ISMS Process Map Template (ISO/IEC 27001 4.4, TS 27022)

21 ISMS processes in governance, risk, operational and support groups, owners, inputs and outputs, interactions, SIPOC, clause mapping, KPIs, maturity

ISMS & ISO/IEC 27001FullISO/IEC 27001:2022 + Amd 1:2024 clauses 4.4 and 8.1 (cited only); ISO/IEC TS 27022:2021 (orientation)process mapUpdated Nov 1, 2026

Open in editorDownload .md

How to use: Use it after context and scope are agreed and before you assign roles in the RACI. Fill the process register first with a named owner per process, then the interactions and the SIPOC tables for the processes auditors sample most. The main pitfall is a map of boxes that matches no real activity or records.

Preview

ISMS Process Map: [Organization name]

The process map of an information security management system (ISMS): which processes run the ISMS, who owns them, what goes in and comes out, how they connect and how their performance is measured. It supports ISO/IEC 27001:2022 + Amd 1:2024 clause 4.4, which treats the ISMS as a set of connected processes rather than a pile of documents, and clause 8.1 on operational planning and control. The grouping into governance, risk, operational and support processes is loosely oriented on the process reference model in ISO/IEC TS 27022:2021, without reproducing it. Replace every [bracketed] value and every row marked Example.

Document control

Field	Value
Document ID	DOC-ISMS-004
Version	[1.0]
Status	[Draft / In review / Approved / Superseded]
Owner	[@isms-manager]
Approvers/reviewers	[@ciso], [@coo], [@process-owners]
Last updated	YYYY-MM-DD
Classification	[Internal]
Standard and edition	ISO/IEC 27001:2022 + Amd 1:2024, clauses 4.4 and 8.1; orientation ISO/IEC TS 27022:2021
Scope reference	DOC-ISMS-002
Roles reference	DOC-ISMS-006
Number of processes	[21]
Next scheduled review	YYYY-MM-DD

Approvals

Role	Name	Decision	Date
ISMS manager	[@isms-manager]	[Prepared]	YYYY-MM-DD
Chief information security officer	[@ciso]	[Approved / Approved with changes]	YYYY-MM-DD
Top management representative	[@coo]	[Approved]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0 (Example)	2027-02-10	[@isms-manager]	First process map for the certification project
1.1 (Example)	2027-09-01	[@isms-manager]	O-04 vulnerability and threat management split from O-05 incident management; owner of S-02 changed

Purpose and scope
Process approach and model
Process landscape
Process register
Process interactions
SIPOC for key processes
Mapping of processes to clauses
Process performance indicators
Process owner duties and process description minimum
Process review and maturity
Size tiers
Records and evidence
References

1. Purpose and scope

This document defines the processes that establish, run, monitor and improve the ISMS of [Organization name] within the scope set in DOC-ISMS-002. It names an owner for each process, its inputs and outputs, the processes it hands over to, its key performance indicators and the clauses of ISO/IEC 27001 it serves.

It covers ISMS processes, not the business processes the ISMS protects. Business processes (for example customer onboarding or software release) appear only where an ISMS process interfaces with them, such as change management or supplier management.

Users: top management, the ISMS manager, process owners, control owners, internal auditors and the certification body during Stage 1.

2. Process approach and model

The ISMS is run as a set of interacting processes, following the plan-do-check-act logic of the management system clauses:

Governance processes (G) set direction and check the system: context and scope, leadership and policy, objectives and planned changes, performance monitoring, internal audit, management review and improvement.
Risk processes (R) identify, analyse, evaluate, treat and accept information security risks and keep the Statement of Applicability current.
Operational processes (O) run the controls day to day: operational planning and control, access and identity, change and configuration, vulnerability and threat management, incident management, supplier security and ICT readiness.
Support processes (S) give the other processes what they need: resources, competence and awareness, communication and documented information.

ISO/IEC TS 27022:2021 describes a process reference model for ISMS processes. This map follows the same process-oriented idea but uses four groups and its own process names. If you want to align closely with the TS, read it and adjust section 4; do not copy its process descriptions into your documents. The TS is under systematic review, with a preliminary work item for a revision listed in the ISO catalogue on 2026-11-01.

3. Process landscape

How to read it: context feeds risk assessment, risk treatment drives the operation of controls, operation produces measurements, monitoring and audit feed management review, and management review drives improvement and new objectives, which loops back into the next risk cycle. Support processes serve all the others (dotted lines).

4. Process register

ID	Process	Owner	Purpose	Key inputs	Key outputs	Main documents
G-01 (Example)	Context and scope	[@isms-manager]	Determine issues, parties, requirements and scope	Strategy, contracts, legal register, interfaces	Context analysis, scope statement	DOC-ISMS-003, DOC-ISMS-002
G-02 (Example)	Leadership and policy	[@ceo]	Show commitment, set policy, assign roles	Context, risk appetite, business strategy	Information security policy, topic policies, roles	DOC-ISMS-001, DOC-ISMS-005, DOC-ISMS-006
G-03 (Example)	Objectives and planned changes	[@ciso]	Set measurable objectives and plan ISMS changes	Policy, risks, review decisions	Objectives register, ISMS change plans	DOC-ISMS-024, DOC-ISMS-025
G-04 (Example)	Performance monitoring	[@isms-manager]	Measure and evaluate ISMS and control performance	Measurement definitions, operational data	Measurement results, performance report	DOC-ISMS-080, DOC-ISMS-081
G-05 (Example)	Internal audit	[@internal-audit-lead]	Check conformity and effective implementation	Audit programme, previous results, risks	Audit reports, findings	DOC-ISMS-082, DOC-ISMS-083, DOC-ISMS-084
G-06 (Example)	Management review	[@ceo]	Decide on suitability, adequacy and effectiveness of the ISMS	Review inputs from all processes	Decisions, actions, resource changes	DOC-ISMS-085
G-07 (Example)	Improvement and corrective action	[@isms-manager]	Correct nonconformities, remove causes, improve	Findings, incidents, review decisions	Corrective actions, improvement register	DOC-ISMS-087, DOC-ISMS-086, DOC-ISMS-088
R-01 (Example)	Risk assessment	[@risk-manager]	Identify, analyse and evaluate risks	Method, criteria, assets, threats, context	Risk register, assessment report	DOC-ISMS-010, DOC-ISMS-015, DOC-ISMS-016, DOC-ISMS-017
R-02 (Example)	Risk treatment and SoA	[@ciso]	Select treatments and controls, keep the SoA current	Evaluated risks, Annex A, requirements	Risk treatment plan, SoA	DOC-ISMS-013, DOC-ISMS-011
R-03 (Example)	Risk acceptance and monitoring	[@risk-manager]	Obtain acceptance of residual risk, track risk changes	Treatment results, criteria	Acceptance records, risk trend	DOC-ISMS-019, DOC-ISMS-016
O-01 (Example)	Operational planning and control	[@it-ops-lead]	Plan and control the running of controls, including outsourced processes	Treatment plan, SoA, operating procedures	Operating records, control evidence	DOC-ISMS-049, DOC-ISMS-033
O-02 (Example)	Access and identity	[@iam-lead]	Grant, review and remove access under least privilege	HR events, access requests, policy	Access records, review results	DOC-ISMS-041
O-03 (Example)	Change and configuration	[@it-ops-lead]	Control changes and keep secure configurations	Change requests, baselines	Approved changes, configuration records	DOC-ISMS-060, `ops/change-enablement-policy`
O-04 (Example)	Vulnerability and threat	[@security-engineer]	Find and fix vulnerabilities, use threat intelligence	Scans, advisories, intelligence feeds	Remediation tracker, intelligence reports	DOC-ISMS-072, DOC-ISMS-045
O-05 (Example)	Incident management	[@security-ops-lead]	Detect, respond to and learn from incidents	Event reports, monitoring alerts	Incident records, reviews, notifications	DOC-ISMS-020, DOC-ISMS-021, DOC-ISMS-022, DOC-ISMS-023
O-06 (Example)	Supplier security	[@procurement-lead]	Assess, contract, monitor and exit suppliers securely	Supplier requests, risk criteria	Supplier register, assessments, agreements	DOC-ISMS-066, DOC-ISMS-067, DOC-ISMS-068
O-07 (Example)	ICT readiness and continuity	[@bc-manager]	Keep ICT ready to meet continuity objectives	BIA, recovery objectives	ICT readiness plan, test results	DOC-ISMS-047, DOC-ISMS-120, DOC-ISMS-121
S-01 (Example)	Resources	[@coo]	Provide people, budget and tools	Plans, review decisions	Budget, resource plan	DOC-ISMS-031
S-02 (Example)	Competence and awareness	[@hr-lead]	Ensure competence and awareness	Role requirements, gaps	Training records, competence matrix	DOC-ISMS-026
S-03 (Example)	Communication	[@isms-manager]	Plan internal and external communication	Communication needs	Communication plan and log	DOC-ISMS-027
S-04 (Example)	Documented information	[@isms-manager]	Create, control and retain documents and records	Document requests, retention rules	Document register, controlled documents	DOC-ISMS-028

Total: 7 governance, 3 risk, 7 operational and 4 support processes, 21 processes in all (Example).

5. Process interactions

From	Output handed over	To	Frequency (Example)
G-01	Issues, requirements, scope	R-01, G-02, O-06	Annually and on trigger
G-02	Policy, roles, risk appetite approval	G-03, R-01, S-02	Annually
R-01	Evaluated risks	R-02, G-06, G-07 (reassessment results)	Annually and on trigger
R-02	Treatment plan, SoA	O-01, G-03, S-01	After each assessment
R-02	Residual risks for acceptance	R-03	After each assessment
O-01 to O-07	Control evidence and operational data	G-04, G-05	Continuous, monthly summary
O-05	Lessons learned, new threats	R-01, G-07	After each significant incident
O-04	Emerging threats and unremediated vulnerabilities	R-01, O-05	Monthly
O-06	Supplier risks and incidents	R-01, O-05	On assessment and event
G-04	Measurement results	G-06, G-03	Quarterly
G-05	Audit results, nonconformities	G-07, G-06	Per audit
G-06	Decisions, actions, resource changes	G-03, G-07, S-01	At least annually
G-07	Corrective actions and improvements, action status	R-01, O-01, S-04, G-06	Continuous
S-04	Controlled documents, records	All	Continuous
S-02	Competent and aware staff	All	Continuous
S-03	Communications to parties	All, interested parties	Per plan

The sequence shows one typical chain from the table: an incident leads to a corrective action, a reassessment of risk and a management decision.

6. SIPOC for key processes

6.1 R-01 Risk assessment

Suppliers	Inputs	Process steps	Outputs	Customers
G-01, asset owners, O-04, O-05, O-06	Context, asset inventory, threat catalogue, incidents, supplier risks, risk criteria	1. Plan the cycle. 2. Identify risks (event-based or asset-based). 3. Analyse likelihood and impact on the 5 x 5 scale. 4. Evaluate against bands and criteria. 5. Report	Updated risk register, risk assessment report	R-02, R-03, G-06, risk owners

6.2 O-05 Incident management

Suppliers	Inputs	Process steps	Outputs	Customers
All staff, monitoring provider, customers, suppliers	Event reports, alerts, threat intelligence	1. Report and log. 2. Assess and classify. 3. Contain, eradicate, recover. 4. Notify where required. 5. Review and learn	Incident records, notifications, post-incident reviews	Customers, authorities where required, R-01, G-07, G-06

6.3 G-05 Internal audit

Suppliers	Inputs	Process steps	Outputs	Customers
G-06, R-01, previous audits	Audit programme, risk results, previous findings, process changes	1. Plan the audit. 2. Prepare checklist. 3. Collect evidence. 4. Report findings. 5. Follow up	Audit report, nonconformities, observations	G-07, G-06, process owners

6.4 G-06 Management review

Suppliers	Inputs	Process steps	Outputs	Customers
G-04, G-05, R-01, O-05, G-01, S-01	Status of previous actions, changes in issues and parties, performance, audit results, risk status, opportunities	1. Collect inputs. 2. Hold the review. 3. Decide. 4. Record minutes. 5. Track actions	Decisions on improvement and changes, resource decisions, minutes	G-03, G-07, S-01, all owners

7. Mapping of processes to clauses

Clause (ISO/IEC 27001:2022)	Short label (own words)	Process
4.1	Issues	G-01
4.2	Interested parties and requirements	G-01
4.3	Scope	G-01
4.4	ISMS and its processes	G-01, this document
5.1	Leadership and commitment	G-02
5.2	Policy	G-02
5.3	Roles, responsibilities and authorities	G-02
6.1.1	Risks and opportunities, general	R-01, G-03
6.1.2	Risk assessment	R-01
6.1.3	Risk treatment and SoA	R-02, R-03
6.2	Objectives	G-03
6.3	Planning of changes	G-03
7.1	Resources	S-01
7.2	Competence	S-02
7.3	Awareness	S-02
7.4	Communication	S-03
7.5	Documented information	S-04
8.1	Operational planning and control	O-01
8.2	Performing risk assessments	R-01
8.3	Implementing risk treatment	R-02, O-01
9.1	Monitoring and measurement	G-04
9.2	Internal audit	G-05
9.3	Management review	G-06
10.1	Continual improvement	G-07
10.2	Nonconformity and corrective action	G-07

Annex A control groups mapped to operational processes (Example):

Process	Main Annex A controls (number and own label)
O-02	A.5.15 to A.5.18 access rules, identity, authentication information, access rights; A.8.2 to A.8.5 privileged access, access restriction, source code access, secure authentication
O-03	A.8.9 configuration management, A.8.32 change management
O-04	A.5.7 threat intelligence, A.8.8 technical vulnerabilities
O-05	A.5.24 to A.5.28 incident planning, assessment, response, learning, evidence; A.6.8 event reporting
O-06	A.5.19 to A.5.23 supplier relationships, agreements, ICT supply chain, monitoring, cloud services
O-07	A.5.29 security during disruption, A.5.30 ICT readiness, A.8.13 backup, A.8.14 redundancy
O-01	A.5.37 documented operating procedures and the remaining controls marked applicable in the SoA

Keep these labels consistent with the SoA (DOC-ISMS-011, compliance/statement-of-applicability).

8. Process performance indicators

Process	Indicator	Target (Example)	Source	Frequency
G-01	Context analysis reviewed within 12 months	100%	Revision history	Annually
G-03	Objectives on track	At least 80%	Objectives register	Quarterly
G-05	Audit programme completed as planned	100% of planned audits in the cycle	Audit programme	Quarterly
G-06	Management review actions closed by due date	At least 90%	Action log	Quarterly
G-07	Corrective actions closed within agreed time	At least 85%	CAPA records	Monthly
R-01	Risk assessment cycle completed on schedule	Yes	Assessment report	Annually
R-03	Accepted risks past their review date	0	Acceptance register	Monthly
O-02	Leaver accounts disabled within 24 hours	At least 98%	Identity system	Monthly
O-03	Changes with security review before production	100% of high-risk changes	Change records	Monthly
O-04	Critical vulnerabilities fixed within target time	At least 95%	Remediation tracker	Monthly
O-05	Incidents reported to customers within contract deadline	100%	Incident register	Monthly
O-06	Critical suppliers assessed within 12 months	100%	Supplier register	Quarterly
O-07	ICT recovery tests meeting the recovery time objective	100% of tests	Test reports	Per test
S-02	Staff with current awareness training	At least 95%	Training records	Monthly
S-04	Documents past review date	Under 5%	Document register	Monthly

Full definitions (formula, data source, owner, thresholds) belong in the measurement programme (DOC-ISMS-080, isms/isms-measurement-programme), and results in the performance report (DOC-ISMS-081).

9. Process owner duties and process description minimum

Each process owner:

keeps the process description current and approved;
makes sure the people who run the process are competent and aware;
monitors the process indicators and acts on adverse trends;
keeps the records listed in section 12 for their process;
reports status and issues to the ISMS manager for management review;
raises changes to the process through the ISMS change plan when the change affects the ISMS (DOC-ISMS-025);
takes part in internal audits of the process and owns its corrective actions.

Minimum content of a process description (one page is often enough):

Process ID and name:
Owner and deputy:
Purpose:
Trigger (event or schedule):
Inputs and their suppliers:
Steps (5 to 10 lines):
Outputs and their customers:
Records produced and where kept:
Indicators (link to DOC-ISMS-080):
Related procedures and policies (document IDs):
Clauses and Annex A controls served:
Last review date:

10. Process review and maturity

Once a year, before management review, each owner rates the process on this simple scale:

Level	Description
1 Initial	Done, but depends on individuals; few records
2 Repeatable	Documented steps, records kept, owner known
3 Defined	Description approved, indicators measured, staff trained
4 Measured	Indicators reviewed and acted on, targets met most of the time
5 Improving	Lessons from audits, incidents and indicators change the process

Process	Level last year	Level now	Main gap	Improvement action
O-06 (Example)	1	2	No register of critical suppliers before the project	Supplier register built, assessments scheduled (IMP-004)
G-04 (Example)	2	3	Indicators defined but not reviewed	Quarterly performance report introduced
[Process]	[n]	[n]	[Gap]	[Action]

Improvement actions go to the continual improvement register (DOC-ISMS-088, isms/continual-improvement-register).

11. Size tiers

Aspect	Small: Quillmere Analytics Ltd (Example)	Medium: Quillmere Health Systems (Example)	Large: Quillmere Group (Example)
Profile	46 staff (38 employees, 8 contractors), B2B SaaS, part-time ISMS manager (0.5 FTE, the Head of Engineering Operations)	320 staff, full-time ISMS manager plus 3-person security team, two offices and a colocation suite	2,400 staff, 6 sites in 4 countries, OT and IT, CISO with a 14-person security office, integrated management system with ISO 9001 and ISO 22301
Number of processes	About 14, by merging (for example G-03 into G-02, R-03 into R-02, O-02 to O-04 as one "IT security operations" process, S-01 to S-04 as one support process: 6 governance, 2 risk, 5 operational, 1 support)	21 as in section 4	21 group processes plus site-level operational processes for OT (for example plant access and OT change)
Owners	4 people own everything: CEO, ISMS manager (the Head of Engineering Operations), CTO, finance and people lead	13 named owner roles, as in section 4	Group process owners in the CISO office, with site owners for operational processes
Segregation guardrail	The ISMS manager must not audit their own processes: internal audit outsourced or done by a trained peer from another function	Internal audit by a separate trained auditor	Internal audit function independent of the CISO office
Shared processes	None	Change and supplier processes shared with IT operations	Document control, internal audit, management review and improvement shared with the ISO 9001 and ISO 22301 systems
Description form	One page per merged process	Process descriptions per section 9	Group process manual plus site annexes

12. Records and evidence

Process	Records that prove it operates	Owner	Where kept	Retention (Example)
G-01	Approved context analysis, scope statement	[@isms-manager]	Document system	3 years after supersession
G-02	Signed policy, communication evidence, role assignments	[@ceo]	Document system	3 years after supersession
G-03	Objectives register, change plans	[@ciso]	GRC tool or register	3 years
G-04	Measurement results, performance reports	[@isms-manager]	Reporting folder	3 years
G-05	Audit programme, reports, checklists	[@internal-audit-lead]	Audit folder	3 years or one certification cycle
G-06	Management review minutes and action log	[@ceo]	Board or ISMS folder	3 years or one certification cycle
G-07	Nonconformity and corrective action records	[@isms-manager]	CAPA register	3 years after closure
R-01 to R-03	Risk register snapshots, assessment reports, acceptance records	[@risk-manager]	GRC tool	3 years
O-01 to O-07	Access reviews, change records, vulnerability tracker, incident register, supplier assessments, test reports	Process owners	Operational systems	Per retention schedule
S-01 to S-04	Budget approvals, training records, communication log, document register	Process owners	HR, finance and document systems	Per retention schedule

Link each record type to the controls it evidences in the control evidence matrix (DOC-ISMS-033, isms/control-evidence-matrix), and list the process map itself in the documented information register (DOC-ISMS-028). The annual calendar (DOC-ISMS-032, isms/isms-annual-calendar) schedules the recurring process activities.

13. References

Reference	Edition	Use
ISO/IEC 27001:2022, ISMS requirements	2022, https://www.iso.org/standard/82875.html	Clauses 4.4, 8.1 and the clause mapping
ISO/IEC 27001:2022/Amd 1:2024	2024-02-23, https://www.iso.org/standard/88435.html	Climate action changes to 4.1 and 4.2 (G-01)
ISO/IEC TS 27022:2021, ISMS processes	2021, https://www.iso.org/standard/61004.html	Orientation for the process grouping; under systematic review
ISO/IEC 27002:2022, controls	2022, https://www.iso.org/standard/75652.html	Control guidance for operational processes
ISO/IEC 27003:2017, ISMS guidance	2017, https://www.iso.org/standard/63417.html	Clause explanations; a revision is in progress, check for a newer edition
ISO/IEC 27004:2016, measurement	2016, https://www.iso.org/standard/64120.html	Process indicators; under revision

Related templates: isms/isms-context-interested-parties, isms/isms-roles-raci, isms/isms-manual, isms/isms-measurement-programme, isms/isms-performance-report, isms/isms-annual-calendar, isms/control-evidence-matrix, isms/continual-improvement-register, compliance/statement-of-applicability, isms/iso-27000-family-map.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024, clauses 4.4 and 8.1, with the process grouping loosely oriented on ISO/IEC TS 27022:2021. The process names, register, SIPOC tables, indicators, maturity scale and guidance are original text. No ISO or IEC text, process descriptions or tables are reproduced; read the official standards, sold by ISO, IEC and national standards bodies, for the exact requirements. Check the current edition of each standard before use. This is a documentation format, not certification or legal advice. Template licence: MIT.

Related templates

ISMS & ISO/IEC 27001