Kit ISMS-Reise

12 modules from beginner to ISMS manager and internal auditor, outcomes, templates in study order, hours, self-checks, 5 role tracks, learner log

ISO/IEC 27000 family by layer, editions as of 2026-11-01, certifiable or not, revision watch, what to buy per tier, if-you-are-X-read-Y table, standards library register

Clauses 4 to 10 in plain language: intent, what to produce, what auditors check, common nonconformities, templates, 2022 and Amd 1 changes, required records

Worked example, 46-person SaaS from decision to certificate: filled scope, risk, SoA, objective, audit finding, review decision, Stage 2 finding

Drivers with evidence, four options (do nothing, SOC 2, 27001, 27001 plus 27701), 3-year costs and benefits per tier, risks, scoring, decision record

Phases 0 to 10 from decision to Stage 2, entry and exit criteria, deliverables by template, durations and Gantt charts per tier, critical path, delays

Management system scope (cl. 4.3): 4.1 issues incl. climate and AI role, 4.2 parties, scope sentence (QMS and ISO 42001 examples), interfaces, exclusions

Top-management policy (DOC-ISMS-001): purpose, leadership duties, clause 5.2 commitments, principles, objectives, topic policy index, exceptions, size tiers, records

Risk criteria and score-only bands, acceptance authority, criteria for assessments, event or asset-based steps, calibration, treatment, outputs, size tiers, AI variant

Risk register with appetite, catalogue refs, inherent and residual scores, Annex A controls, acceptance with expiry, status lifecycle, heat maps, feeds, size tiers

All 93 Annex A controls with basis, justification, status, reference document (DOC-ISMS IDs) and evidence, exclusions, additional controls, size tiers, records

Evidence register for clauses 4 to 10 and all 93 Annex A controls: owner, record, location, frequency, last collected, status, Stage 2 and surveillance use

12-month ISMS calendar: fixed dates, 30 recurring activities with owners and evidence, month view, Gantt chart, size tiers, rescheduling rules

CB selection for ISO/IEC 27001: accreditation check, impartiality, audit time, multi-site, remote audit, 3-year cost, transfer, RFQ, scoring, decision

Stage 1 audit prep: what Stage 1 reviews, document pack mapped to required documented information, records, go or no-go, logistics, typical findings

Stage 2 audit workbook: evidence index per clause and Annex A theme, sampling populations, interview schedule, evidence rules, debrief log, closing notes

3-year certificate cycle, timing rules, Gantt timeline, audit coverage, change notifications, suspension and withdrawal, recertification, transfers, budget