ISMS Communication Plan Template (ISO/IEC 27001 Clause 7.4)

Communication matrix (what, when, with whom, who, how), internal and external audiences, regulators, certification body, incident pointers, calendar, log

ISMS & ISO/IEC 27001FullISO/IEC 27001:2022 + Amd 1:2024 clauses 5.2, 7.3, 7.4, A.5.5, A.5.6, A.6.8 (cited only); ISO 22361:2022communication planUpdated Nov 1, 2026

Open in editorDownload .md

How to use: Use it when you set up the ISMS and after every major incident, reorganisation or new regulation. Fill the audience list from the interested parties document first, then the communication matrix. The main pitfall is a plan that covers only internal newsletters and leaves customers, regulators and the certification body out.

Preview

ISMS Communication Plan: [Organization name]

Plan for internal and external communication about the information security management system (ISMS): what is communicated, when, with whom, by whom and how, and how each communication is recorded. It supports ISO/IEC 27001:2022 + Amd 1:2024 clause 7.4 (communication) and links to clause 7.3 (awareness), clause 5.2 (policy communication) and Annex A controls A.5.5 (contact with authorities), A.5.6 (contact with special interest groups), A.5.24 to A.5.26 (incident management) and A.6.8 (event reporting). Replace every [bracketed] value and every row marked Example.

Document control

Field	Value
Document ID	DOC-ISMS-027
Version	[1.0]
Status	[Draft / In review / Approved / Superseded]
Owner	[@isms-manager]
Approvers/reviewers	[@head-of-communications], [@ciso], [@legal-counsel], [@isms-steering-committee]
Last updated	YYYY-MM-DD
Classification	[Internal]
Standard and edition	ISO/IEC 27001:2022 + Amd 1:2024 (clauses 5.2, 7.3, 7.4; Annex A A.5.5, A.5.6, A.5.24 to A.5.26, A.6.8)
Next scheduled review	YYYY-MM-DD
Interested parties source	DOC-ISMS-003 (context and interested parties)
Approved spokespersons	[Linked contact list, reference]
Communication log location	[Tool or folder]

Approvals

Role	Name	Decision	Date
ISMS manager	[@isms-manager]	[Prepared]	YYYY-MM-DD
Head of communications	[@head-of-communications]	[Reviewed]	YYYY-MM-DD
Top management	[@ceo]	[Approved]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0 (Example)	YYYY-MM-DD	[@isms-manager]	First issue
1.1 (Example)	YYYY-MM-DD	[@isms-manager]	Added regulator rows after NIS2 applicability assessment
[x.y]	YYYY-MM-DD	[@author]	[Change summary]

1. Purpose and scope
2. Principles
3. Audiences
4. Communication matrix
5. Internal communication
6. External communication
7. Incident and crisis communication
8. Approval, classification and channels
9. Annual communication calendar
10. Communication log
11. Measuring effectiveness
12. Size tiers
13. Records and evidence
14. References
Standard and licence note

1. Purpose and scope

This plan sets out how [Organization name] communicates about information security and the ISMS with people inside and outside the organisation. It covers:

communication of the information security policy and topic-specific policies (clause 5.2 and A.5.1);
messages that build awareness and report ISMS performance;
communication with customers, suppliers, regulators, authorities, the certification body and special interest groups;
public security statements, including the trust centre and claims about certification;
the hand-over to incident and crisis communication.

Item	Value
In scope	[All ISMS-related communication within the scope in DOC-ISMS-002]
Out of scope	[General corporate communication with no security content]
Detailed procedures elsewhere	[Incident response plan DOC-ISMS-020, crisis plan DOC-ISMS-078, event reporting DOC-ISMS-023]
Plan owner	[@isms-manager]

2. Principles

One source of truth. Policies, contacts and status messages come from controlled documents (DOC-ISMS-028); copies are links, not attachments.
Named senders. Every planned communication has a named sender role. Only approved spokespersons speak externally about incidents or security posture.
Classification first. Messages are classified before sending (DOC-ISMS-042). Threat and incident information shared with external groups uses an agreed sharing protocol, such as FIRST TLP 2.0.
Accurate claims. External security claims are checked by the ISMS manager against evidence; certification claims follow the certification mark rules (DOC-ISMS-097).
Two-way channels. Every audience has a way to raise security concerns: staff report events (A.6.8), customers and researchers reach a published security contact.
Recorded. Communications that prove an ISMS requirement (policy communication, regulator contact, customer notification) are logged (section 10).

3. Audiences

Audience ID	Audience	Internal or external	What they need from us	What we need from them	Source requirement
AUD-01	Top management and board	Internal	ISMS performance, risks above appetite, decisions needed	Direction, resources, approvals	Clauses 5.1, 9.3
AUD-02	All staff and contractors	Internal	Policies, awareness, how to report events, changes affecting them	Following rules, reporting events	Clauses 5.2, 7.3, A.6.8
AUD-03	Control and risk owners	Internal	Tasks, deadlines, audit results, metrics	Evidence, status updates	Clauses 6.1, 9.1
AUD-04	Customers	External	Security posture, certification status, incident notifications, subprocessor changes	Security requirements, questionnaires, incident contacts	Contracts, DOC-ISMS-014
AUD-05	Suppliers and processors	External	Our security requirements, incident duties, changes	Incident notices, assurance reports	A.5.19 to A.5.22
AUD-06	Regulators and supervisory authorities	External	Mandatory notifications, responses to requests	Guidance, requests	DOC-ISMS-014 (for example GDPR, NIS2, DORA where applicable)
AUD-07	Law enforcement and national CSIRTs	External	Incident reports where required or useful	Threat information, support	A.5.5
AUD-08	Special interest groups and ISACs	External	Shared threat indicators under agreed protocol	Threat intelligence, good practice	A.5.6, A.5.7
AUD-09	Certification body	External	Audit information, notification of significant changes	Audit plans, findings, certificate	Certification agreement
AUD-10	Insurers	External	Incident notification per policy terms, posture information at renewal	Coverage, incident support	Insurance contract
AUD-11	Public, media and security researchers	External	Approved statements, vulnerability disclosure channel	Responsible disclosure reports	Policy, reputation

4. Communication matrix

Comm ID	What	When	With whom	Who sends	How	Record
COM-001 (Example)	Information security policy and changes	On approval and annually	AUD-02	ISMS manager on behalf of CEO	Intranet page plus e-mail with acknowledgement	Acknowledgement report
COM-002 (Example)	ISMS performance report	Quarterly	AUD-01	ISMS manager	Steering committee meeting, report DOC-ISMS-081	Minutes
COM-003 (Example)	Management review outputs	After each review	AUD-01, AUD-03	ISMS manager	Minutes and action list	DOC-ISMS-085
COM-004 (Example)	Internal audit results	After each audit	AUD-01, AUD-03	Internal audit lead	Audit report DOC-ISMS-084, closing meeting	Report distribution list
COM-005 (Example)	Awareness campaign	Monthly topic, annual course	AUD-02	Security awareness lead	Intranet, chat channel, course platform	Platform completion data
COM-006 (Example)	Security event reporting reminder	Onboarding and twice a year	AUD-02	Security team	Handbook, poster, chat pinned message	Log entry
COM-007 (Example)	Security posture and certificate status	On request and on certificate changes	AUD-04	Sales engineering with ISMS manager review	Trust centre, questionnaire answers	Trust centre version history, DOC-ISMS-115
COM-008 (Example)	Subprocessor and significant change notices	As contracts require, before the change	AUD-04	Privacy lead	E-mail to contract contacts, trust centre update	Notification log
COM-009 (Example)	Security requirements and changes	At contract and on change	AUD-05	Supplier manager	Contract schedule, supplier portal	Supplier file DOC-ISMS-066
COM-010 (Example)	Mandatory incident notifications	Within legal or contractual deadlines	AUD-04, AUD-06	Legal counsel and privacy lead, approved by incident commander	Regulator portal, formal letter	Incident record DOC-ISMS-021
COM-011 (Example)	Contact details review with authorities	Annually	AUD-06, AUD-07	ISMS manager	Contact list check	DOC-ISMS-069
COM-012 (Example)	Threat information sharing	As events occur	AUD-08	Security team lead	ISAC platform under TLP	Sharing log
COM-013 (Example)	Significant ISMS changes	Before or as soon as the change is decided	AUD-09	ISMS manager	E-mail to the certification body contact	ISMS change record DOC-ISMS-025
COM-014 (Example)	Public security statements	On approval	AUD-11	Head of communications with ISMS manager review	Website, press statement	Approval record
[COM-NNN]	[what]	[when]	[audience IDs]	[role]	[channel and format]	[record]

5. Internal communication

5.1 Policy and awareness

Share the information security policy with everyone working in the ISMS scope, and decide which interested parties outside the organisation may receive it (for example customers on request). New staff receive it at onboarding (with the employee security handbook, DOC-ISMS-073); all staff receive changes when approved. Awareness messages follow the security awareness programme (security/security-awareness-program) and the competence and training matrix (DOC-ISMS-026).

5.2 Management reporting

Report	Audience	Frequency	Content
ISMS performance report (DOC-ISMS-081)	Steering committee	Quarterly	Objectives status, metrics, incidents, audit findings, risk changes
Risk summary	Top management	Quarterly and on new High or Critical risk	Risks above appetite, acceptance requests
Management review pack	Top management	At least annually	All clause 9.3 inputs
Board summary	Board or owners	Annually	Posture, certification status, major incidents, investment needs

5.3 Operational messages

Control owners receive reminders for recurring tasks from the ISMS annual calendar (DOC-ISMS-032): access reviews, backup tests, policy reviews and evidence collection. Use the same channel each time so messages are recognised and not mistaken for phishing.

6. External communication

Audience	Typical messages	Approver	Notes
Customers	Security questionnaires, trust centre, certificate copy, incident and breach notices, subprocessor changes	ISMS manager (posture), legal (notices)	Use the answer library (DOC-ISMS-115) for consistency
Regulators	Incident notifications, responses to inquiries, registrations	Legal counsel and top management	Deadlines differ by regime, for example GDPR Article 33 (72 hours to the supervisory authority where feasible) and NIS2 Article 23 (early warning within 24 hours); check each law in DOC-ISMS-014
Authorities and CSIRTs (A.5.5)	Incident reports, requests for help	ISMS manager or incident commander	Keep contacts current in DOC-ISMS-069
Special interest groups (A.5.6)	Indicators, lessons learned	Security team lead	Share only under the agreed protocol; remove personal and customer data
Certification body	Change notifications, audit planning, responses to findings	ISMS manager	See DOC-ISMS-025 section 8
Suppliers	Requirements, incident coordination, audit requests	Supplier manager	Follow the supplier agreement (DOC-ISMS-068)
Public and media	Statements, website security page, vulnerability disclosure policy	Head of communications and CEO	Never confirm incident details before the incident commander approves

Certification claims: refer to the certificate only within its scope and validity, and follow the certification body's mark rules (isms/certification-mark-usage, DOC-ISMS-097).

7. Incident and crisis communication

During a security incident, communication follows the incident response plan (compliance/incident-response-plan, DOC-ISMS-020). When an incident becomes a crisis, the crisis management and communications plan (isms/crisis-management-communications-plan, DOC-ISMS-078) takes over. The flow below shows the main decision points.

Situation	Who decides on communication	Detailed procedure
Suspected event reported by staff	Security team on triage	DOC-ISMS-023
Confirmed incident, no external impact	Incident commander	DOC-ISMS-020
Personal data breach	Legal counsel and privacy lead, incident commander approves	DOC-ISMS-020, `compliance/personal-data-breach-assessment`
Incident affecting customers or regulated services	Incident commander with top management	DOC-ISMS-020
Crisis (major outage, public attention, extortion)	Crisis team	DOC-ISMS-078

8. Approval, classification and channels

Message type	Classification (Example)	Approver	Approved channels
Policy publication	Internal	Policy owner and top management	Intranet, document system
Awareness content	Internal or Public	Security awareness lead	Intranet, chat, course platform
ISMS performance and audit results	Confidential	ISMS manager	Document system with restricted access
Incident status (internal)	Confidential	Incident commander	Dedicated incident channel, bridge call
Customer and regulator notifications	Confidential	Legal counsel	Regulator portal, formal e-mail from a monitored mailbox
Threat sharing	TLP label as agreed	Security team lead	ISAC platform, encrypted e-mail
Public statements	Public	Head of communications and CEO	Website, press release

Out-of-band channels: keep a backup channel for incidents where e-mail or chat may be compromised (for example a phone tree or a separate messaging tenant), tested during exercises.

9. Annual communication calendar

Month (Example, 2027)	Communication
January	Annual policy acknowledgement campaign (COM-001); awareness course opens (COM-005)
February	Q4 performance report to steering committee (COM-002)
March	Authority and special interest contact review (COM-011)
April	Internal audit results (COM-004)
May	Q1 performance report (COM-002); event reporting reminder (COM-006)
June	Management review outputs (COM-003)
August	Q2 performance report (COM-002)
September	Supplier requirements refresh (COM-009)
October	Awareness month campaign (COM-005)
November	Q3 performance report (COM-002); event reporting reminder (COM-006)
December	Plan review and calendar for next year

10. Communication log

Log ID	Date	Comm ID	Audience	Sender	Channel	Summary	Acknowledged or response	Reference
LOG-001 (Example)	2027-01-15	COM-001	AUD-02 (320 staff)	ISMS manager	E-mail with acknowledgement	Policy v3.0 published	312 of 320 acknowledged by 2027-01-31 (97.5%)	Acknowledgement report
LOG-002 (Example)	2027-02-05	COM-013	AUD-09	ISMS manager	E-mail	Notified cloud migration ISMS-CHG-007	Certification body confirmed receipt 2027-02-08	DOC-ISMS-025
LOG-003 (Example)	2027-02-26	COM-008	AUD-04 (hospital customers)	Privacy lead	E-mail	New cloud subprocessor notice, at least 60 days before the planned cutover	No objections received	Notification log
LOG-004 (Example)	2027-03-10	COM-011	AUD-06, AUD-07	ISMS manager	Phone and e-mail	Annual contact check, 2 numbers updated	Updated in DOC-ISMS-069	Contact list v4
[LOG-NNN]	YYYY-MM-DD	[COM-NNN]	[audience]	[role]	[channel]	[summary]	[result]	[reference]

The entries LOG-001 to LOG-003 use the Quillmere Health Systems setting (320 staff, hospital customers).

11. Measuring effectiveness

Measure	Target (Example)	Source
Policy acknowledgement rate within 30 days	95% or more	Acknowledgement report
Staff who can name the event reporting channel (spot check)	90% or more	Internal audit interviews
Mandatory notifications sent within deadline	100%	Incident register DOC-ISMS-021
Customer questionnaire answers consistent with the answer library	100% reviewed before sending	DOC-ISMS-115
Authority contact list reviewed on schedule	Annually	DOC-ISMS-069

12. Size tiers

Aspect	Small: Quillmere Analytics Ltd (46 staff)	Medium: Quillmere Health Systems (320 staff)	Large: Quillmere Group (2,400 staff, 6 sites in 4 countries)
Plan owner and sender	The part-time ISMS manager sends most messages; the managing director approves external statements	ISMS manager, privacy lead and a communications lead	CISO's security office with corporate communications and site coordinators
Key external audiences	B2B customers (as processor), cloud provider, certification body	Hospitals, health regulators, data protection authority, colocation provider	Customers, regulators in 4 countries, OT suppliers, certification bodies for ISO 9001, ISO 22301 and ISO/IEC 27001
Channels	Chat, e-mail, trust page	Intranet, learning platform, customer portal	Intranet in site languages, works council channels where required, regional media contacts
Incident communication	Managing director leads, with external counsel on call	Incident commander rota and legal	Crisis team per region, integrated with ISO 22301 crisis arrangements
Log	One table in this document	Ticketing tool with a communication category	Integrated management system log shared with quality and continuity

13. Records and evidence

Record	Proves	Owner	Location	Retention (Example)
This plan, approved	Communication needs are determined (7.4)	ISMS manager	Document system	Current plus previous [3] versions
Communication log (section 10)	Planned communications happened	ISMS manager	[Tool or folder]	[3] years
Policy acknowledgement reports	Policy communicated (5.2) and awareness (7.3)	HR	Learning or HR system	[3] years
Notification records to regulators and customers	Legal and contractual duties met	Legal counsel	Incident record DOC-ISMS-021	As set by law and DOC-ISMS-014
Authority and special interest contact list	A.5.5, A.5.6 operate	ISMS manager	DOC-ISMS-069	Current plus history
Certification body correspondence	Certificate kept accurate	ISMS manager	Certification folder	Certificate cycle plus [3] years
Approved public statements	Claims checked before publication	Head of communications	Approval records	[3] years

Map these records to clauses 5.2, 7.3 and 7.4 and controls A.5.5, A.5.6 and A.6.8 in the control evidence matrix (isms/control-evidence-matrix, DOC-ISMS-033).

14. References

Reference	Edition	Use
ISO/IEC 27001:2022 + Amd 1:2024	Current; Amd 1 published 2024-02-23	Clauses 5.2, 7.3, 7.4, 9.3; Annex A A.5.5, A.5.6, A.5.24 to A.5.26, A.6.8 (cited only)
ISO/IEC 27002:2022	Current	Guidance for A.5.5, A.5.6, A.6.8
ISO/IEC 27035-1:2023	Current	Incident management principles, including communication
ISO 22361:2022	Current	Crisis management and communication
FIRST Traffic Light Protocol 2.0	https://www.first.org/tlp/	Information sharing labels
Regulation (EU) 2016/679 (GDPR), Articles 33 and 34	Example of breach notification duties	Example only
Directive (EU) 2022/2555 (NIS2), Article 23	Example of incident reporting duties	Example only

Related templates: Context and interested parties (isms/isms-context-interested-parties, DOC-ISMS-003), Incident response plan (compliance/incident-response-plan, DOC-ISMS-020), Crisis management and communications plan (isms/crisis-management-communications-plan, DOC-ISMS-078), Security event reporting procedure (isms/security-event-reporting-procedure, DOC-ISMS-023), Authorities and special interest groups contacts (isms/authority-special-interest-contacts, DOC-ISMS-069), Security whitepaper and trust centre content (isms/security-whitepaper-trust-center, DOC-ISMS-116), Security questionnaire answer library (isms/security-questionnaire-answer-library, DOC-ISMS-115), Certification mark usage rules (isms/certification-mark-usage, DOC-ISMS-097), ISMS change plan (isms/isms-change-plan, DOC-ISMS-025).

Official texts: ISO/IEC 27001:2022 https://www.iso.org/standard/82875.html, Amd 1:2024 https://www.iso.org/standard/88435.html, ISO/IEC 27002:2022 https://www.iso.org/standard/75652.html, ISO 22361:2022 https://www.iso.org/standard/50267.html.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (clauses 5.2, 7.3 and 7.4, Annex A controls A.5.5, A.5.6, A.5.24 to A.5.26 and A.6.8), with ISO/IEC 27035-1:2023 and ISO 22361:2022 as references. Legal deadlines from the GDPR and NIS2 are paraphrased examples from the public texts; check the consolidated official texts and your own obligations. TLP is cited by name as published by FIRST. Clause and control numbers are cited with original descriptions; the text, matrices and examples of this template are original, and no ISO/IEC text is reproduced. You need the official standards to implement and audit the requirements. Check the current editions before use. Quillmere organisations and all figures are fictional examples. This is a documentation format, not legal advice. Template licence: MIT.

Related templates

ISMS & ISO/IEC 27001