# ISMS Budget and Resource Plan: [Organization name]

> Budget and resource plan for establishing, certifying and running an
> information security management system (ISMS) under ISO/IEC
> 27001:2022 including Amendment 1:2024. It covers every cost line
> (internal effort, optional consultant, tooling, training and staff
> certification, penetration testing, certification body fees for the
> initial audit, surveillance years and recertification, and
> remediation), a 3-year view per size tier, a resource plan by role and
> the funding approval. It supports clause 7.1 (an ISMS with no people,
> time or money behind it is only paper) and clause 5.1 (leadership has
> to back the ISMS with real funding), and it gives clause 6.2 planning its "what
> resources" answer. Replace every `[bracketed]` value and every row
> marked *Example*. All money figures are *Example* values in USD: use
> your local currency and real quotes.

<!--
Guidance: How to use this template
- Use it with the business case (`isms/isms-business-case`,
  DOC-ISMS-029): the business case argues for the money, this plan
  shows how it is built and spent. Keep the totals identical in both.
- Fill first: section 2 (assumptions, especially the loaded cost per
  FTE and the contingency rate), then section 4 for your tier, then
  section 6 (resource plan by role). Get certification body fees from
  at least two written quotes (`isms/certification-body-selection`).
- Main pitfall: budgeting only the external spend. Internal effort is
  usually the largest cost, and without named time allocations the
  project stalls. A second pitfall is forgetting years 2 and 3:
  surveillance audits, tooling subscriptions and penetration tests
  recur.
- Related templates: `isms/isms-business-case`,
  `isms/isms-project-charter`, `isms/isms-implementation-roadmap`,
  `isms/isms-roles-raci`, `isms/isms-competence-training-matrix`,
  `isms/certification-cycle-plan`, `security/pentest-report`.
-->

## Document control

<!-- Guidance: Finance usually owns the numbers and the ISMS manager owns the content. Re-approve the plan whenever a total changes by more than the tolerance set in the project charter. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-031 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@cfo], [@sponsor], [@ceo] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024 |
| Size tier used | [Small / Medium / Large or multi-site] |
| Budget period | [FY YYYY to FY YYYY, 3 years] |
| Currency and price basis | [USD / local currency], [prices as of YYYY-MM-DD, excluding / including tax] |
| Business case reference | DOC-ISMS-029 |
| Charter reference | DOC-ISMS-009 |
| Next scheduled review | YYYY-MM-DD [annual budget cycle and each phase gate] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS manager | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Finance | [@cfo] | [Reviewed and funded] | YYYY-MM-DD |
| Sponsor | [@sponsor] | [Approved] | YYYY-MM-DD |
| Top management | [@ceo] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 *(Example)* | YYYY-MM-DD | [@isms-manager] | Baseline approved with the business case |
| 1.1 *(Example)* | YYYY-MM-DD | [@isms-manager] | PCR-001: GRC tool deferred, year 1 tooling reduced |
| 2.0 *(Example)* | YYYY-MM-DD | [@isms-manager] | Year 2 run budget confirmed at management review |

## Contents

<!-- Guidance: Sections 4 and 5 are what finance reads; section 6 is what line managers read, because it names their people's time. -->

1. Purpose and scope
2. Assumptions
3. Cost lines
4. Worked budgets by tier
5. 3-year view and recertification
6. Resource plan by role
7. Funding approval and release
8. Budget monitoring and change
9. Size tiers
10. Records and evidence
11. References

## 1. Purpose and scope

<!-- Guidance: Say what the budget covers and what it excludes. Excluding business-as-usual security spend (for example an existing EDR subscription) is fine, as long as it is stated, so nobody counts it twice. -->

This plan sets out the money and people needed to establish the ISMS,
complete the initial certification audit and run the ISMS through the
first certification cycle. It covers the ISMS scope in DOC-ISMS-002.

| Included | Excluded |
|---|---|
| Internal effort of named roles on ISMS work | Business-as-usual operations already funded (for example existing endpoint protection licences) |
| External advice, tooling, training, testing and audits | Product development not driven by a risk treatment action |
| Remediation capital and one-off spend driven by the risk treatment plan | Spend for other management systems, except shared costs stated in section 9 |
| Contingency on external project lines | Tax treatment and depreciation (finance applies its own rules) |

## 2. Assumptions

<!-- Guidance: Every figure depends on a handful of assumptions. Put them in one table so a reviewer can challenge them, and so a change in one assumption updates every line. -->

| ID | Assumption | Small | Medium | Large |
|---|---|---|---|---|
| BA-001 *(Example)* | Loaded cost per FTE per year (salary, benefits, overhead) | USD 150,000 | USD 140,000 | USD 135,000 |
| BA-002 *(Example)* | Contingency on external project lines (not on internal effort) | 10% | 10% | 10% |
| BA-003 *(Example)* | Certification body fees are based on written quotes; audit time is set by the certification body under ISO/IEC 27006-1:2024 | 2 quotes | 3 quotes | 3 quotes, integrated audit option |
| BA-004 *(Example)* | Penetration test once a year, scope set by the risk assessment | Web application and cloud | Platform, colocation network, external perimeter | IT and OT, all 6 sites over the cycle |
| BA-005 *(Example)* | Existing security tooling continues to be funded from operations | Yes | Yes | Yes |
| BA-006 *(Example)* | Year 1 starts at project kick-off, not at the start of a financial year | Yes | Yes | Yes |

The small tier uses a higher loaded cost because its ISMS effort falls
mostly on senior engineering staff; the medium and large tiers spread it
across a wider mix of roles. Replace all three with your finance team's
figures.

Audit time and any audit-day figure in this plan are *Example* values.
The certification body determines audit time from the number of persons
doing work under the organization's control and complexity factors, so
ask for its calculation in the quote.

## 3. Cost lines

<!-- Guidance: Use the same cost lines in every tier and every year, so totals can be compared and tracked. Mark each line one-off or recurring. -->

| Code | Cost line | What it covers | Nature |
|---|---|---|---|
| CL-01 | Internal effort | Time of the ISMS manager, project manager, security team, control owners and internal auditor on ISMS work, in FTE x loaded cost | Recurring, higher in year 1 |
| CL-02 | Consultant (optional) | Gap assessment support, coaching, template review, pre-audit check, external internal auditor where no independent staff exist | Mostly year 1 |
| CL-03 | Tooling | GRC or ISMS platform, or the incremental cost of using existing tools (ticketing, wiki) for registers and evidence | Recurring subscription |
| CL-04 | Training and staff certification | Awareness platform, role training (risk, internal audit, secure development), professional certifications such as ISO/IEC 27001 lead implementer or lead auditor courses | Recurring |
| CL-05 | Penetration testing | Independent technical testing of in-scope systems; retests after fixes | Recurring, usually annual |
| CL-06 | Certification body fees | Stage 1 and Stage 2 in year 1, surveillance audits in years 2 and 3, recertification before expiry; auditor travel where on site | Recurring by cycle |
| CL-07 | Remediation capex and one-off spend | Controls the treatment plan requires that do not exist yet: logging and monitoring, backup immutability, device management, network segmentation, physical access | Mostly year 1 |
| CL-08 | Contingency | 10% of CL-02 to CL-07 *(Example)* | Each year |

Cash cost is CL-02 to CL-08. Full economic cost adds CL-01.

CL-01 is the time of people already on the payroll, valued at loaded
cost: an opportunity cost, not new spending. If you hire or backfill a
role for the ISMS, move that cost into a cash line so it is not counted
twice. Finance approves the cash budget; line managers approve the time
(section 6). Never present the economic total as the cash request.

## 4. Worked budgets by tier

<!-- Guidance: Keep only your tier and replace every figure. Check that each column adds up; a reviewer will recompute. Figures below are Example values in USD. -->

### 4.1 Small: Quillmere Analytics Ltd

46 staff (38 employees, 8 contractors), one office plus remote staff,
production on one public cloud provider in two regions. Part-time ISMS
manager (0.5 FTE, the Head of Engineering Operations). Target:
certification in 6 months.

| Code | Cost line | Year 1 | Year 2 | Year 3 | 3-year total |
|---|---|---|---|---|---|
| CL-01 | Internal effort (0.8, 0.6, 0.6 FTE x 150,000) | 120,000 | 90,000 | 90,000 | 300,000 |
| CL-02 | Consultant, including external internal auditor | 25,000 | 5,000 | 5,000 | 35,000 |
| CL-03 | Tooling (lightweight GRC platform) | 12,000 | 12,000 | 12,000 | 36,000 |
| CL-04 | Training and staff certification | 7,000 | 4,000 | 4,000 | 15,000 |
| CL-05 | Penetration testing | 18,000 | 18,000 | 18,000 | 54,000 |
| CL-06 | Certification body fees (initial, surveillance 1, surveillance 2) | 16,000 | 7,000 | 7,000 | 30,000 |
| CL-07 | Remediation (device management, logging, backup immutability) | 30,000 | 8,000 | 8,000 | 46,000 |
| CL-08 | Contingency (10% of CL-02 to CL-07) | 10,800 | 5,400 | 5,400 | 21,600 |
| | **Total economic cost** | **238,800** | **149,400** | **149,400** | **537,600** |
| | of which cash (CL-02 to CL-08) | 118,800 | 59,400 | 59,400 | 237,600 |

For Quillmere Analytics the money actually spent is USD 118,800 in year
1 and USD 59,400 in each later year *(Example)*. The USD 300,000 of
internal effort is mostly the ISMS manager's 0.5 FTE, which already sits
in the Head of Engineering Operations' salary, plus control owners' time.
Year 1 is a 6-month build followed by about 6 months of operation, so
the year 1 FTE covers both.

### 4.2 Medium: Quillmere Health Systems

320 staff, two offices and one colocation suite. Full-time ISMS manager
plus a 3-person security team. Target: ISO/IEC 27001 in 10 months,
ISO/IEC 27701 the year after (the privacy add-on is costed separately in
the business case, option D).

| Code | Cost line | Year 1 | Year 2 | Year 3 | 3-year total |
|---|---|---|---|---|---|
| CL-01 | Internal effort (3.5, 3.0, 3.0 FTE x 140,000) | 490,000 | 420,000 | 420,000 | 1,330,000 |
| CL-02 | Consultant | 60,000 | 15,000 | 15,000 | 90,000 |
| CL-03 | Tooling (GRC platform) | 30,000 | 30,000 | 30,000 | 90,000 |
| CL-04 | Training and staff certification | 25,000 | 15,000 | 15,000 | 55,000 |
| CL-05 | Penetration testing | 45,000 | 45,000 | 45,000 | 135,000 |
| CL-06 | Certification body fees (initial, surveillance 1, surveillance 2) | 35,000 | 15,000 | 15,000 | 65,000 |
| CL-07 | Remediation (SIEM onboarding, colocation access control, network segmentation) | 150,000 | 40,000 | 40,000 | 230,000 |
| CL-08 | Contingency (10% of CL-02 to CL-07) | 34,500 | 16,000 | 16,000 | 66,500 |
| | **Total economic cost** | **869,500** | **596,000** | **596,000** | **2,061,500** |
| | of which cash (CL-02 to CL-08) | 379,500 | 176,000 | 176,000 | 731,500 |

### 4.3 Large or multi-site: Quillmere Group

2,400 staff, 6 sites in 4 countries (HQ, 3 plants, 1 service centre, 1
data centre), OT and IT, already certified to ISO 9001 and ISO 22301.
CISO with a 14-person security office. Target: ISO/IEC 27001 for the
group in 15 months, phased by site.

| Code | Cost line | Year 1 | Year 2 | Year 3 | 3-year total |
|---|---|---|---|---|---|
| CL-01 | Internal effort (12.0, 9.0, 9.0 FTE x 135,000) | 1,620,000 | 1,215,000 | 1,215,000 | 4,050,000 |
| CL-02 | Consultant (OT security and programme support) | 180,000 | 40,000 | 40,000 | 260,000 |
| CL-03 | Tooling (enterprise GRC, integrated with the existing management system) | 90,000 | 90,000 | 90,000 | 270,000 |
| CL-04 | Training and staff certification | 80,000 | 50,000 | 50,000 | 180,000 |
| CL-05 | Penetration testing, including OT assessments | 160,000 | 140,000 | 140,000 | 440,000 |
| CL-06 | Certification body fees (initial multi-site, surveillance 1, surveillance 2) | 110,000 | 50,000 | 50,000 | 210,000 |
| CL-07 | Remediation (OT segmentation, site physical controls, monitoring) | 900,000 | 250,000 | 250,000 | 1,400,000 |
| CL-08 | Contingency (10% of CL-02 to CL-07) | 152,000 | 62,000 | 62,000 | 276,000 |
| | **Total economic cost** | **3,292,000** | **1,897,000** | **1,897,000** | **7,086,000** |
| | of which cash (CL-02 to CL-08) | 1,672,000 | 682,000 | 682,000 | 3,036,000 |

The 15-month programme spans parts of two budget years. To keep the
three tiers comparable, year 1 above carries the whole build effort and
the initial certification fee, although Stage 1 and Stage 2 fall in
months 14 and 15 of the programme *(Example)*. If your finance team
budgets by financial year, move the Stage 2 fee and the matching effort
into the year in which the audit happens, and shift the surveillance
years with it.

## 5. 3-year view and recertification

<!-- Guidance: Show the whole certification cycle so nobody is surprised by year 2 and year 3 costs, and note the recertification audit that falls before the certificate expires. -->

### 5.1 Summary by tier (*Example*, USD)

| Tier | Year 1 | Year 2 | Year 3 | 3-year economic cost | 3-year cash cost |
|---|---|---|---|---|---|
| Small: Quillmere Analytics Ltd | 238,800 | 149,400 | 149,400 | 537,600 | 237,600 |
| Medium: Quillmere Health Systems | 869,500 | 596,000 | 596,000 | 2,061,500 | 731,500 |
| Large: Quillmere Group | 3,292,000 | 1,897,000 | 1,897,000 | 7,086,000 | 3,036,000 |

### 5.2 Certification body fees across the cycle (*Example*, USD)

| Audit | Timing | Small | Medium | Large |
|---|---|---|---|---|
| Initial certification (Stage 1 and Stage 2) | Year 1 | 16,000 | 35,000 | 110,000 |
| Surveillance 1 | No later than 12 months from the certification decision | 7,000 | 15,000 | 50,000 |
| Surveillance 2 | Following calendar year | 7,000 | 15,000 | 50,000 |
| Recertification (memo, outside the 3-year total) | Planned and completed before the certificate expires, usually in year 4 of spend | 11,000 | 25,000 | 80,000 |

Surveillance audits take place at least once each calendar year, except
in recertification years. A scope extension, a new site or a transfer
between certification bodies changes these figures; plan them in
`isms/scope-extension-multisite-plan` and `isms/certification-cycle-plan`.

### 5.3 Cost profile

```mermaid
flowchart LR
  Y1["Year 1: build and initial audit (highest spend)"] --> Y2["Year 2: operate, surveillance 1"]
  Y2 --> Y3["Year 3: operate, surveillance 2"]
  Y3 --> Y4["Year 4: recertification, new cycle"]
  Y4 --> Y2N["Next cycle: run costs repeat"]
```

Typical pattern *(Example)*: year 1 is 40% to 50% of the 3-year total
across the three worked tiers (small 238,800 of 537,600 is 44%; medium
869,500 of 2,061,500 is 42%; large 3,292,000 of 7,086,000 is 46%).

## 6. Resource plan by role

<!-- Guidance: Name people and their percentage of time, agreed with their line managers. Clause 7.1 is where an auditor checks the ISMS is actually staffed and funded; an auditor may test whether the ISMS manager actually has the time stated here. Competence requirements for each role go into the competence and training matrix. -->

### 6.1 FTE by role and year (*Example*)

| Role | Small Y1 | Small Y2 and Y3 | Medium Y1 | Medium Y2 and Y3 | Large Y1 | Large Y2 and Y3 |
|---|---|---|---|---|---|---|
| ISMS manager or ISMS core team | 0.5 | 0.5 | 1.0 | 1.0 | 4.0 | 3.5 |
| Project manager | 0 (ISMS manager runs it) | 0 | 0.5 | 0 | Included in core team | Included in core team |
| Security team share | 0 | 0 | 1.2 | 1.3 | Included in core team | Included in core team |
| Site coordinators (6 sites) | Not applicable | Not applicable | Not applicable | Not applicable | 3.0 (6 x 0.5) | 1.5 (6 x 0.25) |
| Control owners (IT, HR, facilities, engineering, legal) | 0.3 | 0.1 | 0.6 | 0.5 | 3.5 | 2.5 |
| Internal auditor | 0 (external, in CL-02) | 0 | 0.2 | 0.2 | 1.0 | 1.0 |
| OT security lead | Not applicable | Not applicable | Not applicable | Not applicable | 0.5 | 0.5 |
| **Total FTE (CL-01)** | **0.8** | **0.6** | **3.5** | **3.0** | **12.0** | **9.0** |

Top management time (policy approval, management review, risk
acceptance) and all-staff time for awareness training (for example 46
staff x 2 hours a year in the small tier) are not costed here; they are
absorbed in normal operations but are a real commitment. Schedule them
in the annual calendar (`isms/isms-annual-calendar`).

### 6.2 Named allocations

| Person | Role | Allocation | Period | Line manager agreement |
|---|---|---|---|---|
| [@isms-manager] *(Example)* | ISMS manager | 100% | Year 1 to year 3 | [@coo], YYYY-MM-DD |
| [@isms-project-manager] *(Example)* | Project manager | 50% | Kick-off to project closure | [@pmo-lead], YYYY-MM-DD |
| [@security-engineer-1] *(Example)* | Security team, risk and monitoring | 40% | Year 1 | [@security-lead], YYYY-MM-DD |
| [@it-lead] *(Example)* | Control owner, IT operations | 20% | Year 1 | [@cto], YYYY-MM-DD |
| [@hr-lead] *(Example)* | Control owner, people controls | 10% | Year 1 | [@chro], YYYY-MM-DD |
| [@internal-auditor] *(Example)* | Internal auditor | 20% | Phase 7 onward | [@cfo], YYYY-MM-DD |

### 6.3 Capacity risks

- If the ISMS manager also has an operational role (common in small
  organisations), protect fixed days each week for ISMS work.
- Backfill delivery roles before releasing control owners; otherwise
  delivery work always wins.
- Plan a deputy for the ISMS manager to avoid a single point of failure.

## 7. Funding approval and release

<!-- Guidance: Release money in tranches tied to phase gates. This keeps spend aligned to progress and gives top management natural decision points. Contingency should need the sponsor's approval to draw. -->

### 7.1 Year 1 tranches for the medium tier (*Example*, USD)

| Tranche | Released at | Lines covered | Amount |
|---|---|---|---|
| T1 | Charter approval (phase 0 gate) | Consultant 30,000; tooling 30,000; training 10,000 | 70,000 |
| T2 | Risk assessment, SoA and treatment plan approved (phase 3 gate) | Remediation 150,000; penetration test 45,000; training 15,000; consultant 20,000 | 230,000 |
| T3 | Management review held (phase 8 gate) | Certification body fees 35,000; consultant pre-audit check 10,000 | 45,000 |
| Contingency | On sponsor approval, logged as a change | Any CL-02 to CL-07 line | 34,500 |
| | | **Year 1 cash total** | **379,500** |

### 7.2 Approval flow

Finance checks the plan against the business case before the sponsor
recommends it; money is then released tranche by tranche.

```mermaid
flowchart TD
  A["ISMS manager prepares plan"] --> B["Finance reviews assumptions and totals"]
  B --> C{"Totals match the business case?"}
  C -- No --> A
  C -- Yes --> D["Sponsor recommends"]
  D --> E["Top management approves budget and allocations"]
  E --> F["Tranche released at each phase gate"]
  F --> G["Spend tracked monthly against plan"]
```

### 7.3 Funding decision record

| Field | Value |
|---|---|
| Decision ID | [DEC-ISMS-002] |
| Approved amount | [Year 1 USD amount; years 2 and 3 indicative, confirmed in the annual budget cycle] |
| Approved by and date | [@ceo / Board], YYYY-MM-DD |
| Conditions | [Tranches as in 7.1; contingency drawn only with sponsor approval] |
| Cost centre | [Cost centre code] |

## 8. Budget monitoring and change

<!-- Guidance: Report spend against plan at every steering group meeting. Changes beyond tolerance follow the project change control in the charter; after closure, they go through the annual budget cycle and management review. -->

| Month *(Example)* | Planned cumulative cash | Actual cumulative cash | Variance | Comment |
|---|---|---|---|---|
| Month 3 | 70,000 | 64,000 | -6,000 | Tooling discount |
| Month 6 | 250,000 | 270,000 | +20,000 | Segmentation work brought forward |
| Month 10 | 379,500 | 372,000 | -7,500 | Contingency partly unused |

Rules:

1. Report variance above 10% of a year budget to the sponsor within
   one week.
2. Reallocation between lines follows the tolerances in the charter
   (`isms/isms-project-charter`, section 11).
3. From year 2, present the actual spend and the next year's request at
   management review (`compliance/management-review`), so that resource
   decisions appear in its outputs.

## 9. Size tiers

<!-- Guidance: Summarise what changes by tier, beyond the numbers. These are the library's working tiers, not official definitions. -->

| Aspect | Small: Quillmere Analytics Ltd | Medium: Quillmere Health Systems | Large: Quillmere Group |
|---|---|---|---|
| Biggest cost line | Internal effort, then remediation | Internal effort, then remediation | Internal effort, then OT and site remediation |
| Tooling approach | Lightweight GRC platform or existing wiki and ticketing | GRC platform | Enterprise GRC shared with ISO 9001 and ISO 22301 |
| Consultant use | Coaching and external internal audit | Targeted support and pre-audit check | OT expertise and programme support |
| Certification body fees | Single site plus remote; small audit team | Two offices plus colocation | Multi-site sampling under ISO/IEC 27006-1:2024 and IAF MD 1:2023 (now re-issued by Global ACI as Global ACI-TECH-3-001; check the current issue); integrated audit with existing certificates may reduce total audit time |
| Shared costs | None | Shared with privacy programme in year 2 | Document control, internal audit, management review and corrective action shared with the integrated management system; show the saving (see `isms/integrated-management-27013`) |
| Approval | CEO | Executive committee | Group board, with site budgets |

## 10. Records and evidence

<!-- Guidance: These records show what the ISMS was given to work with (clause 7.1) and that leadership signed off the money and people (clause 5.1). -->

| Record | Proves | Owner | Location | Retention *(Example)* |
|---|---|---|---|---|
| Approved budget and resource plan (this document) | Resources determined | [@isms-manager] | [Document management system] | Life of the ISMS plus 3 years |
| Funding decision record (section 7.3) | Resources provided by top management | [@cfo] | [Board portal / finance system] | As corporate records policy requires |
| Named allocations with line manager agreement (section 6.2) | People made available | [@isms-manager] | [HR or project system] | 3 years |
| Monthly spend reports (section 8) | Budget controlled | [@finance-business-partner] | [Finance system] | As finance rules require |
| Certification body quotes and contract | Basis for CL-06 | [@procurement-lead] | [Contract repository] | Contract term plus 6 years *(Example)* |

Map these records in the control evidence matrix
(`isms/control-evidence-matrix`) and list the plan in the documented
information register (`isms/isms-documented-information-register`).

## 11. References

<!-- Guidance: Cite exact editions. Fee and audit-time figures are never normative: they come from your certification body's quote. -->

| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022, information security management systems requirements | 2022, with Amd 1:2024 (published 2024-02-23) | Clauses 5.1, 6.2 and 7.1. https://www.iso.org/standard/82875.html, https://www.iso.org/standard/88435.html |
| ISO/IEC 27006-1:2024, requirements for ISMS certification bodies | 2024 | How audit time is determined. https://www.iso.org/standard/82908.html |
| ISO/IEC 17021-1:2015, requirements for certification bodies | 2015 | Certification cycle, surveillance and recertification. https://www.iso.org/standard/61651.html |
| ISO/IEC 27003:2017, ISMS guidance | 2017 (a revision is in progress; check for a newer edition) | Resource planning guidance. https://www.iso.org/standard/63417.html |
| IAF MD 1:2023, audit and certification of a multi-site management system, now re-issued by Global ACI as Global ACI-TECH-3-001 | IAF MD 1 issue 3 (2023). Global Accreditation Cooperation Incorporated (Global ACI) replaced IAF and ILAC on 2026-01-01; Global ACI-TECH-3-001 v1.0 issued 2026-07-10, in force 2026-08-28: check the current issue | Multi-site sampling (large tier); accredited certification under the Global ACI MRA (formerly IAF MLA) |

Related templates: `isms/isms-business-case`, `isms/isms-project-charter`,
`isms/isms-implementation-roadmap`, `isms/isms-roles-raci`,
`isms/isms-competence-training-matrix`, `isms/certification-body-selection`,
`isms/certification-cycle-plan`.

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 including Amd 1:2024
(clauses 5.1, 6.2 and 7.1) and the certification cycle in ISO/IEC
17021-1:2015 and ISO/IEC 27006-1:2024. The cost lines, figures, tables
and examples are original; no ISO/IEC text is reproduced. You need the
official standards for the requirements themselves:
https://www.iso.org/standard/82875.html. Check the current edition of
every standard and accreditation document before use. All figures are
*Example* values, not benchmarks or quotes, and certification decisions
belong to the accredited certification body. This is a documentation
format, not financial advice. Template licence: MIT.