Two numbers circulate about ISO 27001 timelines: "six to twelve months" (the consulting era) and "30 days" (vendor marketing). The truth for a startup using automation sits between them, and it's worth understanding what actually consumes the days.
The realistic arc: 4–8 weeks to Stage 1 readiness
Week 1, scope and connect
Connect your cloud, directory, and dev tools, import your team, and answer plain-language questions about the business. The AI scopes your ISMS and drafts the document set from this. What used to be a discovery phase measured in workshops happens in an afternoon.
Weeks 2–3, review what was built
Policies, risk register, and Statement of Applicability arrive drafted; your job is review and decision. This is real work that deserves real attention, the auditor will interview you against these documents. Expect a handful of decisions only you can make: risk appetite, acceptable use, incident severity.
Weeks 3–6, close the gaps
The task list of what your company genuinely lacks: perhaps 2FA enforcement gaps, missing supplier DPAs, an untested backup restore. Most startups clear it alongside normal work, this stage, not paperwork, is where the calendar time goes.
Weeks 4–8, the operating rhythm
Two things must happen before Stage 2: an internal audit and a management review. Schedule them the moment your documents stabilise. Meanwhile, security training completes and evidence accumulates automatically.
The two things that actually set your date
- Certification body lead time. Bodies book Stage 1 audits weeks ahead, engage them in week two, not week eight. This, not preparation, is the most common bottleneck.
- Decision latency. The AI can draft in seconds; it can't make your CTO review the access-control policy. Teams that batch review sessions twice a week finish in half the elapsed time of teams that let drafts sit.
Preparation is now the fast part. The critical path runs through your calendar and the auditor's.
After Stage 2
Pass and you're certified for three years with annual surveillance audits. Because evidence collection never stopped, surveillance prep is reading a dashboard, not a scramble. The full cost picture is in our cost breakdown.