Realistic timelines for every major framework by company size, readiness level, and audit type.
The most common question we hear from founders is: how long will this take? The honest answer is: it depends. But it depends on specific, knowable factors, your current security posture, your company size, the framework, and the audit type. This whitepaper gives you realistic timelines for the frameworks we most commonly deliver.
The biggest driver of timeline variation is your starting point. A company with no existing security programme, no documented policies, and no security tooling will take significantly longer than a company that already has strong engineering practices, documented processes, and some security controls in place.
Company size matters too, not because larger companies have more to do, but because they have more stakeholders, more complex environments, and slower decision-making. A 10-person startup can move faster than a 500-person enterprise even if the enterprise has better existing controls.
The audit type affects timeline significantly. SOC 2 Type I is faster than Type II (which requires an observation period). ISO 27001 Stage 1 and Stage 2 audits can be combined or separated. Cyber Essentials is faster than Cyber Essentials Plus.
SOC 2 Type I: 2 to 4 months from engagement to report, assuming no major gaps. Companies with significant gaps in access controls, logging, or vendor management should budget 4 to 6 months.
SOC 2 Type II: 9 to 15 months from engagement to report. This includes 1 to 3 months of implementation, a minimum 6-month observation period, and 1 to 2 months for the audit itself. The observation period cannot be shortened.
Companies that have already achieved SOC 2 Type I can move to Type II faster, the implementation work is largely done, and the observation period can begin immediately.
ISO 27001 certification: 9 to 18 months for most companies. Well-prepared companies with existing security programmes can achieve certification in 6 to 9 months. Companies starting from scratch should budget 12 to 18 months.
The certification audit itself (Stage 1 and Stage 2) typically takes 1 to 3 months from when you are ready. Stage 1 is a documentation review; Stage 2 is the on-site or remote assessment.
Annual surveillance audits take 1 to 2 months. Recertification audits (every three years) are comparable to the initial certification.
Cyber Essentials: 2 to 6 weeks from engagement to certificate, assuming remediation is straightforward. Cyber Essentials Plus adds 2 to 4 weeks for the technical assessment.
NHS Digital Readiness Framework: 3 to 6 months depending on the complexity of your product and the number of evidence domains required.
GovAssure: 4 to 8 months for initial assessment, depending on the size and complexity of the organisation.
Netru methodology