ISMS Project Charter Template (ISO/IEC 27001)

ISMS Project Charter: [Organization name]

Project charter for implementing an information security management system (ISMS) and preparing for certification to ISO/IEC 27001:2022 including Amendment 1:2024. It turns the approved business case into a mandate: objectives, a draft scope boundary, sponsor and roles, governance cadence, milestones up to the Stage 2 certification audit, assumptions, constraints, success criteria and change control. It supports clauses 5.1 and 5.3 (leadership commitment, roles and authorities), 6.2 (objectives and how they will be achieved) and 7.1 (resources) during the build phase. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Purpose and background
2. Objectives
3. Draft scope boundary
4. Deliverables
5. Sponsor, roles and project organisation
6. Governance cadence
7. Milestones to Stage 2
8. Assumptions and constraints
9. Project risks
10. Success criteria
11. Change control for the project
12. Handover and closure
13. Size tiers
14. Records and evidence
15. References

1. Purpose and background

[Organization name] decided on YYYY-MM-DD (decision [DEC-ISMS-001]) to build an ISMS and to seek accredited certification to ISO/IEC 27001:2022. This charter authorises the project, names the people accountable for it and sets the boundaries within which the project manager may act without returning to top management.

The project is complete when the ISMS operates as described in clauses 4 to 10, the Stage 2 certification audit has been carried out, any findings have an accepted action plan, and ownership has passed to the ISMS steering committee (isms/isms-steering-committee-charter, DOC-ISMS-007). The certification decision itself belongs to the accredited certification body.

2. Objectives

2.1 Project objectives

2.2 Initial ISMS objectives to be confirmed

Draft two to four ISMS objectives (clause 6.2) for approval in phase 2, for example: "Phishing simulation report rate above 60% by YYYY-MM-DD" or "All critical vulnerabilities fixed within 14 days". Record them in the objectives register (compliance/objectives-register, DOC-ISMS-024).

3. Draft scope boundary

Interfaces and dependencies to document in the scope statement: [customer integrations, colocation provider services, outsourced support desk, group shared services].

4. Deliverables

5. Sponsor, roles and project organisation

The full RACI for ISMS processes is kept in isms/isms-roles-raci (DOC-ISMS-006).

6. Governance cadence

Status reporting: a one-page status report goes to the sponsor every [two weeks], with RAG status for schedule, budget, scope and risk.

7. Milestones to Stage 2

Worked example: Quillmere Health Systems, start 2027-01-04, target about 10 months (all dates Example).

8. Assumptions and constraints

8.1 Assumptions

8.2 Constraints

9. Project risks

10. Success criteria

The project is successful when:

1. All deliverables in section 4 are approved and under document control.
2. The Stage 1 audit raises no issue that prevents Stage 2 from going ahead on the planned date.
3. The Stage 2 audit raises no major nonconformity, or every major nonconformity has an action plan accepted by the certification body within the time it sets.
4. Spend is within 10% of the approved budget and the planned Stage 2 date is met or moved only by an approved change request.
5. The ISMS steering committee, the annual calendar (isms/isms-annual-calendar) and the measurement programme (isms/isms-measurement-programme) are in place at closure.
6. A staff survey or attestation shows at least [90%] of staff have read the information security policy and completed awareness training.

11. Change control for the project

11.1 Tolerances

11.2 Process

Raise every change as a PCR, assess its impact, route it to the lowest level whose tolerance covers it, then update the plan and tell the team.

11.3 Change log

12. Handover and closure

At closure, the project manager prepares a closure report covering:

• deliverables status and where each is stored;
• final spend against budget and remaining commitments (for example surveillance audit fees in DOC-ISMS-031);
• open findings, treatment actions and their owners;
• lessons learned, recorded in the continual improvement register (isms/continual-improvement-register);
• handover of recurring activities to their owners, confirmed in the annual calendar (isms/isms-annual-calendar) and the certification cycle plan (isms/certification-cycle-plan).

The project steering group hands its role to the ISMS steering committee (isms/isms-steering-committee-charter, DOC-ISMS-007).

13. Size tiers

14. Records and evidence

List these records in the documented information register (isms/isms-documented-information-register) and map them in the control evidence matrix (isms/control-evidence-matrix).

15. References

Related templates: isms/isms-business-case, isms/isms-implementation-roadmap, isms/isms-budget-resource-plan, isms/isms-roles-raci, isms/isms-steering-committee-charter, compliance/ms-scope, isms/certification-body-selection, isms/stage-1-readiness-pack.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 including Amd 1:2024 (clauses 5.1, 5.3, 6.2 and 7.1) and common project management practice. The text, roles, milestones and examples are original; no ISO/IEC text is reproduced. You need the official standard for the requirements themselves: https://www.iso.org/standard/82875.html. Check the current edition of every standard before use. Dates and figures are Example values, and certification decisions belong to the accredited certification body. Template licence: MIT.