ISMS SME Fast-Track Kit

Drivers with evidence, four options (do nothing, SOC 2, 27001, 27001 plus 27701), 3-year costs and benefits per tier, risks, scoring, decision record

Phases 0 to 10 from decision to Stage 2, entry and exit criteria, deliverables by template, durations and Gantt charts per tier, critical path, delays

Optional top ISMS document: organisation overview, scope summary, clause 4 to 10 map to document IDs, SoA summary, policy hierarchy, process map, maintenance

Management system scope (cl. 4.3): 4.1 issues incl. climate and AI role, 4.2 parties, scope sentence (QMS and ISO 42001 examples), interfaces, exclusions

Top-management policy (DOC-ISMS-001): purpose, leadership duties, clause 5.2 commitments, principles, objectives, topic policy index, exceptions, size tiers, records

Risk criteria and score-only bands, acceptance authority, criteria for assessments, event or asset-based steps, calibration, treatment, outputs, size tiers, AI variant

Information and associated asset register: roles, C0 to C3 classification, CIA scale, fields, discovery and reconciliation, lifecycle, size tiers, records, metrics

Risk register with appetite, catalogue refs, inherent and residual scores, Annex A controls, acceptance with expiry, status lifecycle, heat maps, feeds, size tiers

Treatment selection and Annex A comparison, actions with controls, budget and schedule, pending decisions, verification, SoA changes, owner approval and acceptance

All 93 Annex A controls with basis, justification, status, reference document (DOC-ISMS IDs) and evidence, exclusions, additional controls, size tiers, records

Plain-language staff handbook: 14 security rules (passwords, MFA, phishing, devices, data, travel, AI tools, reporting), contacts, acknowledgement form

Access principles, role catalogue, joiner mover leaver SLAs, MFA and NIST SP 800-63B-4 password rules, privileged and service accounts, reviews, metrics

ISMS backup policy: tiers from BIA with RPO and RTO, 3-2-1-1-0 copies, immutability, encryption, retention, ransomware, SaaS backups, restore testing

Admin roles, MFA, conditional access, external sharing, SPF, DKIM and DMARC, audit logging, retention, DLP and labels, app consent, quarterly tenant review

Supplier inventory: criticality tiers, data and access, services, contract dates, security terms, certifications, last assessment, review cadence, metrics

Event and incident register: field rules, category and regime codes, register rows, GDPR, NIS2 and DORA notification tracking, status lifecycle, period summary

Evidence register for clauses 4 to 10 and all 93 Annex A controls: owner, record, location, frequency, last collected, status, Stage 2 and surveillance use

Report for one ISMS audit: scope, criteria, team and independence, sampling, findings with evidence and clause references, conclusions, distribution, follow-up

Management review minutes: inputs mapped to ISO 9001:2026, ISO/IEC 27001:2022 and 42001:2023, conclusions, results, action log

Stage 1 audit prep: what Stage 1 reviews, document pack mapped to required documented information, records, go or no-go, logistics, typical findings

Stage 2 audit workbook: evidence index per clause and Annex A theme, sampling populations, interview schedule, evidence rules, debrief log, closing notes