You’re Thinking about two to four months from kickoff to obtaining your Type I report in hand, assuming you’ve already got your controls documented and running. For Style II, tack on A further six to twelve months for that observation period ahead of the auditor even starts off their fieldwork. https://calvant.com/blog/iso-27001-vs-soc-2-comparison-differences-benefits