When a Nigerian bank asked us to take them to ISO 27001, the previous estimate was 24 months. We signed for 14 and delivered in 11 — by removing three delays, not by working miracles.
Evidence as a by-product, not a project
The month before an audit is traditionally a scramble of screenshot archaeology. Wire each control to produce its own evidence continuously and the audit becomes an export.
This is also why the certificate survives surveillance audits without the annual panic.
Scope discipline
The single biggest schedule killer in certification is scope creep dressed as thoroughness. A tight, defensible scope statement cuts the control population without weakening the story the certificate tells regulators.
Detection you can measure beats detection you can only describe.
What it means for your next decision
Read against NDPR, the practical takeaway is simple: the operators who win here are the ones who measure a 6-month evidence window before they commit capital, not after. Greyfusion publishes the assumptions behind these numbers because confident analysis survives scrutiny.
If this maps to something you're planning, the IT & Security desk answers with a working model, not a brochure — talk to us before the decision, not after.
Talk to the team behind this.
Route your enquiry directly to the it desk.