Kit SMSI ISO/IEC 27001

Management system scope (cl. 4.3): 4.1 issues incl. climate and AI role, 4.2 parties, scope sentence (QMS and ISO 42001 examples), interfaces, exclusions

ISMS policy – CIA commitments, sub-policies

Legal, regulatory and contractual register (ISO/IEC 27001 A.5.31, ISO 14001/45001 6.1.3): dated EU, UK, US example rows, control mapping, change log

Clause 4 to 10 readiness scoring (0 to 5), Annex A summary by theme (93 controls), gap register with severity, readiness decision and Stage 1 roadmap

Risk criteria and score-only bands, acceptance authority, event or asset-based assessment steps, treatment options, outputs, AI-risk variant (ISO/IEC 42001)

Asset inventory: classification and labelling scheme, defined CIA scale, information and associated assets, return and disposal rules, lifecycle log

Risk register with appetite, inherent and residual scores, Annex A controls, owner acceptance with expiry, inherent and residual heat maps, review log

Treatment actions per risk with Annex A controls, budget and target residual, pending decisions, progress tracking, signed risk owner approval and residual acceptance with expiry

All 93 ISO/IEC 27001:2022 Annex A controls in 4 themes, applicability, basis, justification, status, evidence, exclusions, extra controls, traceability

Objectives register (ISO cl. 6.2): objectives traced to policy or risk, metric, baseline, target, action plans with resources, review log, communication

Staff AUP: general rules, use by channel, generative AI and shadow AI, BYOD, removable media, clear desk, monitoring notice, exceptions, acknowledgment

Supplier tiering with review intervals, security posture checklist, secure development and SBOM questions, concentration and exit risk, NIS2, DORA, CRA, GDPR hooks, decision

IR policy, CSF 2.0 mapping, roles, classification, containment, evidence and chain of custody, TLP 2.0, GDPR/NIS2/DORA/CRA notification clocks, metrics

Stand-alone BIA: impact criteria, impact over time, MTPD, RTO, RPO, MBCO, prioritized activities, resources, dependencies, gaps, links to BCP and DR

BCP: BIA method, prioritized activities (MTPD, RTO, RPO, MBCO), resources, scenarios, strategies, activation flow, recovery, comms, exercise programme

Controlled document master: header, approvals, revision history, distribution, body, records produced, change control, clause 7.5 control map, numbering, status lifecycle

Policy exception and risk acceptance form: requirement not met, justification, inherent and residual risk, compensating controls, approver tiers, expiry, lifecycle

Audit schedule + report with findings

Management review minutes: inputs mapped to ISO 9001:2026, ISO/IEC 27001:2022 and 42001:2023, conclusions, results, action log

Nonconformity and CAPA record: description, containment, root cause, similar nonconformities check, actions, effectiveness, closure; ISO 13485 and QMSR notes