For a company of 20 to 50 people with one office and its infrastructure in the cloud, plan for two to three days of auditor fieldwork, spread over one to two weeks. The report takes a few more days; with us it arrives within five business days of the closing meeting.
On your side the time splits like this:
- ISMS owner: present for most of the fieldwork, so roughly two to three days, plus a few hours of preparation.
- Control owners: one interview of 30 to 60 minutes each. Six to ten people is typical, for example the CTO, the IT or DevOps lead, HR, the person responsible for suppliers and one or two engineers.
- Everyone else: a few people may get a short question on the day, such as how they would report a lost laptop.
The time goes up with more people in scope, more than one site, on-premises servers or hardware, or a large number of suppliers handling data. A 150-person company with two offices might need four to six days of fieldwork.
Preparation saves the most time. Documents and system access sent a week ahead often cut a full day from the fieldwork.