ISMS Manual Template (ISO/IEC 27001 clauses 4 to 10)
Optional top ISMS document: organisation overview, scope summary, clause 4 to 10 map to document IDs, SoA summary, policy hierarchy, process map, maintenance
How to use: Use it as the single entry point into the ISMS for top management, staff, customers and auditors once the core documents exist. Fill the clause map first: it shows where each requirement is met and reveals missing documented information. The main pitfall is copying policy and procedure text into the manual, which then goes out of date; the standard does not require a manual, so keep it a short pointer document.
Preview
ISMS Manual: [Organization name]
The top-level description of the information security management system (ISMS): who the organisation is, what the ISMS covers, how it is structured, and where each requirement of ISO/IEC 27001:2022 + Amd 1:2024 clauses 4 to 10 is met, by document ID. ISO/IEC 27001 does not require a manual; this document is optional but common, because it gives top management, staff, customers and auditors one entry point into the ISMS. Replace every
[bracketed]value and every row marked Example.
Document control
| Field | Value |
|---|---|
| Document ID | DOC-ISMS-008 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@ceo], [@ciso], [@internal-auditor (reviewer)] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal / Public summary available on request] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024; ISO/IEC 27002:2022 |
| Next scheduled review | YYYY-MM-DD (every [12] months and after any change to scope or structure) |
| ISMS scope reference | DOC-ISMS-002 |
| Certification status | [Not certified / Preparing for Stage 1 / Certified, certificate number and expiry] |
| Other management systems | [ISO 9001, ISO 22301, ISO/IEC 27701, ISO/IEC 42001, none] |
Approvals
| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS manager (prepared by) | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| CISO or security lead | [@ciso] | [Reviewed] | YYYY-MM-DD |
| Top management | [@ceo] | [Approved] | YYYY-MM-DD |
Revision history
| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 | YYYY-MM-DD | [@isms-manager] | First issue |
| [x.y] | YYYY-MM-DD | [@author] | [Change summary] |
Contents
- 1. About this manual
- 2. Organisation overview
- 3. ISMS scope summary
- 4. Policy, objectives and commitment
- 5. ISMS structure: clause map
- 6. Annex A controls and the Statement of Applicability
- 7. Policy hierarchy
- 8. Process map summary
- 9. Roles and governance summary
- 10. Documented information and document index
- 11. How the ISMS is maintained
- 12. Integration with other management systems
- 13. Size tiers
- 14. Records and evidence
- 15. References
- Standard and licence note
1. About this manual
This manual describes the ISMS of [Organization name] and shows where each requirement of ISO/IEC 27001:2022 + Amd 1:2024 is addressed. ISO/IEC 27001 does not require a manual. [Organization name] keeps one because it:
- Gives top management and staff a short overview of the ISMS.
- Gives auditors (internal and external) and customers a map from each clause to the documents and records that meet it.
- Helps new role holders understand how the parts fit together.
Where this manual and a linked document differ, the linked document is authoritative and this manual is corrected at the next update.
| Audience | What they use it for |
|---|---|
| Top management | Overview of commitments, governance and the annual cycle |
| ISMS manager and role holders | Map of documents, owners and processes |
| Staff | Where to find policies and how to report events |
| Internal and external auditors | Clause map (section 5) and document index pointer (section 10) |
| Customers and partners (summary only) | Description of the ISMS and its scope, shared under [NDA / trust centre] |
2. Organisation overview
| Item | Value |
|---|---|
| Legal name and entities | [Organization name, registered entities] |
| Business activities | [Products and services] |
| Locations | [Offices, plants, data centres, remote work] |
| People | [Number of employees and contractors] |
| Key information assets | [Customer data, intellectual property, financial data, operational technology] |
| Main technology | [Cloud platforms, data centres, SaaS suites, OT systems] |
| Key interested parties | [Customers, regulators, staff, suppliers, investors] |
| Main legal and contractual drivers | [Data protection law, sector rules, customer contracts; see DOC-ISMS-014] |
Worked example (Example), Quillmere Analytics Ltd:
| Item | Value |
|---|---|
| Business activities | B2B SaaS analytics platform for retail customers |
| Locations | One office plus remote staff; production on one public cloud provider in two regions (primary and DR) |
| People | 46 staff: 38 employees and 8 contractors |
| Key information assets | Customer datasets including personal data processed as a processor, platform source code, customer contracts |
| Main drivers | Customer contracts asking for ISO/IEC 27001 certification, data processing agreements, GDPR as an example of applicable data protection law |
| ISMS target | Certification in 6 months |
3. ISMS scope summary
The ISMS scope is defined and maintained in DOC-ISMS-002
(compliance/ms-scope). Summary:
| Item | Value |
|---|---|
| Scope statement | [One or two sentences, identical to DOC-ISMS-002] |
| Included | [Products, processes, sites, systems, teams] |
| Excluded and why | [Exclusions with justification] |
| Interfaces and dependencies | [Group services, suppliers, cloud providers outside direct control] |
| Annex A applicability | See DOC-ISMS-011 Statement of Applicability |
Scope statement (Example): "The information security management system covering the development, operation and support of the Quillmere Analytics SaaS platform, including the office, remote staff and the production and DR environments hosted by a public cloud provider."
4. Policy, objectives and commitment
| Element | Where it is defined | Owner |
|---|---|---|
| Information security policy (5.2) | DOC-ISMS-001 (compliance/information-security-policy) | Top management |
| Topic-specific policies | DOC-ISMS-005 policy framework and index | Policy owners |
| Information security objectives (6.2) | DOC-ISMS-024 (compliance/objectives-register) | ISMS manager |
| Commitment of top management (5.1) | Policy approval, steering committee (DOC-ISMS-007), management review (DOC-ISMS-085), budget (DOC-ISMS-031) | Top management |
| Risk appetite and criteria | DOC-ISMS-015, DOC-ISMS-010 | Top management |
Top management demonstrates leadership by approving the policy and objectives, providing the resources in the ISMS budget, chairing or attending the steering committee and the management review, accepting High risks with a treatment decision, and communicating the importance of information security to staff.
5. ISMS structure: clause map
Columns: Req. DI shows whether ISO/IEC 27001 itself requires documented information for that clause (Yes) or whether the organisation keeps it by choice (Own). Status: Approved, Draft, Planned.
5.1 Clause 4: Context of the organisation
| Clause | Topic (own wording) | Where met | Req. DI | Owner | Status |
|---|---|---|---|---|---|
| 4.1 | External and internal issues, including whether climate change is a relevant issue (Amd 1:2024) | DOC-ISMS-003 context and interested parties | Own | ISMS manager | [Approved] |
| 4.2 | Interested parties, their requirements, which ones the ISMS addresses (Amd 1 note on climate-related requirements) | DOC-ISMS-003; DOC-ISMS-014 legal, regulatory and contractual register | Own | ISMS manager, legal | [Approved] |
| 4.3 | Scope of the ISMS | DOC-ISMS-002 ISMS scope | Yes | Top management | [Approved] |
| 4.4 | ISMS processes and their interactions | DOC-ISMS-004 process map | Own | ISMS manager | [Approved] |
5.2 Clause 5: Leadership
| Clause | Topic (own wording) | Where met | Req. DI | Owner | Status |
|---|---|---|---|---|---|
| 5.1 | Leadership and commitment | DOC-ISMS-007 steering committee charter and minutes; DOC-ISMS-085 management review | Own | Top management | [Approved] |
| 5.2 | Information security policy | DOC-ISMS-001 | Yes | Top management | [Approved] |
| 5.3 | Roles, responsibilities and authorities | DOC-ISMS-006 roles and RACI | Own | Top management | [Approved] |
5.3 Clause 6: Planning
| Clause | Topic (own wording) | Where met | Req. DI | Owner | Status |
|---|---|---|---|---|---|
| 6.1.1 | Actions to address risks and opportunities | DOC-ISMS-016 risk register; DOC-ISMS-088 improvement register | Own | ISMS manager | [Approved] |
| 6.1.2 | Risk assessment process | DOC-ISMS-010 risk methodology; DOC-ISMS-015 risk criteria | Yes | ISMS manager | [Approved] |
| 6.1.3 | Risk treatment process | DOC-ISMS-010; DOC-ISMS-013 risk treatment plan | Yes | ISMS manager | [Approved] |
| 6.1.3 d | Statement of Applicability | DOC-ISMS-011 | Yes | CISO | [Approved] |
| 6.2 | Information security objectives and planning to achieve them | DOC-ISMS-024 objectives register | Yes | ISMS manager | [Approved] |
| 6.3 | Planning of changes to the ISMS | DOC-ISMS-025 ISMS change plan | Own (no DI requirement in 6.3) | ISMS manager | [Draft] |
5.4 Clause 7: Support
| Clause | Topic (own wording) | Where met | Req. DI | Owner | Status |
|---|---|---|---|---|---|
| 7.1 | Resources | DOC-ISMS-031 budget and resource plan | Own | Top management | [Approved] |
| 7.2 | Competence | DOC-ISMS-026 competence and training matrix; training records | Yes (evidence of competence) | HR, ISMS manager | [Approved] |
| 7.3 | Awareness | security/security-awareness-program; DOC-ISMS-073 employee security handbook; DOC-ISMS-074 phishing simulation plan | Own | HR, ISMS manager | [Approved] |
| 7.4 | Communication | DOC-ISMS-027 communication plan | Own | ISMS manager | [Approved] |
| 7.5.1 | Documented information determined as necessary | DOC-ISMS-028 documented information register | Yes | ISMS manager | [Approved] |
| 7.5.2, 7.5.3 | Creating, updating and controlling documented information | DOC-ISMS-005 policy framework; compliance/controlled-document format | Own | ISMS manager | [Approved] |
5.5 Clause 8: Operation
| Clause | Topic (own wording) | Where met | Req. DI | Owner | Status |
|---|---|---|---|---|---|
| 8.1 | Operational planning and control, including externally provided processes | DOC-ISMS-032 annual calendar; DOC-ISMS-049 security operating procedures; DOC-ISMS-066 supplier register; change records | Yes (to the extent necessary) | ISMS manager, control owners | [Approved] |
| 8.2 | Risk assessment at planned intervals and on significant change | DOC-ISMS-017 risk assessment report; DOC-ISMS-016 | Yes (results) | ISMS manager | [Approved] |
| 8.3 | Risk treatment implementation | DOC-ISMS-013 status; DOC-ISMS-019 risk acceptance records | Yes (results) | Risk owners | [Approved] |
5.6 Clause 9: Performance evaluation
| Clause | Topic (own wording) | Where met | Req. DI | Owner | Status |
|---|---|---|---|---|---|
| 9.1 | Monitoring, measurement, analysis and evaluation | DOC-ISMS-080 measurement programme; DOC-ISMS-081 performance report | Yes (results) | ISMS manager | [Approved] |
| 9.2 | Internal audit programme and results | DOC-ISMS-082 programme; DOC-ISMS-083 checklist; DOC-ISMS-084 reports | Yes | Internal auditor | [Approved] |
| 9.3 | Management review | DOC-ISMS-085 management review minutes | Yes (results) | Top management | [Approved] |
5.7 Clause 10: Improvement
| Clause | Topic (own wording) | Where met | Req. DI | Owner | Status |
|---|---|---|---|---|---|
| 10.1 | Continual improvement | DOC-ISMS-088 continual improvement register | Own | ISMS manager | [Approved] |
| 10.2 | Nonconformity and corrective action | DOC-ISMS-087 nonconformity and corrective action record; DOC-ISMS-086 audit findings register | Yes | ISMS manager | [Approved] |
6. Annex A controls and the Statement of Applicability
Annex A of ISO/IEC 27001:2022 lists 93 controls in four themes:
organizational (A.5.1 to A.5.37, 37 controls), people (A.6.1 to A.6.8, 8),
physical (A.7.1 to A.7.14, 14) and technological (A.8.1 to A.8.34, 34).
Controls are selected through risk treatment (clause 6.1.3) and compared
with Annex A so that no necessary control is omitted. The Statement of
Applicability (DOC-ISMS-011, compliance/statement-of-applicability)
records for each control whether it is applicable, why, and its
implementation status.
SoA summary (Example, Quillmere Analytics Ltd, SoA version 1.0):
| Theme | Controls | Applicable | Not applicable | Implemented | Partial | Planned |
|---|---|---|---|---|---|---|
| A.5 Organizational | 37 | 37 | 0 | 30 | 5 | 2 |
| A.6 People | 8 | 8 | 0 | 8 | 0 | 0 |
| A.7 Physical | 14 | 14 | 0 | 12 | 2 | 0 |
| A.8 Technological | 34 | 33 | 1 | 26 | 5 | 2 |
| Total | 93 | 92 | 1 | 76 | 12 | 4 |
Not applicable in this example: A.8.30 outsourced development (all code written by staff under the organisation's direct supervision, no outsourced development), justified in DOC-ISMS-011. Data centre physical controls stay applicable and are operated by the cloud provider. Implementation status figures cover applicable controls only (76 + 12 + 4 = 92).
Control evidence is indexed in the control evidence matrix (DOC-ISMS-033,
isms/control-evidence-matrix).
7. Policy hierarchy
The policy hierarchy, naming scheme, approval levels, review cadence and
the full index of topic-specific policies are defined in DOC-ISMS-005
(isms/isms-policy-framework). Summary:
| Level | Document type | Approved by | Example |
|---|---|---|---|
| 1 | Information security policy | Top management | DOC-ISMS-001 |
| 2 | Topic-specific policies | Steering committee | DOC-ISMS-041 access control policy |
| 3 | Standards | CISO or ISMS manager | security/cryptography-standard |
| 4 | Procedures and operating instructions | Process or control owner's manager | DOC-ISMS-049 security operating procedure |
| 5 | Records | Created by operation | Access review records, training records |
8. Process map summary
The ISMS processes and their interactions are described in DOC-ISMS-004
(isms/isms-process-map). The ISMS follows a plan, do, check, act cycle:
| Process group | Main processes | Process owner |
|---|---|---|
| Management processes | Context, scope, policy, risk management, objectives, management review | ISMS manager, top management |
| Core security processes | Access control, incident management, vulnerability management, change management, supplier security, continuity | Control owners |
| Support processes | Competence and awareness, communication, documented information, resources | HR, ISMS manager |
| Assurance processes | Monitoring and measurement, internal audit, corrective action | ISMS manager, internal auditor |
9. Roles and governance summary
Roles, responsibilities, authorities, deputies and the RACI matrix are in
DOC-ISMS-006 (isms/isms-roles-raci); the steering committee is set up by
DOC-ISMS-007 (isms/isms-steering-committee-charter).
| Role or body | Holder | Main ISMS duty |
|---|---|---|
| Top management | [CEO and executive team] | Leadership, policy, resources, management review |
| Steering committee | [Chair] | Decisions between management reviews |
| CISO or security lead | [@ciso] | Security strategy and risk reporting |
| ISMS manager | [@isms-manager] | Runs the ISMS and reports performance |
| Risk owners | [Executives or department heads] | Treatment decisions and residual risk acceptance |
| Internal auditor | [@internal-auditor] | Independent assurance |
| DPO or privacy lead | [@dpo] | Privacy oversight |
10. Documented information and document index
The complete index of ISMS documents and records, with owner, version,
storage location, retention and access rules, is the documented
information register DOC-ISMS-028
(isms/isms-documented-information-register). Rules for creating,
identifying, reviewing, approving, distributing, storing, protecting and
disposing of documented information (clause 7.5) are in DOC-ISMS-005.
| Item | Value |
|---|---|
| Document management system | [Tool or shared repository] |
| Master copy of this manual | [Location] |
| Document ID scheme | DOC-ISMS-NNN, per DOC-ISMS-005 |
| External documents | Standards, laws, supplier documents: listed in DOC-ISMS-028 with source and version |
| Records retention | Per DOC-ISMS-028 and data/data-retention-deletion-standard |
| Uncontrolled copies | Printed or exported copies are uncontrolled; check the version in the master location |
11. How the ISMS is maintained
11.1 Annual cycle
The ISMS annual calendar (DOC-ISMS-032, isms/isms-annual-calendar)
schedules recurring activities. Typical rhythm:
| Activity | Frequency | Output |
|---|---|---|
| Steering committee | [Quarterly] | Minutes and action log (DOC-ISMS-007) |
| KPI collection and performance report | [Monthly / quarterly] | DOC-ISMS-081 |
| Risk register review | [Quarterly] | Updated DOC-ISMS-016 |
| Full risk reassessment | [Annually] and on significant change | DOC-ISMS-017 |
| Policy and document review | [Annually] per document | Updated versions in DOC-ISMS-028 |
| Access reviews | [Quarterly for privileged, semi-annually for others] | ops/access-review records |
| Awareness training | [Annually] plus onboarding | Training records |
| Internal audit | Per programme, all clauses and applicable controls within [the certification cycle] | DOC-ISMS-084 |
| Management review | [Annually] | DOC-ISMS-085 |
| Certification audits | Surveillance each year, recertification every three years | Certification body reports |
11.2 Planning changes to the ISMS
Changes to the ISMS (new scope, new sites, reorganisation, new standards
integrated) are planned and carried out in a controlled way (clause 6.3)
using the ISMS change plan (DOC-ISMS-025, isms/isms-change-plan). Each
change records why it is needed, what it could disturb, who does the
work and with what resources, and the steering committee approves it.
11.3 Updating this manual
Update this manual when the scope, structure, key roles or the documents in section 5 change. The ISMS manager checks the clause map against the documented information register at least once a year, before the management review.
12. Integration with other management systems
ISO/IEC 27001:2022 uses the harmonized structure shared by ISO management system standards, so clauses 4 to 10 can be run as common processes.
| Shared process | Shared with | Owner | Notes |
|---|---|---|---|
| Document control | [ISO 9001] | [Quality manager] | One procedure, ISMS records kept in the same system |
| Internal audit | [ISO 9001, ISO 22301] | [Head of internal audit] | Integrated audit programme; ISMS-competent auditors for ISMS clauses |
| Management review | [ISO 9001, ISO 22301] | [CEO] | One meeting with separate ISMS inputs and outputs |
| Corrective action | [ISO 9001] | [Quality manager] | One register, tagged by system |
| Business continuity | [ISO 22301] | [BC manager] | A.5.29 and A.5.30 linked to the BCMS (DOC-ISMS-121, DOC-ISMS-047) |
| Privacy | [ISO/IEC 27701:2025] | [DPO] | Stand-alone PIMS or combined with the ISMS (DOC-ISMS-100) |
| AI | [ISO/IEC 42001:2023] | [AI governance lead] | Integrated SoA option (DOC-ISMS-107) |
Mapping detail: isms/integrated-management-27013 (DOC-ISMS-105).
13. Size tiers
| Topic | Small: Quillmere Analytics Ltd (46 staff) | Medium: Quillmere Health Systems (320 staff) | Large: Quillmere Group (2,400 staff, 6 sites) |
|---|---|---|---|
| Need for a manual | Optional; a short manual (sections 1 to 6 and 10) helps the 0.5 FTE ISMS manager and the certification body | Recommended as the entry point for the 3-person security team, 8 committee members and customers in healthcare | Recommended at group level, with a short site annex per site |
| Length | About 10 pages | About 20 pages | Group manual about 25 pages plus one annex per site (6 annexes) |
| Clause map | One table, one owner per clause | One table, owners per department | Group table plus a column showing which clauses are run centrally and which per site |
| Integration section | Not needed | Short: planned ISO/IEC 27701 extension the year after certification | Detailed: shared processes with ISO 9001 and ISO 22301 already certified |
| Audience | Staff, certification body, enterprise customers | Staff, hospital customers, certification body | Group staff, site management, certification body, regulators where relevant |
| Review | Annually | Annually and when the 27701 extension starts | Annually and when each new site joins the scope during the 15-month phased plan |
14. Records and evidence
| Record | Proves | Kept by | Where | Retention (Example) |
|---|---|---|---|---|
| Approved manual and revision history | ISMS structure described and approved | ISMS manager | Document management system | Current plus [3] previous versions |
| Annual clause-map check against DOC-ISMS-028 | Manual kept current | ISMS manager | Review note or management review input | [3] years |
| Distribution or publication record | Manual available to those who need it | ISMS manager | Intranet page history or distribution list | Current |
| Customer copies or summaries shared | Controlled external distribution | Sales or security team | Trust centre or NDA file | [3] years |
The records that prove each clause operates are listed in the documents named in section 5 and indexed in DOC-ISMS-033.
15. References
| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024 | Current (https://www.iso.org/standard/82875.html, Amd 1: https://www.iso.org/standard/88435.html) | Clauses 4 to 10, Annex A |
| ISO/IEC 27000:2026 | Current, 6th edition (https://www.iso.org/standard/84257.html) | Overview of the ISMS family |
| ISO/IEC 27002:2022 | Current (https://www.iso.org/standard/75652.html) | Control guidance |
| ISO/IEC 27003:2017 | Current; a revision is in progress, check for a newer edition (https://www.iso.org/standard/63417.html) | ISMS implementation guidance |
| ISO/IEC TS 27022:2021 | Current (https://www.iso.org/standard/61004.html) | Reference model of ISMS processes |
| ISO/IEC 27013:2021 + Amd 1:2024 | Current (https://www.iso.org/standard/78752.html) | Integration with ISO/IEC 20000-1 |
Related templates: compliance/ms-scope,
compliance/information-security-policy, isms/isms-context-interested-parties,
isms/isms-process-map, isms/isms-policy-framework,
isms/isms-roles-raci, isms/isms-steering-committee-charter,
compliance/statement-of-applicability,
isms/isms-documented-information-register, isms/isms-annual-calendar,
isms/isms-change-plan, isms/integrated-management-27013,
isms/control-evidence-matrix.
Standard and licence note
Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (clauses 4 to 10 and Annex A), with guidance from ISO/IEC 27000:2026, ISO/IEC 27003:2017 and ISO/IEC TS 27022:2021. ISO/IEC 27001 does not require an ISMS manual. The text, tables, clause map wording and examples are original. No ISO/IEC text is reproduced: clause numbers are cited with short topic descriptions written for this template, not the official clause titles or requirements. Obtain the official standards from ISO, IEC or your national standards body, and check the current edition before use (ISO/IEC 27003 is under revision). Quillmere entities are fictional.
Template licence: MIT.
Related templates
Access Control Policy Template (ISO/IEC 27001 A.5.15)
Access principles, role catalogue, joiner mover leaver SLAs, MFA and NIST SP 800-63B-4 password rules, privileged and service accounts, reviews, metrics
ISMS & ISO/IEC 27001Annex A Organizational Controls Guide Template (ISO/IEC 27001 A.5)
A.5.1 to A.5.37 in own words: intent, typical implementation, tier notes, evidence auditors sample, pitfalls, linked templates, self-check, study record
ISMS & ISO/IEC 27001Annex A People and Physical Controls Guide Template (ISO/IEC 27001 A.6, A.7)
A.6.1 to A.6.8 and A.7.1 to A.7.14 in own words: intent, tier notes, evidence, pitfalls, physical boundary decision for cloud and colocation, self-check, study record