Compliance effort estimator

What actually drives certification effort

Organisations budget certification by headcount, which is the weakest predictor available. Two companies of two hundred people can differ by a factor of four in effort, and the difference has almost nothing to do with size.

The strongest driver is how much is already written down. An organisation with documented processes, even imperfect ones, is doing a mapping exercise. An organisation with everything in people's heads is doing an authoring exercise, and authoring is an order of magnitude slower because it requires decisions rather than transcription.

The second driver is estate complexity, specifically how many distinct environments hold in-scope data. Three cloud accounts, an on-premise remnant and a SaaS estate is not three times the work of one environment; it is closer to five times, because each boundary needs its own evidence and each interface needs its own justification.

The third is whether the certification is a first or a recertification. A first certification carries the whole cost of building the management system. A recertification carries the cost of proving it kept operating, which is materially less if evidence was collected continuously and materially more if it was not.

Where estimates go wrong

Almost every underestimate we see comes from the same three places.

Evidence with a time dimension. Quarterly reviews, scan cycles and log review records cannot be produced retrospectively. If your audit date is nine months out and you start collecting in month six, you will arrive with one cycle where the auditor expects three. This alone has moved more certification dates than any technical gap.

Remediation effort counted as zero. The gap assessment finds things. Fixing them is work, it lands on teams who did not plan for it, and it competes with product delivery. A realistic estimate carries a remediation allowance even before you know what will be found.

Internal coordination. Certification cuts across departments, and the calendar cost of getting decisions from people whose main job is something else is consistently underestimated. This is the largest single line in most programmes and it never appears in a vendor quote, because it is your time rather than theirs.

How to read the number this gives you

The output is person days across your organisation, not consultant days. That distinction matters, because the consultant portion is usually a minority of the total and is the only part with a price attached, which is why quotes look small against the real cost.

Treat it as a range rather than a figure. Anything inside plus or minus thirty per cent of the estimate is the same answer for planning purposes, and precision beyond that is false.

If the number is larger than you expected, the useful response is not to compress the timeline. It is to reduce scope. A certification covering the systems that genuinely need it, achieved on time, is worth more than a broader scope achieved late or achieved on paper.

What to do next with the estimate

Convert it into a calendar before you convert it into a budget. Effort tells you how much work exists; the calendar tells you whether the date is possible. Start the time-dimensioned evidence immediately regardless of when the rest begins.

Then identify who owns each block of effort. Effort with no owner is effort that will not happen, and the commonest failure in certification programmes is not lack of budget but lack of a named person outside the security team.

If you want the estimate checked against your actual estate, a scoping call takes thirty minutes and will usually change the number in one direction or the other. We have talked organisations out of certification scope more often than into it.