An ISMS is a routine you repeat every year, not a folder you write once

Most first-time readers picture a stack of policies. Auditors picture something else: a cycle that has visibly gone round at least once, with dates, names and decisions attached. The shape below is illustrative. Your quarters will not line up so neatly, and that is fine as long as every movement happens and leaves a record.

1. 1

   Set direction

   Leadership decides what the system covers and what it should achieve this year.

   What happens

   • Confirms the scope still matches the business
   • Refreshes the risk assessment
   • Agrees measurable security objectives

   You get

   • An updated risk register
   • A treatment plan with owners
   • Objectives someone can report on

   Good practice

   • Risks rated with the same method as last year
   • Each objective has a number or a date

   Watch for

   • Copying last year's register without asking what changed
   • Objectives like "improve security"

2. 2

   Operate

   The chosen safeguards run as part of normal work.

   What happens

   • Owners run their controls: access reviews, backups, patching, supplier checks
   • Staff complete awareness training
   • Incidents are logged and handled

   You get

   • Tickets, logs and sign-offs
   • Training completion records

   Good practice

   • Evidence is produced by the work itself
   • Owners know which controls are theirs

   Watch for

   • Collecting evidence in a rush the week before an audit

3. 3

   Check

   People who did not run a control look at whether it worked.

   What happens

   • Track the agreed metrics
   • Run the internal audit programme
   • Hold the management review

   You get

   • An internal audit report
   • Review minutes with decisions

   Good practice

   • Auditors are independent of the area they test
   • Leaders make real calls in the review

   Watch for

   • A review meeting that only reads slides aloud

4. 4

   Adjust

   Findings turn into fixes, and fixes turn into next year's inputs.

   What happens

   • Log each nonconformity
   • Find the root cause
   • Track corrective action to closure

   You get

   • A corrective action log
   • Changes to risks, controls or scope

   Good practice

   • Fixes address the cause, not only the symptom

   Watch for

   • Closing findings by editing the document that was wrong

Clause 6 is where the Statement of Applicability (SoA) comes from: a list of all 93 Annex A controls showing which ones you use, which you exclude, and why. Each clause has its own guide; start with the three below if you are scoping a new system.

• Clause 4: context of the organisationYour context, interested parties and the boundary of the ISMS.
• Clause 9: performance evaluationMeasuring, auditing and reviewing the system.
• Documented informationWhat to write, how to control it, and how little is enough.

• Scope statement. Signed, dated, and still accurate about sites, teams and systems.
• Risk register and treatment plan. Every significant risk has an owner and a decision.
• Statement of Applicability. Each control marked in or out, with a reason a stranger can follow.
• Objectives and measurements. Targets set in Clause 6, with results reported against them.
• Competence and training records. Proof that people in security roles can do them.
• Internal audit report. What was tested, by whom, and what failed.
• Management review minutes. Decisions on resources, risks and changes, not just attendance.
• Corrective action log. Findings, causes, fixes and closure dates.

The standard expects the system to fit the organisation's size and risks. A small team that runs a light loop every year is in better shape than a large one with a thick manual nobody opens.

• The launch-year spike. Huge effort before the first audit, then nothing until the next one. Surveillance audits catch the gap.
• Ownerless controls. A control assigned to "IT" is run by nobody. Name a person.
• A frozen risk register. New products, vendors and offices arrive, and the register never hears about them.
• Reviews without decisions. Minutes that record attendance but no choices give an auditor nothing to sample.

Sources: ISO/IEC 27001:2022, clause numbers and titles and the Annex A structure (public); ISO/IEC 27002:2022 for control titles; ISO/IEC 17021-1 and ISO/IEC 27006 for how certification bodies run audits. All descriptions are our own summary, not the standards' text.