ISMS Annual Calendar Template (ISO/IEC 27001 Recurring Activities)
12-month ISMS calendar: fixed dates, 30 recurring activities with owners and evidence, month view, Gantt chart, size tiers, rescheduling rules
SGSI e ISO/IEC 27001CompletaISO/IEC 27001:2022 + Amd 1:2024 clauses 8.1, 9.1 to 9.3 (cited only); ISO/IEC 17021-1:2015annualcalendardiagram
Cómo usar: Use it at the start of each ISMS year once the external audit date is known. Fill the fixed dates first and work backwards: internal audit before management review, management review before the external audit. The main pitfall is a calendar that is not in a real scheduling tool with owners and evidence links.
Vista previa
ISMS Annual Calendar: [Organization name], [Year]
Twelve-month plan of the recurring activities that keep the information security management system (ISMS) of [Organization name] running and produce the records an auditor expects: access reviews, risk and policy reviews, awareness and phishing, backup, disaster recovery and continuity tests, penetration testing, supplier reviews, key rotation, internal audit, management review and the external surveillance audit. It supports ISO/IEC 27001:2022 + Amd 1:2024 clauses 6.1, 8.1, 9.1, 9.2 and 9.3 and the operation of the Annex A controls named in each row. Replace every
[bracketed]value and every row marked Example.
Document control
| Field | Value |
|---|---|
| Document ID | [DOC-ISMS-032] |
| Version | [2027 v1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@ciso], [@coo] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024 |
| ISMS year covered | [YYYY-MM-DD to YYYY-MM-DD] |
| External audit dates | [Surveillance 1 / Surveillance 2 / Recertification, YYYY-MM-DD] |
| Certification cycle reference | [DOC-ISMS-094, certification cycle plan] |
| Next scheduled review | [Quarterly at the steering committee, next YYYY-MM-DD] |
Approvals
| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS owner | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Chief information security officer | [@ciso] | [Reviewed] | YYYY-MM-DD |
| Top management | [@coo] | [Approved] | YYYY-MM-DD |
Revision history
| Version | Date | Author | Change |
|---|---|---|---|
| 2027 v1.0 (Example) | YYYY-MM-DD | [@isms-manager] | Calendar for the first surveillance year |
| 2027 v1.1 (Example) | YYYY-MM-DD | [@isms-manager] | Incident response exercise moved from November to October so that it finishes before the readiness health check; approved by the CISO |
| [version] | YYYY-MM-DD | [@author] | [Change summary] |
Contents
- Purpose and planning rules
- Fixed dates and dependencies
- Activity register
- Month-by-month calendar
- Calendar chart
- Size tiers
- Rescheduling and missed activities
- Records and evidence
- Review of the calendar
- References
1. Purpose and planning rules
This calendar schedules every recurring ISMS activity for [Year] so that controls operate at the frequency stated in policies and standards, and so that the records needed for the internal audit, the management review and the external audit are produced in good time.
Planning rules:
- Clause sequence. Internal audit (9.2) and the performance report (9.1) are completed before the management review (9.3). The management review is completed before the external audit.
- Spread the load. No more than [3] major activities in one month for the same team.
- Frequency from the source. Each activity's frequency comes from the policy, standard, contract or risk treatment that requires it; the source is named in the activity register.
- One owner, one record. Each activity has one accountable owner and one named record stored in a known location.
- Lead time. Reminders go out [10] working days before each activity; external testers and auditors are booked at least [8] weeks ahead.
- Freeze periods. Avoid scheduling disruptive tests during [peak trading periods, year-end close or major releases].
2. Fixed dates and dependencies
| Fixed point | Date (Example) | Set by | Dependent activities |
|---|---|---|---|
| Surveillance audit 1 | 2027-11-15 to 2027-11-17 | Certification body | Management review, internal audit, readiness health check |
| Management review | 2027-08-26 | Top management | Internal audit report, performance report, risk review |
| Internal audit window | 2027-06-07 to 2027-07-16 | Internal audit programme (DOC-ISMS-082) | Audit plan, auditor availability |
| Annual risk assessment | 2027-04-05 to 2027-04-30 | Risk methodology (DOC-ISMS-010) | Context review, SoA review |
| Peak business period (freeze) | 2027-12-01 to 2027-12-31 | Business | No disruptive tests in December |
| Financial year budget approval | 2027-10-15 | Finance | Next year's ISMS budget and test bookings |
3. Activity register
| ID | Activity | Clause or control | Frequency (source) | Months (Example) | Owner | Evidence produced |
|---|---|---|---|---|---|---|
| CAL-001 (Example) | User access review of in-scope systems | A.5.15, A.5.18 | Quarterly (access control policy DOC-ISMS-041) | Mar, Jun, Sep, Dec | [@it-ops-lead] | Signed review per system, removal tickets |
| CAL-002 (Example) | Privileged access review | A.8.2 | Quarterly (privileged access standard) | Mar, Jun, Sep, Dec | [@iam-lead] | Privileged account list with approvals |
| CAL-003 (Example) | Physical access list review | A.7.2 | Quarterly (physical security policy DOC-ISMS-055) | Feb, May, Aug, Nov | [@facilities-lead] | Badge list review record |
| CAL-004 (Example) | Context, interested parties and climate change issue review | Clauses 4.1, 4.2 | Annual (DOC-ISMS-003) | Apr | [@isms-manager] | Updated context register with review date |
| CAL-005 (Example) | Legal, regulatory and contractual register review | A.5.31 | Half-yearly (DOC-ISMS-014) | Jan, Jul | [@legal-lead] | Register version and change log |
| CAL-006 (Example) | Annual risk assessment | Clauses 6.1.2, 8.2 | Annual plus on change (DOC-ISMS-010) | Apr | [@isms-manager] | Risk assessment report (DOC-ISMS-017), updated register |
| CAL-007 (Example) | Risk register and treatment progress review | Clauses 6.1.3, 8.3 | Quarterly | Jan, Apr, Jul, Oct | [@isms-manager] | Register snapshot, treatment plan status |
| CAL-008 (Example) | Statement of Applicability review | Clause 6.1.3 d | Annual, after risk assessment | May | [@isms-manager] | SoA new version or reviewed-unchanged record |
| CAL-009 (Example) | Policy and standard reviews | A.5.1, clause 7.5 | Annual per document (DOC-ISMS-005) | Rolling, peak in May | Policy owners | Approved versions, review records |
| CAL-010 (Example) | Asset inventory reconciliation | A.5.9 | Half-yearly (DOC-ISMS-012) | Mar, Sep | [@it-ops-lead] | Reconciliation report, variance tickets |
| CAL-011 (Example) | Annual awareness training campaign | A.6.3 | Annual plus at onboarding (security awareness programme) | Feb | [@awareness-lead] | Completion report from the learning platform |
| CAL-012 (Example) | Phishing simulation | A.6.3, A.6.8 | Quarterly (DOC-ISMS-074) | Jan, Apr, Jul, Oct | [@awareness-lead] | Campaign results, follow-up training list |
| CAL-013 (Example) | Competence and training matrix review | Clause 7.2 | Annual (DOC-ISMS-026) | Mar | [@hr-lead] | Updated matrix, training plan |
| CAL-014 (Example) | Backup restore test | A.8.13 | Quarterly (backup policy DOC-ISMS-061) | Feb, May, Aug, Nov | [@it-ops-lead] | Restore test log entries (DOC-ISMS-071) |
| CAL-015 (Example) | Disaster recovery test | A.5.30, A.8.14 | Annual (ICT readiness plan DOC-ISMS-047) | Sep | [@it-ops-lead] | DR test report, actions |
| CAL-016 (Example) | Business continuity tabletop exercise | A.5.29 | Annual (DOC-ISMS-121) | May | [@bc-lead] | Exercise report, lessons learned |
| CAL-017 (Example) | Incident response exercise | A.5.24, A.5.26 | Annual (DOC-ISMS-020) | Oct | [@incident-manager] | Exercise record, updated playbooks |
| CAL-018 (Example) | External penetration test | A.8.8, A.8.29 | Annual and after major change | Mar | [@security-lead] | Test report, remediation tickets |
| CAL-019 (Example) | Vulnerability scanning and remediation review | A.8.8 | Monthly scans, monthly review (DOC-ISMS-072) | Every month | [@vuln-lead] | Scan reports, tracker status |
| CAL-020 (Example) | Firewall and network rule review | A.8.20, A.8.22 | Half-yearly (DOC-ISMS-063) | Jun, Dec | [@network-lead] | Rule review record, change tickets |
| CAL-021 (Example) | Critical supplier security reviews | A.5.19, A.5.22 | Annual per critical supplier (DOC-ISMS-066) | Feb to Mar | [@procurement-lead] | Supplier assessments (DOC-ISMS-067), assurance reports |
| CAL-022 (Example) | Cryptographic key rotation and certificate review | A.8.24 | Annual rotation, monthly expiry check (DOC-ISMS-070) | Jan rotation, monthly check | [@platform-lead] | Key register updates, rotation tickets |
| CAL-023 (Example) | Log review and monitoring rule tuning | A.8.15, A.8.16 | Monthly review, half-yearly tuning (DOC-ISMS-064) | Monthly, tuning in Apr and Oct | [@soc-lead] | Review sign-off, rule change records |
| CAL-024 (Example) | Metrics collection and performance report | Clause 9.1 | Monthly collection, quarterly report (DOC-ISMS-080) | Report in Jan, Apr, Jul, Oct | [@isms-manager] | Performance report (DOC-ISMS-081) |
| CAL-025 (Example) | Security steering committee | Clause 5.1 | Quarterly (DOC-ISMS-007) | Feb, May, Aug (with review), Nov | [@ciso] | Minutes and action log |
| CAL-026 (Example) | Internal audit | Clause 9.2 | Annual coverage of the full ISMS (DOC-ISMS-082) | Jun to Jul | [@internal-audit] | Audit plans, reports (DOC-ISMS-084), findings |
| CAL-027 (Example) | Management review | Clause 9.3 | Annual minimum | Aug | [@ceo] | Minutes (DOC-ISMS-085) |
| CAL-028 (Example) | Surveillance readiness health check | Clauses 9 and 10 | Annual, 6 weeks before external audit (DOC-ISMS-096) | Oct | [@isms-manager] | Health check report |
| CAL-029 (Example) | External surveillance audit | Certification cycle | Annual (DOC-ISMS-094) | Nov | [@isms-manager] | CB audit report, findings action plan (DOC-ISMS-093) |
| CAL-030 (Example) | Objectives setting and next-year calendar | Clauses 6.2, 8.1 | Annual | Dec | [@isms-manager] | Objectives register, calendar for next year |
| [CAL-NNN] | [activity] | [clause or control] | [frequency and source] | [months] | [@owner] | [evidence] |
4. Month-by-month calendar
| Month (2027 Example) | Activities (register IDs) | Key deliverable | Watch point |
|---|---|---|---|
| January | Legal register review (CAL-005), risk register review (CAL-007), phishing (CAL-012), key rotation (CAL-022), Q4 performance report (CAL-024) | Q4 performance report | Key rotation completed before certificates enter the 30-day expiry window |
| February | Awareness campaign (CAL-011), physical access review (CAL-003), restore test (CAL-014), supplier reviews start (CAL-021), steering committee (CAL-025) | Awareness completion above 95% by month end | New joiners from January included |
| March | Access reviews (CAL-001, CAL-002), asset reconciliation (CAL-010), competence review (CAL-013), penetration test (CAL-018), supplier reviews end (CAL-021) | Penetration test report | Test scheduled outside the release freeze |
| April | Context review (CAL-004), annual risk assessment (CAL-006), risk register review (CAL-007), phishing (CAL-012), monitoring tuning (CAL-023), Q1 report (CAL-024) | Risk assessment report | Context review completed first, so new issues feed the risk assessment |
| May | SoA review (CAL-008), policy review peak (CAL-009), physical access review (CAL-003), restore test (CAL-014), BC tabletop (CAL-016), steering committee (CAL-025) | Updated SoA and policies | Policies approved before the internal audit starts |
| June | Access reviews (CAL-001, CAL-002), firewall rule review (CAL-020), internal audit starts (CAL-026) | Audit plans issued | Auditees briefed; auditors independent of the areas they audit |
| July | Legal register review (CAL-005), risk register review (CAL-007), phishing (CAL-012), Q2 report (CAL-024), internal audit ends (CAL-026) | Internal audit reports | Findings logged in DOC-ISMS-086 within 5 working days |
| August | Physical access review (CAL-003), restore test (CAL-014), management review with steering committee (CAL-025, CAL-027) | Management review minutes | All clause 9.3 inputs present, including audit results and the performance report |
| September | Access reviews (CAL-001, CAL-002), asset reconciliation (CAL-010), DR test (CAL-015) | DR test report | Recovery measured against RTO and RPO from the BIA |
| October | Risk register review (CAL-007), phishing (CAL-012), incident exercise (CAL-017), monitoring tuning (CAL-023), Q3 report (CAL-024), readiness health check (CAL-028) | Health check report | Corrective actions from the internal audit closed or on track |
| November | Physical access review (CAL-003), restore test (CAL-014), steering committee (CAL-025), surveillance audit (CAL-029) | CB audit report | Findings action plan submitted by the CB's deadline |
| December | Access reviews (CAL-001, CAL-002), firewall rule review (CAL-020), objectives and next calendar (CAL-030) | Objectives and calendar for next year | Freeze period: reviews only, no disruptive tests |
Monthly activities not repeated in every row: vulnerability scanning and review (CAL-019), log review (CAL-023), certificate expiry check (CAL-022) and metrics collection (CAL-024).
5. Calendar chart
The chart shows the main annual and quarterly activities for the 2027 example year. Monthly activities are omitted for readability.
6. Size tiers
| Aspect | Small: Quillmere Analytics Ltd (Example) | Medium: Quillmere Health Systems (Example) | Large: Quillmere Group (Example) |
|---|---|---|---|
| Profile | 46 staff (38 employees, 8 contractors), one office plus remote staff, SaaS on one public cloud in two regions | 320 staff, two offices, one colocation suite | 2,400 staff, 6 sites in 4 countries, IT and OT, already certified to ISO 9001 and ISO 22301 |
| Who runs the calendar | Part-time ISMS manager (0.5 FTE, Head of Engineering Operations) in the team's ticketing tool | Full-time ISMS manager with a 3-person security team, GRC tool or shared calendar | Security office of 14 under the CISO, one group calendar plus site calendars inside the integrated management system |
| Access reviews | Quarterly for the cloud console, identity provider and code repository (about 6 systems) | Quarterly for about 25 systems, monthly for privileged accounts on clinical systems | Quarterly per site, monthly for privileged and OT engineering accounts |
| Physical reviews | Office badge list half-yearly; data centres covered by provider assurance reports | Quarterly for offices and the colocation suite | Quarterly per site, including plant control rooms |
| Testing | One annual penetration test of the SaaS platform; restore tests quarterly; region failover test annually | Annual penetration test plus application test before major releases; DR test of the colocation suite | Penetration tests rotated across sites, OT assessments per plant, group DR test of the data centre |
| Internal audit | One auditor (external contractor or a trained colleague outside engineering), 3 to 4 days in one window | Internal audit spread over 6 weeks, auditors from quality and finance trained in ISO 19011 | Rolling audit programme across 6 sites, integrated with ISO 9001 and ISO 22301 audits |
| External audits | Surveillance audit once a year at one location | Surveillance audit once a year covering offices and colocation | Surveillance audit with site sampling set by the certification body, integrated audit where the CB offers it |
| Phasing | One calendar for the whole company | One calendar; separate dates for the colocation suite | Group calendar for shared activities; site calendars follow the phased certification by site |
Small organisations can combine activities in the same week (for example access review and asset reconciliation) to save effort, as long as each produces its own record.
7. Rescheduling and missed activities
| Situation | Rule | Approval | Record |
|---|---|---|---|
| Activity moved within the same quarter | Allowed if the frequency in the source document is still met | Activity owner informs the ISMS manager | Revision history of the calendar |
| Activity moved to a later quarter | Allowed only with a reason and a new date | CISO approves | Revision history and steering committee minutes |
| Activity missed | Treat as a potential nonconformity: assess the impact on the control and the risk | ISMS manager assesses; CISO decides | Entry in DOC-ISMS-087 or a recorded rationale |
| Activity no longer needed | Remove only after the source document or risk treatment is changed | Document owner and ISMS manager | Updated source document and calendar |
Track completion as a metric: "calendar activities completed in the planned month" is a useful ISMS management indicator in the measurement programme (DOC-ISMS-080).
8. Records and evidence
| Record | Proves | Kept by | Location | Retention (Example) |
|---|---|---|---|---|
| Approved calendar per ISMS year | Operational planning (8.1) | ISMS manager | Document management system | 3 years (one certification cycle) |
| Planned versus actual tracker | Activities happened as planned or were rescheduled with approval | ISMS manager | GRC tool or calendar export | 3 years |
| Activity records (column "Evidence produced" in section 3) | Each control operated at its frequency | Activity owners | Locations named in DOC-ISMS-033 | As set per record in DOC-ISMS-028 |
| Rescheduling approvals | Changes were controlled | ISMS manager | Revision history and minutes | 3 years |
| Reminder and booking confirmations for external tests and audits | Lead times met | Activity owners | E-mail or ticketing | 1 year |
The control evidence matrix (isms/control-evidence-matrix,
DOC-ISMS-033) lists the same records per clause and control with the
last collection date; update both documents together.
9. Review of the calendar
- Review progress against the calendar at each quarterly steering committee and record slipped activities.
- Rebuild the calendar each December for the next year, after the certification body confirms the next audit date.
- Update the calendar within one month when a new policy, standard, contract or risk treatment adds a recurring activity, or when the scope changes.
- In a recertification year, bring the internal audit and management review forward so that the full ISMS is covered before the recertification audit (see DOC-ISMS-094).
10. References
| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024 | https://www.iso.org/standard/82875.html ; https://www.iso.org/standard/88435.html | Clauses 8.1, 9.1, 9.2, 9.3 and Annex A controls named in the register |
| ISO/IEC 27002:2022 | https://www.iso.org/standard/75652.html | Guidance on operating each control |
| ISO/IEC 17021-1:2015 | https://www.iso.org/standard/61651.html | Surveillance audits at least once a calendar year, recertification before expiry |
| ISO 19011:2026 | https://www.iso.org/standard/88984.html | Guidance for planning internal audits |
Related templates: isms/control-evidence-matrix (DOC-ISMS-033),
isms/isms-measurement-programme (DOC-ISMS-080),
isms/isms-performance-report (DOC-ISMS-081),
compliance/internal-audit-program (DOC-ISMS-082),
compliance/management-review (DOC-ISMS-085),
isms/certification-cycle-plan (DOC-ISMS-094),
isms/surveillance-readiness-health-check (DOC-ISMS-096),
ops/access-review, isms/phishing-simulation-plan (DOC-ISMS-074),
isms/backup-restore-test-log (DOC-ISMS-071),
isms/cryptographic-key-register (DOC-ISMS-070),
isms/supplier-register (DOC-ISMS-066).
Standard and licence note
Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clauses 8.1 and 9.1 to 9.3 and the certification cycle described in ISO/IEC 17021-1:2015. The activities, frequencies, months and dates are original, illustrative examples; the standards ask for planned intervals and leave frequencies to the organization. No ISO or IEC text is reproduced, and you need the official standards to apply the requirements. ISO and IEC standards are copyrighted and sold by ISO, IEC and national standards bodies. Check the current edition and amendments, and your certification body's rules, before use. Template licence: MIT.
Plantillas relacionadas
SGSI e ISO/IEC 27001
Certification Cycle Plan Template (ISO/IEC 27001 3-year cycle)
3-year certificate cycle, timing rules, Gantt timeline, audit coverage, change notifications, suspension and withdrawal, recertification, transfers, budget
SGSI e ISO/IEC 27001ISMS Implementation Roadmap Template (ISO/IEC 27001)
Phases 0 to 10 from decision to Stage 2, entry and exit criteria, deliverables by template, durations and Gantt charts per tier, critical path, delays
SGSI e ISO/IEC 27001Access Control Policy Template (ISO/IEC 27001 A.5.15)
Access principles, role catalogue, joiner mover leaver SLAs, MFA and NIST SP 800-63B-4 password rules, privileged and service accounts, reviews, metrics