ISO 27001: Understanding the ISMS Cycle

Once you have gone through clause 4 through to clause 10 as detailed above, you have designed and implemented your ISMS! ​​An ISMS, once established, should be a well-oiled machine that continually operates within a yearly cycle.

Before AssuranceLab can certify your organisation against ISO 27001 or affiliated standards, you must have gone through the below cycle at LEAST once.

 ISO 27001 ISMS Diagram (1)

How do I know if I’ve completed the above cycle?

Since the full cycle of an ISMS is interconnected and each step feeds into the next – it’s important to understand the key action items for each step of the process. Below is a simple checklist you can follow to assess what is left to do in your first ISMS cycle.

ISO Ref

Action Item / Key Document

Completed

4.3

Documented ISMS Scope

 

5.2

Documented Information Security Policy

 

6.1.1, 6.1.2

Completed and Documented Risk Assessment

 

6.1.3

Documented Risk Treatment Plans against identified risks

 

6.1.3

Documented Statement of Applicability

 

6.2

Documented ISMS Objectives

 

9.1

Evidence of metrics and measurements recorded to determine the performance of the ISMS. (Note: These should be in line with the ISMS objectives defined in 6.2)

 

9.2

Completed and documented an Internal Audit

 

9.3

Completed and documented a Management Review

 

10.2

Documented Corrective Actions register with all identified non-conformities, be it from an AssuranceLab audit, internal audit or management review.

 

 

I’ve completed the cycle – where does each piece of evidence go in Pillar?

ISO Ref

Action Item / Key Document

Pillar ID

4.3

Documented ISMS Scope

ISMS01 

5.2

Documented Information Security Policy

ISMS02

6.1.1, 6.1.2

Completed and Documented Risk Assessment

RAP05

6.1.3

Documented Risk Treatment Plans against identified risks

RAP08

6.1.3

Documented Statement of Applicability

SOA01

6.2

Documented ISMS Objectives

ETC02

9.1

Evidence of metrics and measurements recorded to determine the performance of the ISMS. (Note: These should be in line with the ISMS objectives defined in 6.2)

ETC06

9.2

Completed and documented Internal Audit

MOC14

9.3

Completed and documented Management Review

MGT04

10.2

Documented Corrective Actions register with any/all findings from Stage 1, internal audit and management reviews logged

MOC03