---
title: We have a large RFP that requires a PCI (or HIPAA/SOC 1/SOC 2, etc.) audit. What is a reasonable time period to give ourselves and have a successful audit result?
description: "It's an excellent question and the one we get most often. Each of the compliance standards has specific requirements. The SOC 1 requirements are still largely determined by the entity; however, the controls must be comprehensive enough that an independent…"
url: "https://auditliaison.com/news-resources/faq/we-have-a-large-rfp-that-requires-a-pci-or-hipaa-soc-1-soc-2-etc-audit-what-is-a-reasonable-time-period-to-give-ourselves-and-have-a-successful-audit-result/"
updated: "2020-03-25"
category: Frequently Asked Questions
---

# We have a large RFP that requires a PCI (or HIPAA/SOC 1/SOC 2, etc.) audit. What is a reasonable time period to give ourselves and have a successful audit result?

It's an excellent question and the one we get most often. Each of the compliance standards has specific requirements. The SOC 1 requirements are still largely determined by the entity; however, the controls must be comprehensive enough that an independent auditor can positively opine on the overall internal control framework design and effectiveness. You can prepare for a SOC 2 and HIPAA Security Rule audit in approximately the same amount of time as a SOC 1. As a rough estimate, we can generally assist a Company to be ready for the point-in-time audits between 3 to 6 months.

In our experience, PCI and ISO 27001 preparation require additional time than the other standards; however, our team helps companies achieve readiness for PCI, ISO 27001 and ISO 22301 audits in less than a year, as well.