How many mandays required for the below mentioned standards

[sms4u]

Hello everyone...

my company is asking me to calculate the mandays for the implementation for below mentioned standards

ISO 27001:2013
ISO 27017 : 2015
ISO 27018
ISO 20000 - 9
PCI - DSS
ISO 22301

Could any help me out to calculate the mandays as an consultant

 

[Jen Kirley]

Hello everyone...

my company is asking me to calculate the mandays for the implementation for below mentioned standards

ISO 27001:2013
ISO 27017 : 2015
ISO 27018
ISO 20000 - 9
PCI - DSS
ISO 22301

Could any help me out to calculate the mandays as an consultant

Goodness.

Time for implementation relies on a number of factors, including but not limited to:

• The size and maturity of the current management system - what is currently in place, and for how long?
• The complexity of the products and/or services provided
• The education level of the organization's members (lower level education often requires more explicit process documentation)
• Interested party expectations for processes and documentation
• The leadership's commitment (less commitment can add time for implementation)
• The consultant's type and extent of education and experience in the industry and specific clientele being served

Therefore, it is impossible to predict the number of mandays to implement a quality management system. The effects of variables are almost infinite. A number of consultants promise implementation in X days, but there is no promise of effectiveness or returned vlue to interested parties, which is the objective of the listed standards.

 

[Richard Regalado]

I second the motion.
Goodness.

The number of man-days will also be dependent on the risks facing the organization.

 

[John Broomfield]

Instead of implementing these standards why not study how your organization already works as a system and probably already conforms with many of the requirements specified by these standards.

Instead, why not budget a week to complete the above study so you can report back on where your organization falls short?

Then you’ll be able to determine the competencies missing from your organization to introduce any needed new controls (to existing processes) or new processes.