Tools · Smaller checks
Is our Stage 2 date realistic?
Give the totals from your ISO 27001 readiness assessment and the date your certification body has booked. You get the earliest date a Stage 2 audit could pass, the three steps that decide it, and whether your date holds. Free, no account, and nothing you enter leaves this page.
Question 1 of 6
Give totals from your readiness assessment, not rows. The check never asks who owns what or which control is late, and nothing you enter leaves this page.
Your Stage 2 date
Answer the questions and the estimate appears here, with the verdict against your booked date.
- 6 questions, about 5 minutes
- Totals only: no names, owners or controls
- Nothing is stored, not even in your browser: reloading starts again
- If you accepted analytics, we count how far people get through the questions, never what they answer.
How this was calculated, and what it is not
How the estimate is worked out. (a) Remaining work: each owner works through their items below In place one after another, blockers first, then in the standard's order, starting from the as-at date; the last item's date is when the work is done. Items at In place need no more work, only time. (b) IS-05: "The ISMS must run for at least 3 months, producing records, before the Stage 2 audit." — the last blocker's In place date plus 3 months. (c) IS-06: "At least one full internal audit cycle and one management review must be completed before Stage 2." — the later of your planned management review, your planned end of audit fieldwork, and the earliest possible end of the Check phase (the audit programme in place, plus 4 weeks, the Check phase in the ISO 27001 Implementation Methodology & Project Plan). The earliest Stage 2 date is the latest of the three. Weeks are calendar weeks.
The workbook works this out row by row. The check asks only for the totals those rows add up to: the longest owner's queue for (a), the blockers and their longest queue for (b), and the audit programme for (c). Blank dates count as the workbook counts them.
The 8 blockers
Without them a Stage 2 audit cannot pass. Each must be Operating before the Stage 2 date (IS-08: "Every gap must have an owner and a date, sequenced so that blockers close before the Stage 2 date.").
- 4.3 Determining the scope of the information security management system
- 5.2 Policy
- 6.1.2 Information security risk assessment
- 6.1.3 Information security risk treatment
- 6.2 Information security objectives and planning to achieve them
- 9.2.2 Internal audit programme
- 9.3.3 Management review results
- 10.2 Nonconformity and corrective action
| Level | What it means |
|---|---|
| 0 Not started | Nothing exists yet. |
| 1 Planned | Owner and approach agreed; not yet in place. |
| 2 In place | Documented and working, but little or no record yet. |
| 3 Operating | Working, with records covering at least 3 months, and an auditor could sample it. |
What it leaves to the workbook
- Which items, and whose. The workbook names the blocking items and the critical path, the items whose slip would move the date, in the order to work on them. A check that never asks for names cannot.
- The queues themselves. You add up each owner's weeks; the workbook does it from one row per requirement. An owner with two roles, or two people sharing one, changes the longest queue.
- Not your auditor's view. The 3 months of operation and the Check phase are the workbook's defaults. Your certification body may expect more.
The workbook's own limitations
- This is a self-assessment: it is as accurate as the scores and the weeks of work entered. Evidence notes, and a second person checking the scores of the blockers, are the best defence against optimism.
- The estimate assumes each owner works on one item at a time, in the order shown, from the as-at date, and that the dates you entered for the internal audit and management review hold. It does not include the certification body's lead time: book the Stage 1 and Stage 2 dates early.
- A certification body decides on the evidence it samples. Every requirement at Operating makes a pass likely, not certain; a requirement at In place may still pass if it has enough records, and may not.
- It does not judge whether your controls are the right ones for your risks (IS-03): that is the risk assessment and the Statement of Applicability.