You’re Looking at two to 4 months from kickoff to getting your Kind I report in hand, assuming you’ve presently obtained your controls documented and functioning. For Type II, tack on Yet another six to twelve months for the observation period before the auditor even starts off their fieldwork. The https://calvant.com/blog/iso-27001-vs-soc-2-comparison-differences-benefits