Quick answer: A typical SME can reach ISO 27001 audit-readiness in about eight weeks with Cyber Veda, then complete the certification body's Stage 1 and Stage 2 audits. Larger scopes, multiple sites or little existing documentation take longer.
The week-by-week path
- Week 1: Gap assessment. We profile your organisation, review what evidence already exists and pinpoint the controls that matter most for your target.
- Week 2: Policies. Right-sized policies written for how your business actually runs, then approved by leadership.
- Weeks 3–7: Evidence sprint. We map controls, close gaps and capture evidence with your team: around two hours a week of your time.
- Week 8: Internal audit. An independent audit, run the same way the certification body will, finds anything left before they do.
- Then: Certified. We stand beside you through Stage 1 and Stage 2 with your chosen certification body.
Stage 1 and Stage 2, explained
Stage 1 is the certification body's documentation review: is your ISMS designed correctly and ready to audit? Stage 2 tests whether it actually operates: interviews, evidence sampling and control testing. The gap between them is usually a few weeks, to fix anything Stage 1 raises.
What speeds it up
- A tight, well-reasoned scope
- A named internal owner with a couple of hours a week
- Existing documentation, cloud tooling or a compliance platform like Vanta
- Fast decisions from leadership on risk and policy
What slows it down
- Scope that keeps growing
- Evidence that only exists in people's heads
- Technical remediation that competes with product work
- Booking the certification body late (they are often booked weeks ahead)
Working to a tender deadline?
Tell us the date. We'll work backwards and tell you honestly whether it's achievable. Book a free consultation.