Getting ISO 27001 certified sounds daunting, but for a 50-person company it usually comes down to three work streams: risk assessment, documented controls and internal audit readiness.
We start with a gap analysis against the 93 Annex A controls, then prioritise the 20–25 controls that actually matter for your risk profile. Tooling (asset inventory, MFA, backup verification) covers a large share of the evidence automatically.
The biggest time sink is not the controls — it is interviews and policy sign-off. Plan two rounds of management review and keep documents short. Six months is achievable for a focused team of three.