The duration depends on the size and complexity of the organization. In many cases, a certifiable ISMS can be established within a few months.