An ISO 27001 programme plan: who does what, and which decisions come first.

1. Why we are certifying, in one sentence a buyer would recognise.
2. What is in scope: which products, sites, teams and systems.
3. Who owns the ISMS day to day, with time set aside for it.
4. Who the executive sponsor is, and how often they will meet the owner.
5. Which risk method we will use, and who approves risk acceptance.
6. How much risk we are willing to accept, in words the team can apply.
7. Build or buy: in-house effort, outside help, or a compliance tool, or a mix.
8. Which certification body, and that it is accredited for ISO 27001.
9. Who performs the internal audit, given that they must be objective.
10. What budget covers fixes the gap analysis will reveal.

1. 01

   Mobilise

   Turn the decision into a funded project with owners.

   What happens

   • Agree the ten decisions above
   • Name the ISMS owner and sponsor
   • Brief the team leads whose areas are in scope

   You get

   • Project charter
   • Draft scope
   • Owner list

   Good practice

   • A sponsor who attends the first steering meeting
   • Scope tied to what buyers actually buy

   Watch for

   • Starting work before an owner has time for it

2. 02

   Understand

   Learn the context, the gaps and the risks.

   What happens

   • Context and interested parties
   • Gap analysis against clauses and Annex A
   • Asset inventory and risk assessment

   You get

   • Context register
   • Gap report
   • Risk register
   • Scope statement

   Good practice

   • Asset owners score their own risks
   • Record controls you already run

   Watch for

   • Copying a template risk register

3. 03

   Decide and document

   Choose controls and write what you will do.

   What happens

   • Risk treatment plan
   • Statement of Applicability
   • Policy and procedure set
   • Objectives and measures

   You get

   • Treatment plan
   • SoA
   • Approved policies
   • Objectives

   Good practice

   • Describe how you work, not an ideal company
   • Approval by the right level

   Watch for

   • Writing documents nobody will follow

4. 04

   Operate

   Run the controls long enough to have records.

   What happens

   • Close the gaps by priority
   • Train staff
   • Collect evidence as it is produced
   • Handle incidents and changes through the new process

   You get

   • Control evidence
   • Training records
   • Metrics

   Good practice

   • Evidence collected as you go, not at the end

   Watch for

   • Controls switched on the week before the audit

5. 05

   Check and present

   Audit yourself, review as leadership, then face the certification body.

   What happens

   • Internal audit
   • Corrective actions
   • Management review
   • Stage 1 and Stage 2 with the certification body

   You get

   • Internal audit report
   • Corrective action log
   • Review minutes

   Good practice

   • Leave time to fix internal audit findings

   Watch for

   • A management review that is only a slide deck

For what happens inside Stage 1 and Stage 2 and after them, see the certification guide. This roadmap stops where the certification body begins.

Two lines matter most. The sponsor must own risk acceptance and the management review; delegating those empties them. The internal auditor must not audit their own work, so in a small company it is often an outside party or a colleague from a different area.

• An owner with no time. The ISMS becomes the fifth job of a busy engineering lead and quietly stops.
• Scope that keeps moving. Every new product added mid-project resets risk work and evidence.
• Waiting on policy approval. Drafts sit unsigned because nobody booked the sponsor's time.
• Tool first, process second. A platform bought before decisions are made fills with unused templates.
• HR and legal brought in late. Screening, contracts and disciplinary process are people controls, and they take time to change.
• Evidence collected at the end. Gaps in records cannot be fixed retrospectively.

Sources: ISO/IEC 27001:2022 clauses 4 to 10 (public titles only; the standard's text is not reproduced); ISO/IEC 17021-1 for the role of the certification body.