You’re Looking at two to 4 months from kickoff to receiving your Kind I report in hand, assuming you’ve currently received your controls documented and running. For Form II, tack on Yet another six to 12 months for that observation time period prior to the auditor even begins their fieldwork. https://calvant.com/blog/iso-27001-vs-soc-2-comparison-differences-benefits