ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
A gap assessment timeline depends far more on access to people and evidence than on the size of the framework you are assessing against. Most delays come from waiting for interviews and documents, not from the analysis itself.
This guide gives typical duration ranges, explains what drives effort up or down, and sets out a phase plan you can adapt. It builds on the scoping, interview and scoring stages of a normal assessment.
There is no fixed answer, and any figure you see quoted is a typical range rather than a rule. A focused assessment of a small organization against one framework can finish in a few weeks. A multi-site organization assessing against several frameworks can take a quarter or more.
Treat the ranges in the table as planning assumptions, check them against the framework you are using (for example the NIST Cybersecurity Framework page for NIST-based work), then adjust after the first week once you know how quickly people respond.
Four things move the schedule most: the scope, the number of people to interview, the quality of existing documentation and the depth of evidence required. A broad scope with many teams multiplies interviews. Thin documentation means more time spent finding out what actually happens.
Depth matters too. A quick self-assessment checks whether controls exist, while an evidence-based review checks whether they operate, and the second takes noticeably longer.
Spend the first week agreeing scope, framework version, sponsor, scoring scale and the list of interviewees. Decisions made here prevent rework later. Write the scope down and get sign-off, since late changes are the most common reason assessments overrun.
Our guide to gap assessment scoping covers what to settle before any interviews begin.
| Organization size | Typical duration | Main driver | Main risk to schedule |
|---|---|---|---|
| Small team, one site | 2 to 4 weeks | Number of systems in scope | Key people unavailable |
| Mid-sized, several teams | 4 to 8 weeks | Interview scheduling | Evidence scattered across tools |
| Large or multi-site | 8 to 16 weeks | Scope agreement and sampling | Late scope changes |
| Regulated, audit-driven | Varies with deadline | Evidence depth | Rework after review |
This is usually the longest phase. Send the evidence request list on day one so owners have time to gather documents, and book interviews early because calendars fill quickly. Hold interviews in short blocks by topic rather than one long session per person.
See evidence for gap assessments and interview technique for what to ask for and how to record it.
Build a buffer of about ten to twenty percent into the plan, because something always moves. Identify the dependencies that can stall everything: a sponsor sign-off on scope, access to a system administrator, or a legal review of interview notes. Put those dates on the plan in bold and confirm them at kickoff. If a dependency slips, tell the sponsor the effect on the end date the same day rather than absorbing the delay silently.
Where the deadline is fixed, such as an external audit date, work backwards from it and trim scope before you trim evidence quality.
Scoring takes less time than gathering, provided your scale is defined in advance. Apply the same rules to every requirement and record the reason for each score in a sentence. If two assessors score independently and compare, allow a few extra days for calibration.
The article on gap assessment scoring explains how to keep ratings consistent.
Reporting needs time for drafting, internal review and a findings walkthrough with owners, so that nobody is surprised by a score. Rank the gaps by risk and effort, and agree owners and dates for the top actions before the meeting ends.
The guides to report structure and prioritization show a format that speeds this phase.
A common pattern for a mid-sized organization is week one for scope and requests, weeks two and three for evidence and interviews, week four for scoring and analysis and week five for the report and walkthrough. Add a buffer week if more than two sites are involved.
Keep the plan visible to everyone involved, because people respond faster when they see the dates that depend on them.
Elapsed time and effort are different. A five-week assessment might need only fifteen to twenty days of assessor effort, with the rest spent waiting for responses. To estimate effort, count the requirements in scope, the interviews needed and the documents to review, then allow time for each. A rough allowance of thirty to sixty minutes per interview topic, plus review time for each document, gives a starting figure you can refine after the first few sessions. Label these numbers as assumptions in your plan so sponsors understand they are estimates.
Also add time for travel or coordination if teams sit in several locations, and for the final review with legal or compliance if they must approve wording.
Most of these causes are visible at kickoff. Ask each owner what could stop them from delivering evidence or attending an interview in the planned week, and record the answers as risks to the schedule with a named person and a fallback date.
Watch for these problems.
Some frameworks need more effort simply because they contain more requirements or require deeper evidence. An assessment against a catalogue of a few dozen controls moves faster than one against hundreds of detailed requirements. Where the framework is prescriptive about documents, expect more time reviewing records. Where it is outcome-based, expect more time in interviews discussing how results are achieved. Either way, list the requirements first and divide them among assessors so work can run in parallel.
Start with a structured workbook so every requirement, question and score has a place, instead of building the format while you work. Reuse answers across frameworks where requirements overlap. Automate evidence collection for things like access lists and patch status.
If you would prefer a finished structure, the Gap Assessment Report and Workbook provides scoring, evidence and reporting fields built for this kind of assessment.
One experienced lead plus a part-time second reviewer is enough for many mid-sized assessments. The lead owns scope, scoring and the report, while the reviewer challenges scores and checks evidence. Avoid spreading the work across many part-time assessors, because calibration then consumes the time you saved. If you use internal staff, protect their time in writing; assessments slip when people treat the work as a spare-hours task.
Where outside help is used, give the consultant a named internal contact who can unblock access within a day.
When you book the next round, keep the same assessors where possible, since they already know the environment and can move quickly.
The first assessment sets the baseline, and the timeline for repeat rounds is usually shorter because scope, contacts and evidence sources are already known. Plan the next round when you finish the first, so it does not slip. The guide to the gap assessment reassessment shows how to compare rounds.
Use a simple tracker with one row per requirement or topic and columns for evidence received, interview held, score drafted and score reviewed. The percentage complete in each column shows where the bottleneck sits. If evidence is at eighty percent but interviews are at thirty, you know to push on calendars rather than documents. Review the tracker twice a week and raise blockers with the sponsor as soon as they appear.
Share the plan with sponsors and owners at kickoff and send short weekly updates: what is done, what is late and what you need. A one-paragraph update keeps attention on the dates and exposes blockers early.
Typically two to four weeks for a small organization and eight weeks or more for larger or multi-site ones, depending on scope and access to people.
Waiting for interviews and evidence. Scope changes after work has started are the second most common cause.
For a narrow scope and a small team, a rapid self-assessment is possible, but it will rely on answers rather than tested evidence.
It can save time where requirements overlap, but plan extra effort for mapping and for keeping scores comparable.
Usually every twelve months, and after major change, with shorter timelines for each repeat.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026