I will prepare your company for soc 2 and iso 27001 before the auditor arrives

For ISO 27001, seven to nine months from a standing start to a certificate. For a SOC 2 Type II, eleven to thirteen, because the report covers an observation period that cannot be shortened or backdated. Anyone quoting three months is describing a Type I, which is a different thing.

No, and nobody preparing you can. ISO certification comes from an accredited certification body, a SOC 2 report from a licensed CPA firm, PCI DSS validation from a QSA. I get the estate and the evidence ready for them, and I will help you choose which one to engage.

Often yes, and for a specific reason. Platforms measure configuration well and cannot see whether a control actually operated with someone accountable for it. Readiness percentages go green long before an auditor would agree.

Yes, from how your company actually works. Template packs are recognised instantly by auditors, because the first interview with an engineer contradicts them. Fewer and shorter, describing real practice, is worth more.

Tell me which customer asked and what they wrote. If it is a European tender, usually ISO 27001. If it is US technology procurement, usually SOC 2. If both, there is a sequence that saves about a third of the work and I will lay it out before you commit.