayed certificate in this market.
9. Can we certify one site or one service rather than the whole company?
Yes. Clause 4.3 lets you determine the boundaries and applicability of the ISMS, provided you state the interfaces and dependencies with everything outside the boundary honestly. A narrow, defensible scope certifies months earlier and can be extended at a surveillance audit. What fails is excluding something the auditor encounters anyway — a shared domain, a shared administrator, a shared network — because that is a scope that does not describe the business.
10. When should we engage a consultant, and when the certification body?
Engage the consultant at the start, because scope and risk decisions made in week two determine the cost of everything after. Approach certification bodies for quotations once the scope and headcount in scope are stable, usually around the end of the documentation phase, and book Stage 1 when internal audit and management review are scheduled with confidence. Under ISO/IEC 17021-1:2015 a certification body may not provide management system consultancy to an organisation it certifies, so these are necessarily two different suppliers.
Get a timeline built on your gap assessment, not a template
Sterling plans backwards from the date you need the certificate and tells you plainly whether it is achievable — including when it is not. We have run this process across Philippine BPOs, fintechs, manufacturers and shared service centres, and the first thing we will do is find the critical path you have not noticed yet.
Talk to a Sterling ISO 27001 consultant
11. Is training included with Sterling’s ISO 27001 consulting?
Every Sterling engagement includes live internal auditor training for your audit team and preferential access to Sterling Academy, with complimentary ISO 27001 awareness training for your people as part of the engagement. Special pricing applies to the wider catalogue — Information Security Essentials, 93 Annex A Controls (ISO/IEC 27002:2022) and Risk Management — through your Sterling consultant. Learners who complete a course and its final exam receive a numbered Certificate of Completion, verifiable online, and the completion records serve as evidence for clauses 7.2 and 7.3 and Annex A control 6.3.
Where to go next
- ISO 27001 certification in the Philippines — the complete guide: clauses, controls, process and cost.
- What ISO 27001 certification costs in the Philippines — consulting, audit fees and the internal cost nobody budgets.
- Risk assessment and the Statement of Applicability — phase 2 in full, with one risk traced end to end.
- The 15 mandatory documents — what phase 3 actually has to produce.
- Internal audit and management review — phase 5, and the two clauses most likely to delay you.
- All 93 Annex A controls — with the evidence a Stage 2 auditor asks for.
- ISO 27001 vs ISO 27002 — requirements against guidance, and why only one of them certifies.
- ISO 27001 for fintech in the Philippines — BSP, NPC and SEC supervision, cloud scoping and the diligence pack banks ask for.
Written and maintained by the ISO 27001 practice at Sterling International Consulting, Philippines. All clause and control references are to ISO/IEC 27001:2022 including Amendment 1:2024. Last updated: 1 August 2026.