# ISMS Annual Calendar: [Organization name], [Year]

> Twelve-month plan of the recurring activities that keep the
> information security management system (ISMS) of [Organization name]
> running and produce the records an auditor expects: access reviews,
> risk and policy reviews, awareness and phishing, backup, disaster
> recovery and continuity tests, penetration testing, supplier reviews,
> key rotation, internal audit, management review and the external
> surveillance audit. It supports ISO/IEC 27001:2022 + Amd 1:2024
> clauses 6.1, 8.1, 9.1, 9.2 and 9.3 and the operation of the Annex A
> controls named in each row. Replace every `[bracketed]` value and
> every row marked *Example*.

<!--
Guidance: How to use this template
- When to use: at the start of each ISMS year, after the management
  review has set objectives and the certification body has confirmed
  the surveillance or recertification audit date.
- Fill first: the fixed dates (external audit, management review,
  internal audit window), then work backwards: the internal audit must
  finish before management review, and management review before the
  external audit.
- Main pitfall: a calendar that exists only as a document. Put every
  activity into the shared calendar or ticketing system with an owner,
  a reminder and a link to where the evidence is stored. An activity
  without a record did not happen, as far as an auditor is concerned.
- The example year is 2027 for an organisation with a surveillance
  audit in November. Shift the months to your own audit date.
- Related templates: `isms/control-evidence-matrix`,
  `isms/isms-measurement-programme`, `compliance/internal-audit-program`,
  `compliance/management-review`, `ops/access-review`,
  `isms/phishing-simulation-plan`, `isms/backup-restore-test-log`,
  `isms/certification-cycle-plan`, `isms/surveillance-readiness-health-check`.
-->

## Document control

<!-- Guidance: Issue a new version of the calendar for each ISMS year and record moved dates in the revision history, with the reason. Auditors compare the planned and actual dates. -->

| Field | Value |
|---|---|
| Document ID | [DOC-ISMS-032] |
| Version | [2027 v1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@ciso], [@coo] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024 |
| ISMS year covered | [YYYY-MM-DD to YYYY-MM-DD] |
| External audit dates | [Surveillance 1 / Surveillance 2 / Recertification, YYYY-MM-DD] |
| Certification cycle reference | [DOC-ISMS-094, certification cycle plan] |
| Next scheduled review | [Quarterly at the steering committee, next YYYY-MM-DD] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS owner | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Chief information security officer | [@ciso] | [Reviewed] | YYYY-MM-DD |
| Top management | [@coo] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 2027 v1.0 *(Example)* | YYYY-MM-DD | [@isms-manager] | Calendar for the first surveillance year |
| 2027 v1.1 *(Example)* | YYYY-MM-DD | [@isms-manager] | Incident response exercise moved from November to October so that it finishes before the readiness health check; approved by the CISO |
| [version] | YYYY-MM-DD | [@author] | [Change summary] |

## Contents

1. Purpose and planning rules
2. Fixed dates and dependencies
3. Activity register
4. Month-by-month calendar
5. Calendar chart
6. Size tiers
7. Rescheduling and missed activities
8. Records and evidence
9. Review of the calendar
10. References

## 1. Purpose and planning rules

<!-- Guidance: Explain what the calendar is for and the rules used to build it. Questions: which activities are mandatory under the standard, which come from your controls and policies, and which from contracts? Pitfall: piling everything into the two months before the external audit, which overloads people and produces thin evidence. -->

This calendar schedules every recurring ISMS activity for [Year] so
that controls operate at the frequency stated in policies and
standards, and so that the records needed for the internal audit, the
management review and the external audit are produced in good time.

Planning rules:

1. **Clause sequence.** Internal audit (9.2) and the performance report
   (9.1) are completed before the management review (9.3). The
   management review is completed before the external audit.
2. **Spread the load.** No more than [3] major activities in one month
   for the same team.
3. **Frequency from the source.** Each activity's frequency comes from
   the policy, standard, contract or risk treatment that requires it;
   the source is named in the activity register.
4. **One owner, one record.** Each activity has one accountable owner
   and one named record stored in a known location.
5. **Lead time.** Reminders go out [10] working days before each
   activity; external testers and auditors are booked at least [8]
   weeks ahead.
6. **Freeze periods.** Avoid scheduling disruptive tests during
   [peak trading periods, year-end close or major releases].

## 2. Fixed dates and dependencies

<!-- Guidance: Enter the dates that others set first: the certification body's audit, board meetings, financial year end, peak business periods. Then place the dependent activities. An auditor will check that the internal audit covered the ISMS before the management review took place. -->

| Fixed point | Date *(Example)* | Set by | Dependent activities |
|---|---|---|---|
| Surveillance audit 1 | 2027-11-15 to 2027-11-17 | Certification body | Management review, internal audit, readiness health check |
| Management review | 2027-08-26 | Top management | Internal audit report, performance report, risk review |
| Internal audit window | 2027-06-07 to 2027-07-16 | Internal audit programme (DOC-ISMS-082) | Audit plan, auditor availability |
| Annual risk assessment | 2027-04-05 to 2027-04-30 | Risk methodology (DOC-ISMS-010) | Context review, SoA review |
| Peak business period (freeze) | 2027-12-01 to 2027-12-31 | Business | No disruptive tests in December |
| Financial year budget approval | 2027-10-15 | Finance | Next year's ISMS budget and test bookings |

```mermaid
flowchart LR
  A["Context and legal review (Apr)"] --> B["Annual risk assessment (Apr)"]
  B --> C["SoA and policy review (May)"]
  C --> D["Internal audit (Jun to Jul)"]
  D --> E["Performance report (Jul)"]
  E --> F["Management review (Aug)"]
  F --> G["Readiness health check (Oct)"]
  G --> H["Surveillance audit (Nov)"]
  H --> I["Objectives and calendar for next year (Dec)"]
```

## 3. Activity register

<!-- Guidance: One row per recurring activity. Name the clause or control it serves, the source of the frequency, the owner and the record. Use the same record names as the control evidence matrix (DOC-ISMS-033) so the two documents agree. -->

| ID | Activity | Clause or control | Frequency (source) | Months *(Example)* | Owner | Evidence produced |
|---|---|---|---|---|---|---|
| CAL-001 *(Example)* | User access review of in-scope systems | A.5.15, A.5.18 | Quarterly (access control policy DOC-ISMS-041) | Mar, Jun, Sep, Dec | [@it-ops-lead] | Signed review per system, removal tickets |
| CAL-002 *(Example)* | Privileged access review | A.8.2 | Quarterly (privileged access standard) | Mar, Jun, Sep, Dec | [@iam-lead] | Privileged account list with approvals |
| CAL-003 *(Example)* | Physical access list review | A.7.2 | Quarterly (physical security policy DOC-ISMS-055) | Feb, May, Aug, Nov | [@facilities-lead] | Badge list review record |
| CAL-004 *(Example)* | Context, interested parties and climate change issue review | Clauses 4.1, 4.2 | Annual (DOC-ISMS-003) | Apr | [@isms-manager] | Updated context register with review date |
| CAL-005 *(Example)* | Legal, regulatory and contractual register review | A.5.31 | Half-yearly (DOC-ISMS-014) | Jan, Jul | [@legal-lead] | Register version and change log |
| CAL-006 *(Example)* | Annual risk assessment | Clauses 6.1.2, 8.2 | Annual plus on change (DOC-ISMS-010) | Apr | [@isms-manager] | Risk assessment report (DOC-ISMS-017), updated register |
| CAL-007 *(Example)* | Risk register and treatment progress review | Clauses 6.1.3, 8.3 | Quarterly | Jan, Apr, Jul, Oct | [@isms-manager] | Register snapshot, treatment plan status |
| CAL-008 *(Example)* | Statement of Applicability review | Clause 6.1.3 d | Annual, after risk assessment | May | [@isms-manager] | SoA new version or reviewed-unchanged record |
| CAL-009 *(Example)* | Policy and standard reviews | A.5.1, clause 7.5 | Annual per document (DOC-ISMS-005) | Rolling, peak in May | Policy owners | Approved versions, review records |
| CAL-010 *(Example)* | Asset inventory reconciliation | A.5.9 | Half-yearly (DOC-ISMS-012) | Mar, Sep | [@it-ops-lead] | Reconciliation report, variance tickets |
| CAL-011 *(Example)* | Annual awareness training campaign | A.6.3 | Annual plus at onboarding (security awareness programme) | Feb | [@awareness-lead] | Completion report from the learning platform |
| CAL-012 *(Example)* | Phishing simulation | A.6.3, A.6.8 | Quarterly (DOC-ISMS-074) | Jan, Apr, Jul, Oct | [@awareness-lead] | Campaign results, follow-up training list |
| CAL-013 *(Example)* | Competence and training matrix review | Clause 7.2 | Annual (DOC-ISMS-026) | Mar | [@hr-lead] | Updated matrix, training plan |
| CAL-014 *(Example)* | Backup restore test | A.8.13 | Quarterly (backup policy DOC-ISMS-061) | Feb, May, Aug, Nov | [@it-ops-lead] | Restore test log entries (DOC-ISMS-071) |
| CAL-015 *(Example)* | Disaster recovery test | A.5.30, A.8.14 | Annual (ICT readiness plan DOC-ISMS-047) | Sep | [@it-ops-lead] | DR test report, actions |
| CAL-016 *(Example)* | Business continuity tabletop exercise | A.5.29 | Annual (DOC-ISMS-121) | May | [@bc-lead] | Exercise report, lessons learned |
| CAL-017 *(Example)* | Incident response exercise | A.5.24, A.5.26 | Annual (DOC-ISMS-020) | Oct | [@incident-manager] | Exercise record, updated playbooks |
| CAL-018 *(Example)* | External penetration test | A.8.8, A.8.29 | Annual and after major change | Mar | [@security-lead] | Test report, remediation tickets |
| CAL-019 *(Example)* | Vulnerability scanning and remediation review | A.8.8 | Monthly scans, monthly review (DOC-ISMS-072) | Every month | [@vuln-lead] | Scan reports, tracker status |
| CAL-020 *(Example)* | Firewall and network rule review | A.8.20, A.8.22 | Half-yearly (DOC-ISMS-063) | Jun, Dec | [@network-lead] | Rule review record, change tickets |
| CAL-021 *(Example)* | Critical supplier security reviews | A.5.19, A.5.22 | Annual per critical supplier (DOC-ISMS-066) | Feb to Mar | [@procurement-lead] | Supplier assessments (DOC-ISMS-067), assurance reports |
| CAL-022 *(Example)* | Cryptographic key rotation and certificate review | A.8.24 | Annual rotation, monthly expiry check (DOC-ISMS-070) | Jan rotation, monthly check | [@platform-lead] | Key register updates, rotation tickets |
| CAL-023 *(Example)* | Log review and monitoring rule tuning | A.8.15, A.8.16 | Monthly review, half-yearly tuning (DOC-ISMS-064) | Monthly, tuning in Apr and Oct | [@soc-lead] | Review sign-off, rule change records |
| CAL-024 *(Example)* | Metrics collection and performance report | Clause 9.1 | Monthly collection, quarterly report (DOC-ISMS-080) | Report in Jan, Apr, Jul, Oct | [@isms-manager] | Performance report (DOC-ISMS-081) |
| CAL-025 *(Example)* | Security steering committee | Clause 5.1 | Quarterly (DOC-ISMS-007) | Feb, May, Aug (with review), Nov | [@ciso] | Minutes and action log |
| CAL-026 *(Example)* | Internal audit | Clause 9.2 | Annual coverage of the full ISMS (DOC-ISMS-082) | Jun to Jul | [@internal-audit] | Audit plans, reports (DOC-ISMS-084), findings |
| CAL-027 *(Example)* | Management review | Clause 9.3 | Annual minimum | Aug | [@ceo] | Minutes (DOC-ISMS-085) |
| CAL-028 *(Example)* | Surveillance readiness health check | Clauses 9 and 10 | Annual, 6 weeks before external audit (DOC-ISMS-096) | Oct | [@isms-manager] | Health check report |
| CAL-029 *(Example)* | External surveillance audit | Certification cycle | Annual (DOC-ISMS-094) | Nov | [@isms-manager] | CB audit report, findings action plan (DOC-ISMS-093) |
| CAL-030 *(Example)* | Objectives setting and next-year calendar | Clauses 6.2, 8.1 | Annual | Dec | [@isms-manager] | Objectives register, calendar for next year |
| [CAL-NNN] | [activity] | [clause or control] | [frequency and source] | [months] | [@owner] | [evidence] |

## 4. Month-by-month calendar

<!-- Guidance: This view is for owners: what happens this month and what must be ready. Check the load per month against the planning rule in section 1. Every activity listed here must appear in the activity register. -->

| Month *(2027 Example)* | Activities (register IDs) | Key deliverable | Watch point |
|---|---|---|---|
| January | Legal register review (CAL-005), risk register review (CAL-007), phishing (CAL-012), key rotation (CAL-022), Q4 performance report (CAL-024) | Q4 performance report | Key rotation completed before certificates enter the 30-day expiry window |
| February | Awareness campaign (CAL-011), physical access review (CAL-003), restore test (CAL-014), supplier reviews start (CAL-021), steering committee (CAL-025) | Awareness completion above 95% by month end | New joiners from January included |
| March | Access reviews (CAL-001, CAL-002), asset reconciliation (CAL-010), competence review (CAL-013), penetration test (CAL-018), supplier reviews end (CAL-021) | Penetration test report | Test scheduled outside the release freeze |
| April | Context review (CAL-004), annual risk assessment (CAL-006), risk register review (CAL-007), phishing (CAL-012), monitoring tuning (CAL-023), Q1 report (CAL-024) | Risk assessment report | Context review completed first, so new issues feed the risk assessment |
| May | SoA review (CAL-008), policy review peak (CAL-009), physical access review (CAL-003), restore test (CAL-014), BC tabletop (CAL-016), steering committee (CAL-025) | Updated SoA and policies | Policies approved before the internal audit starts |
| June | Access reviews (CAL-001, CAL-002), firewall rule review (CAL-020), internal audit starts (CAL-026) | Audit plans issued | Auditees briefed; auditors independent of the areas they audit |
| July | Legal register review (CAL-005), risk register review (CAL-007), phishing (CAL-012), Q2 report (CAL-024), internal audit ends (CAL-026) | Internal audit reports | Findings logged in DOC-ISMS-086 within 5 working days |
| August | Physical access review (CAL-003), restore test (CAL-014), management review with steering committee (CAL-025, CAL-027) | Management review minutes | All clause 9.3 inputs present, including audit results and the performance report |
| September | Access reviews (CAL-001, CAL-002), asset reconciliation (CAL-010), DR test (CAL-015) | DR test report | Recovery measured against RTO and RPO from the BIA |
| October | Risk register review (CAL-007), phishing (CAL-012), incident exercise (CAL-017), monitoring tuning (CAL-023), Q3 report (CAL-024), readiness health check (CAL-028) | Health check report | Corrective actions from the internal audit closed or on track |
| November | Physical access review (CAL-003), restore test (CAL-014), steering committee (CAL-025), surveillance audit (CAL-029) | CB audit report | Findings action plan submitted by the CB's deadline |
| December | Access reviews (CAL-001, CAL-002), firewall rule review (CAL-020), objectives and next calendar (CAL-030) | Objectives and calendar for next year | Freeze period: reviews only, no disruptive tests |

Monthly activities not repeated in every row: vulnerability scanning and
review (CAL-019), log review (CAL-023), certificate expiry check
(CAL-022) and metrics collection (CAL-024).

## 5. Calendar chart

<!-- Guidance: A chart helps the steering committee see clashes and the run-up to the external audit. Keep the chart and the tables consistent: same activities, same months. -->

The chart shows the main annual and quarterly activities for the 2027
example year. Monthly activities are omitted for readability.

```mermaid
gantt
  title ISMS annual calendar 2027 (Example)
  dateFormat YYYY-MM-DD
  section Governance
  Q4 performance report :rep1, 2027-01-11, 10d
  Steering committee Feb :sc1, 2027-02-18, 1d
  Q1 performance report :rep2, 2027-04-12, 10d
  Steering committee May :sc2, 2027-05-20, 1d
  Q2 performance report :rep3, 2027-07-19, 10d
  Management review :mr1, 2027-08-26, 1d
  Q3 performance report :rep4, 2027-10-11, 10d
  Steering committee Nov :sc4, 2027-11-25, 1d
  Objectives and next calendar :obj1, 2027-12-01, 15d
  section Risk and compliance
  Legal register review Jan :leg1, 2027-01-04, 10d
  Context review :ctx1, 2027-04-01, 5d
  Annual risk assessment :ra1, 2027-04-05, 26d
  SoA and policy review :soa1, 2027-05-03, 25d
  Legal register review Jul :leg2, 2027-07-01, 10d
  section People
  Phishing Q1 :ph1, 2027-01-18, 5d
  Awareness campaign :aw1, 2027-02-01, 28d
  Phishing Q2 :ph2, 2027-04-19, 5d
  Phishing Q3 :ph3, 2027-07-19, 5d
  Phishing Q4 :ph4, 2027-10-18, 5d
  section Technical tests
  Penetration test :pt1, 2027-03-08, 10d
  BC tabletop exercise :bc1, 2027-05-13, 1d
  DR test :dr1, 2027-09-14, 2d
  Incident response exercise :ir1, 2027-10-07, 1d
  section Suppliers
  Critical supplier reviews :sup1, 2027-02-15, 40d
  section Audit
  Internal audit :ia1, 2027-06-07, 40d
  Readiness health check :hc1, 2027-10-04, 5d
  Surveillance audit :sa1, 2027-11-15, 3d
```

## 6. Size tiers

<!-- Guidance: The activities are the same in every organisation; the frequency, the number of systems and who does the work change. The settings are the library's fictional examples. -->

| Aspect | Small: Quillmere Analytics Ltd *(Example)* | Medium: Quillmere Health Systems *(Example)* | Large: Quillmere Group *(Example)* |
|---|---|---|---|
| Profile | 46 staff (38 employees, 8 contractors), one office plus remote staff, SaaS on one public cloud in two regions | 320 staff, two offices, one colocation suite | 2,400 staff, 6 sites in 4 countries, IT and OT, already certified to ISO 9001 and ISO 22301 |
| Who runs the calendar | Part-time ISMS manager (0.5 FTE, Head of Engineering Operations) in the team's ticketing tool | Full-time ISMS manager with a 3-person security team, GRC tool or shared calendar | Security office of 14 under the CISO, one group calendar plus site calendars inside the integrated management system |
| Access reviews | Quarterly for the cloud console, identity provider and code repository (about 6 systems) | Quarterly for about 25 systems, monthly for privileged accounts on clinical systems | Quarterly per site, monthly for privileged and OT engineering accounts |
| Physical reviews | Office badge list half-yearly; data centres covered by provider assurance reports | Quarterly for offices and the colocation suite | Quarterly per site, including plant control rooms |
| Testing | One annual penetration test of the SaaS platform; restore tests quarterly; region failover test annually | Annual penetration test plus application test before major releases; DR test of the colocation suite | Penetration tests rotated across sites, OT assessments per plant, group DR test of the data centre |
| Internal audit | One auditor (external contractor or a trained colleague outside engineering), 3 to 4 days in one window | Internal audit spread over 6 weeks, auditors from quality and finance trained in ISO 19011 | Rolling audit programme across 6 sites, integrated with ISO 9001 and ISO 22301 audits |
| External audits | Surveillance audit once a year at one location | Surveillance audit once a year covering offices and colocation | Surveillance audit with site sampling set by the certification body, integrated audit where the CB offers it |
| Phasing | One calendar for the whole company | One calendar; separate dates for the colocation suite | Group calendar for shared activities; site calendars follow the phased certification by site |

Small organisations can combine activities in the same week (for
example access review and asset reconciliation) to save effort, as long
as each produces its own record.

## 7. Rescheduling and missed activities

<!-- Guidance: Plans change. What an auditor checks is that a missed or moved activity was noticed, approved and recovered, and that the control did not silently stop. -->

| Situation | Rule | Approval | Record |
|---|---|---|---|
| Activity moved within the same quarter | Allowed if the frequency in the source document is still met | Activity owner informs the ISMS manager | Revision history of the calendar |
| Activity moved to a later quarter | Allowed only with a reason and a new date | CISO approves | Revision history and steering committee minutes |
| Activity missed | Treat as a potential nonconformity: assess the impact on the control and the risk | ISMS manager assesses; CISO decides | Entry in DOC-ISMS-087 or a recorded rationale |
| Activity no longer needed | Remove only after the source document or risk treatment is changed | Document owner and ISMS manager | Updated source document and calendar |

Track completion as a metric: "calendar activities completed in the
planned month" is a useful ISMS management indicator in the measurement
programme (DOC-ISMS-080).

## 8. Records and evidence

<!-- Guidance: The calendar is planning information under clause 8.1; the records it schedules are the evidence. Point each activity to its record and keep the planned-versus-actual view. Link the records in the control evidence matrix. -->

| Record | Proves | Kept by | Location | Retention *(Example)* |
|---|---|---|---|---|
| Approved calendar per ISMS year | Operational planning (8.1) | ISMS manager | Document management system | 3 years (one certification cycle) |
| Planned versus actual tracker | Activities happened as planned or were rescheduled with approval | ISMS manager | GRC tool or calendar export | 3 years |
| Activity records (column "Evidence produced" in section 3) | Each control operated at its frequency | Activity owners | Locations named in DOC-ISMS-033 | As set per record in DOC-ISMS-028 |
| Rescheduling approvals | Changes were controlled | ISMS manager | Revision history and minutes | 3 years |
| Reminder and booking confirmations for external tests and audits | Lead times met | Activity owners | E-mail or ticketing | 1 year |

The control evidence matrix (`isms/control-evidence-matrix`,
DOC-ISMS-033) lists the same records per clause and control with the
last collection date; update both documents together.

## 9. Review of the calendar

<!-- Guidance: Review progress at every steering committee and rebuild the calendar each year. Questions: which activities slipped and why, which months were overloaded, did a new control or contract add an activity? -->

- Review progress against the calendar at each quarterly steering
  committee and record slipped activities.
- Rebuild the calendar each December for the next year, after the
  certification body confirms the next audit date.
- Update the calendar within one month when a new policy, standard,
  contract or risk treatment adds a recurring activity, or when the
  scope changes.
- In a recertification year, bring the internal audit and management
  review forward so that the full ISMS is covered before the
  recertification audit (see DOC-ISMS-094).

## 10. References

<!-- Guidance: Cite the editions used. Frequencies come from your own documents, not from the standard; the standard asks for planned intervals. -->

| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024 | https://www.iso.org/standard/82875.html ; https://www.iso.org/standard/88435.html | Clauses 8.1, 9.1, 9.2, 9.3 and Annex A controls named in the register |
| ISO/IEC 27002:2022 | https://www.iso.org/standard/75652.html | Guidance on operating each control |
| ISO/IEC 17021-1:2015 | https://www.iso.org/standard/61651.html | Surveillance audits at least once a calendar year, recertification before expiry |
| ISO 19011:2026 | https://www.iso.org/standard/88984.html | Guidance for planning internal audits |

Related templates: `isms/control-evidence-matrix` (DOC-ISMS-033),
`isms/isms-measurement-programme` (DOC-ISMS-080),
`isms/isms-performance-report` (DOC-ISMS-081),
`compliance/internal-audit-program` (DOC-ISMS-082),
`compliance/management-review` (DOC-ISMS-085),
`isms/certification-cycle-plan` (DOC-ISMS-094),
`isms/surveillance-readiness-health-check` (DOC-ISMS-096),
`ops/access-review`, `isms/phishing-simulation-plan` (DOC-ISMS-074),
`isms/backup-restore-test-log` (DOC-ISMS-071),
`isms/cryptographic-key-register` (DOC-ISMS-070),
`isms/supplier-register` (DOC-ISMS-066).

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clauses 8.1 and
9.1 to 9.3 and the certification cycle described in ISO/IEC
17021-1:2015. The activities, frequencies, months and dates are
original, illustrative examples; the standards ask for planned
intervals and leave frequencies to the organization. No ISO or IEC text
is reproduced, and you need the official standards to apply the
requirements. ISO and IEC standards are copyrighted and sold by ISO,
IEC and national standards bodies. Check the current edition and
amendments, and your certification body's rules, before use. Template
licence: MIT.