ISO/IEC 27001:2022 + AMD 1:2024 TURNKEY CERTIFICATION PRACTICE

Audit-Ready ISO 27001 Architecture in 8–10 Weeks.

Traditional ISO/IEC 27001:2022 consulting consumes 300+ hours of internal CISO and engineering time drafting policies, risk registers, and network diagrams from scratch. Armura Security combines Lead Auditor forensic verification across all 230 normative controls, a single-tenant encrypted evidence vault, and our Turnkey Remediation Factory to cut internal team effort by 90%.

View Fixed-Fee SOW Packages Inspect Vault Security

230

Clauses 4–10 & Annex A Controls

90%

Reduction in Engineering Time

100%

Stage 1 & Stage 2 Guarantee

ARMURA

SECURITY

ARCHITECTURE & GOVERNANCE

Standard Coverage: ISO/IEC 27001:2022 + Amd 1:2024

Audit Methodology: ISO 19011:2018 & ISO/IEC 17021-1

Client Evidence Portal: Single-Tenant Isolated GCP Vault

Lead Auditor Engineering

We Don't Just Point Out Gaps—We Engineer Your Entire ISMS.

Every control is evaluated and signed off by an experienced Senior Cybersecurity Architect & ISO 27001 Lead Auditor, accelerated by private, air-gapped verification tooling for rapid turnaround and zero oversight gaps.

Decoupled Stage 1 vs. Stage 2 Forensic Audit

We evaluate all 230 requirements across Clauses 4.1–10.2, Amd 1:2024 Climate Change, and Annex A.5–A.8, separating documentary design (Stage 1) from operational evidence and network architecture topology (Stage 2).

5-Workstream Turnkey Remediation Factory

Instead of handing you generic blank templates, we custom-author your missing ISMS policies, 16-column Risk Register (Clause 6.1.2), 230-row Statement of Applicability (Clause 6.1.3 d), and target 4-VLAN HA NGFW diagrams (A8.20/A8.22).

Closed-Loop 100% Verification & CB Defense

Every remediated policy, register, and network diagram undergoes a second closed-loop verification pass to confirm 230/230 conformity prior to external Certification Body Stage 1 and Stage 2 audits.

Transparent Commercial Architecture

Three-Phase ISO/IEC 27001:2022 Engagement Roadmap

Phase 1 • 2 Weeks

SOW 1: Fast-Track Gap Assessment

$12,500 CAD

50% credited to SOW2 if signed within 14 days

• Dedicated single-tenant Client Evidence Portal provisioned in 24 hours
• 230-Control Lead Auditor Forensic Assessment (Clauses 4–10 + Annex A)
• Master Gap Assessment Tracker (.xlsx) with ISO 17021-1 classifications
• Executive Report & SOW2/SOW3 Remediation Roadmap (.pdf/.docx)

Billing: 100% Upfront (or 50% Kickoff / 50% Report Delivery)

Phase 2 • 8–10 Weeks

SOW 2: Turnkey ISMS Remediation

$48,000 CAD

5 Workstreams to 100% Stage 1 & 2 Readiness

• WS1–WS2: Quick-win closure & custom authoring of all missing Policies
• WS3: 16-column Risk Register (6.1.2) & 230-row SoA (6.1.3 d)
• WS4: Target 4-VLAN HA NGFW Architecture Diagrams (A8.20/A8.22)
• WS5: Independent Clause 9.2 Internal Audit & Stage 2 Readiness Binder

Billing: 40% Kickoff / 30% WS3 Delivery / 30% WS5 Mock Audit

Phase 3 • 12 Months

SOW 3: Managed ISMS Retainer

$31,200 CAD/yr

Billed Quarterly ($7,800 CAD / qtr)

• Module A (Q1–Q4): Quarterly 90-day IAM access reviews, Risk Register updates, & Clause 9.1 KPIs
• Module B (Q3): Annual Independent Clause 9.2 Internal Audit Report
• Module C (Q4): Clause 9.3 Executive Management Review Minutes & Live CB Surveillance Defense
• Module D: Living SoA & B2B Customer Security Questionnaire Desk

Eliminates post-certification control drift across Years 1–3

Preferred Full Lifecycle Bundle

12 Months Turnkey

SOW 2 + SOW 3 Year 1 Bundle

$70,500 CAD

Saves $8,700 CAD vs. standalone

• Complete SOW 2 Turnkey Remediation (Workstreams 1–5)
• Full Year 1 SOW 3 Managed ISMS & Surveillance Retainer (Modules A–D)
Aligned Milestone & Quarterly Schedule:
• SOW2 Portion ($44,500 CAD): 40% Kickoff / 30% WS3 / 30% Stage 2 Readiness
• SOW3 Portion ($26,000 CAD): Billed Quarterly ($6,500 CAD/qtr in Year 1)

Request Bundle MSA & SOW

Zero Cross-Tenant Exposure

Dedicated Single-Tenant GCP Evidence Vault Architecture

Your security policies, risk registers, and network topology diagrams never sit in a shared multi-tenant SaaS bucket. Every Armura Security client receives a dedicated, physically isolated Google Cloud Platform (GCP) Nextcloud vault.

1. Single-Tenant VM & Disk Isolation

Dedicated GCP Compute Engine instance and persistent disk per client (https://<client>.armurasecurity.com) with zero shared databases.

2. TLS 1.3 In-Transit & AES-256 At-Rest

Strict HTTPS/TLS 1.3 (HSTS enforced) behind Cloudflare WAF/DDoS protection, paired with AES-256 disk-level encryption at rest.

3. Private Air-Gapped Analytical Review

All AI-assisted document cross-referencing runs inside Armura's private, air-gapped local workstation environment—zero public LLM API exposure.

4. Cryptographic Teardown at Closeout

Upon engagement closeout, your final audit binder is delivered and the temporary cloud VM and persistent disks are cryptographically destroyed.

ISO/IEC 27001:2022 Clause 9.2.2(a) & ISO 19011

Why Independent Clause 9.2 Internal Auditing Is Mandatory

Under ISO/IEC 27001:2022 Clause 9.2.2(a) and ISO 19011, an organization's IT and security personnel are strictly prohibited from auditing their own operational controls—doing so triggers an automatic Major Nonconformity during external certification. Both SOW 2 (Workstream 5) and SOW 3 (Module B) include Armura Security acting as your independent ISO 19011 Internal Audit function.