Certified ISO 27001 Lead Auditor maps your current state against all 93 Annex A controls and hands you a prioritized path to certification.
Provided by STEPHEN W., Technical Project Manager — GRC & vCISO — SOC 2 Type II, ISO 27001, NIST CSF/800-53/800-171, CMMC, FedRAMP, HIPAA, PCI DSS, GDPR
WHO THIS IS FOR Organizations pursuing ISO 27001:2022 certification for the first time, or maintaining an existing ISMS and preparing for a surveillance or recertification audit. WHAT YOU GET 1.
Scoping and ISMS boundary definition Clear determination of what's in scope — systems, locations, business units, and interested parties — documented so your certification body doesn't challenge it later. 2. Full control gap assessment Assessment against all 93 Annex A controls plus Clauses 4–10 of the standard.
Each control is rated Implemented, Partially Implemented, or Not Implemented, with the specific evidence gap identified. 3. Statement of Applicability (SoA) draft A working SoA with inclusion/exclusion justifications ready for your certification body. 4.
Risk register Identified risks with scoring, treatment decisions, and owners assigned. 5. Prioritized remediation roadmap Sequenced by certification blocker vs. nice-to-have, with realistic effort estimates so you know what has to happen before Stage 1 and what can wait. 6.
Executive summary deck Certification readiness posture, timeline, and resource requirements in language your leadership will act on.
METHODOLOGY Document review, stakeholder interviews, control walkthroughs, and evidence sampling — the same approach a certification body uses at Stage 1, so there are no surprises when the real auditor arrives. TIMELINE Standard engagement is 3–4 weeks. Kickoff within 5 business days of scope agreement.
CREDENTIALS ISO 27001 Certified Lead Auditor. CISM. PMP. 25 years of security governance and risk work across federal agencies, healthcare, payments, banking, and critical infrastructure.
ALSO AVAILABLE Policy and ISMS documentation build-out, internal audit execution, Stage 1/Stage 2 audit support, and fractional CISO retainer for ongoing ISMS ownership.
COPE INCLUDED AT THIS PRICE - Up to 200 employees - Single legal entity - Up to 2 physical or remote-work locations - Up to 2 production environments (e.g., one cloud provider plus corporate IT) - Up to 12 stakeholder interviews - ISO/IEC 27001:2022 — all 93 Annex A controls plus Clauses 4–10 DELIVERABLES 1.
ISMS scope and boundary definition 2. Control-by-control gap assessment: all 93 Annex A controls rated Implemented / Partially Implemented / Not Implemented, each with the specific evidence gap identified 3. Clause 4–10 management system assessment 4. Draft Statement of Applicabilit
Heelr is the cybersecurity services marketplace by Cyberr. Buyers scope work, compare verified providers and pay through protected payments.