ISO 27001 readiness is often pitched as a 9-to-12-month program. For most modern organizations, that timeline is wrong. It reflects how the program is run, not what the standard actually requires.
We routinely take organizations from gap to readiness in 14 weeks. The compression comes from operating cadence, not from cutting corners. Here is how it works.
Why 14 weeks is achievable
Three things make compression possible. First, modern organizations already operate most of the controls — they just have not connected them to the standard. Second, evidence collection can be automated. Third, the ISMS does not have to be invented from scratch; it can be built on what already exists.
The remaining work is scoping, documenting, and putting the cadence in place. That is a 14-week program when it is run as a program.
Compressing scope without losing rigor
Scope decisions in the first week often determine whether a program runs hot or stalls. We push for a defensible, narrow scope — the systems, processes, and people the certificate needs to cover for the strategic outcome, and nothing more.
Over-scoping is the most common reason ISO programs slip. An auditor will not penalize a narrow scope. They will penalize an unsupportable one. Defensible narrowness is the goal.
The cadence
Weeks 1-2: scoping, statement of applicability, control gap analysis. Weeks 3-6: control design and remediation, with parallel evidence collection. Weeks 7-10: internal audit, management review, and gap closure. Weeks 11-14: pre-audit dry run and certification readiness.
What makes the cadence work is the parallel-evidence track. Evidence is collected as controls go live, not at the end. By week 12 the evidence package is already auditor-ready.
Sustaining the program after certification
The harder problem is what happens after the certificate ships. Most certifications degrade between annual surveillance audits. The cadence falls off. The control owners change roles. The evidence stops being collected.
The sustainable model treats the ISMS as a running system, not a project. Monthly control checks, quarterly management review, continuous evidence collection, and a real internal audit function. The cost of running it sustainably is a fraction of the cost of running it as an annual fire drill.
What good looks like
Good ISO 27001 readiness is invisible to the rest of the business. Engineering keeps shipping. Operations keep running. The ISMS produces evidence as a byproduct of how the organization already operates — not as a separate stream of work.
Once an organization gets to that posture, the next annual audit becomes a routine, not a project. Which is the entire point of certification.