Governance. Risk. Compliance. Cybersecurity.
MAST Consulting Group - Governance, Risk, Compliance and Cybersecurity Logo
Timeline

Timeline — Integrated Management System (IMS)

A realistic week-by-week view of how Integrated Management System (IMS) runs. Timelines compress for smaller scopes and extend for multi-entity or multi-site programmes; this baseline assumes a mid-size enterprise.

  • ISO/IEC 27001 Certified
  • ISO/IEC 27701 Certified
  • ISO 9001 Certified

Delivered by an ISO/IEC 27001, 27701 & 9001 certified organisation

Week-by-week plan

WeekPhaseKey activitiesOutput
Weeks 1–2Standards MappingMap clauses and controls across ISO 27001, 9001, 14001, 45001, 27701, 22301, 20000-1 and 42001 into a single normalised matrix.Signed-off standards mapping pack and gate review
Weeks 3–4Integrated DesignOne policy suite, one risk methodology, one Statement of Applicability and one document control framework spanning every standard in scope.Signed-off integrated design pack and gate review
Weeks 5–6Unified ImplementationShared controls, training, supplier assurance, incident and change processes deployed once across the organisation.Signed-off unified implementation pack and gate review
Weeks 7–8Combined Internal AuditOne internal audit programme and one management review covering all standards in a single cycle.Signed-off combined internal audit pack and gate review
Weeks 9–10Joint CertificationCoordinated Stage 1 + Stage 2 with an accredited body that audits all schemes in one engagement.Signed-off joint certification pack and gate review
Weeks 11–12Continuous ImprovementSingle corrective-action, KPI and surveillance-audit calendar — sustainable beyond first certification.Signed-off continuous improvement pack and gate review
12-week delivery plan

Gantt-style timeline titled "12-week delivery plan" over 12 Weeks with 6 phases: Standards Mapping from Week 1 to 2; Integrated Design from Week 3 to 4; Unified Implementation from Week 5 to 6; Combined Internal Audit from Week 7 to 8; Joint Certification from Week 9 to 10; Continuous Improvement from Week 11 to 12.

Standards Mapping
Signed-off standards mapping pack and gate review
Integrated Design
Signed-off integrated design pack and gate review
Unified Implementation
Signed-off unified implementation pack and gate review
Combined Internal Audit
Signed-off combined internal audit pack and gate review
Joint Certification
Signed-off joint certification pack and gate review
Continuous Improvement
Signed-off continuous improvement pack and gate review

What accelerates the timeline

  • Executive sponsor engaged from day one with weekly steering attendance.
  • Existing asset inventory, network diagrams and HR org chart available.
  • GRC tooling already deployed or selected (Vanta, Drata, Archer, ServiceNow).
  • Workforce available for awareness training within the engagement window.
Conditions that compress delivery

Checklist titled "Conditions that compress delivery" with 4 items, every item marked complete: Executive sponsor engaged from day one with weekly steering attendance.; Existing asset inventory, network diagrams and HR org chart available.; GRC tooling already deployed or selected (Vanta, Drata, Archer, ServiceNow).; Workforce available for awareness training within the engagement window..

  • Executive sponsor engaged from day one with weekly steering attendance.
  • Existing asset inventory, network diagrams and HR org chart available.
  • GRC tooling already deployed or selected (Vanta, Drata, Archer, ServiceNow).
  • Workforce available for awareness training within the engagement window.

What typically extends it

  • Multiple legal entities, brands or geographies in scope.
  • Significant cloud migration running in parallel.
  • Open audit findings or regulator enforcement requiring remediation first.
  • Mergers, divestitures or system replacements mid-engagement.
Next: Pricing & Engagement