# ISMS Implementation Roadmap: [Organization name]

> Implementation roadmap for building an information security management
> system (ISMS) and reaching the certification audit under ISO/IEC
> 27001:2022 including Amendment 1:2024. It sets out eleven phases (0 to
> 10, from the decision to the Stage 2 audit) followed by the
> certification cycle, with entry and exit criteria, deliverables by
> template, durations for small, medium and large organisations, Gantt
> charts, the critical path and the most common causes of delay. It
> supports clause 6.2 (turning each objective into a plan with actions,
> budget, an owner, a date and a way to check success) and clause 8.1
> (operational planning and control). Replace every `[bracketed]` value
> and every row marked *Example*.

<!--
Guidance: How to use this template
- Use it right after the business case is approved, together with the
  project charter (`isms/isms-project-charter`, DOC-ISMS-009). The
  charter takes its milestones from this roadmap.
- Fill first: section 3 (pick your tier and adjust the durations), then
  section 5 (your Gantt chart), then section 6 (critical path). Delete
  the Gantt charts for tiers that do not apply to you.
- Main pitfall: compressing phase 6 (operate and collect records). The
  auditor tests whether the ISMS works, which needs records produced
  over time: access reviews, log reviews, backup tests, incidents,
  training, supplier reviews. Policies written the week before Stage 1
  are a common reason for findings.
- Related templates: `isms/isms-project-charter`,
  `isms/isms-business-case`, `isms/isms-budget-resource-plan`,
  `compliance/iso-27001-gap-assessment`, `isms/isms-annual-calendar`,
  `isms/certification-cycle-plan`, `isms/isms-worked-walkthrough`.
-->

## Document control

<!-- Guidance: Version the roadmap at each phase gate. When a date moves, record why in the revision history and raise a project change request in the charter if it moves a milestone. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-030 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@sponsor], [@isms-project-manager], [@cto] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024; certification process per ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024 |
| Size tier used | [Small / Medium / Large or multi-site] |
| Planned start | YYYY-MM-DD |
| Planned Stage 2 window | YYYY-MM-DD to YYYY-MM-DD |
| Charter reference | DOC-ISMS-009 |
| Next scheduled review | YYYY-MM-DD [each phase gate] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS manager | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Project manager | [@isms-project-manager] | [Reviewed] | YYYY-MM-DD |
| Sponsor | [@sponsor] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 *(Example)* | YYYY-MM-DD | [@isms-manager] | Baseline roadmap approved with the charter |
| 1.1 *(Example)* | YYYY-MM-DD | [@isms-manager] | Phase 5 extended by two weeks after PCR-002 (outsourced support desk added to scope) |

## Contents

<!-- Guidance: Section 2 is the reference most people use; sections 5 and 6 are what the sponsor watches. -->

1. How to read this roadmap
2. Phases, entry and exit criteria
3. Durations by tier
4. Deliverables by phase
5. Gantt charts by tier
6. Critical path
7. Common delays and how to avoid them
8. After Stage 2: the certification cycle
9. Size tiers
10. Records and evidence
11. References

## 1. How to read this roadmap

<!-- Guidance: Explain the logic once. Phases overlap in practice; the gates are what matter. A gate is passed when its exit criteria are met and the sponsor records the decision. -->

The roadmap follows the order of ISO/IEC 27001:2022 clauses 4 to 10 and
the two-stage initial certification audit described in ISO/IEC
17021-1:2015. Phases may overlap, but each has a gate: the next
dependent phase does not close before the previous gate is passed.

```mermaid
flowchart LR
  P0["0 Decide"] --> P1["1 Context and scope"]
  P1 --> P2["2 Leadership and policy"]
  P2 --> P3["3 Risk and SoA"]
  P3 --> P5["5 Annex A implementation"]
  P2 --> P4["4 Support"]
  P4 --> P6["6 Operate and collect records"]
  P5 --> P6
  P6 --> P7["7 Internal audit"]
  P7 --> P8["8 Management review"]
  P8 --> P9["9 Stage 1 audit"]
  P9 --> P10["10 Stage 2 audit"]
  P10 --> C["Certification cycle"]
  C -->|"improve"| P6
```

Conventions:

- Clause references use the clause number and a short description in
  this template's own words.
- Durations are *Example* values in weeks. Audit dates and audit time
  are set by your certification body, which applies ISO/IEC
  27006-1:2024.
- "Records" means documented information that shows an activity took
  place (clause 7.5), for example a signed access review or a backup
  restore test log.

## 2. Phases, entry and exit criteria

<!-- Guidance: Make each exit criterion testable by someone outside the project. "Policy written" is not an exit criterion; "Policy approved by top management and published to all staff" is. -->

### Phase 0: Decide

| Item | Content |
|---|---|
| Purpose | Decide whether and how to build an ISMS, and with what resources |
| Entry criteria | A driver exists (customer, tender, regulation, risk, insurer) and an owner is willing to write the case |
| Key activities | Gap assessment; options and cost estimate; sponsor identified; decision by top management; charter drafted |
| Exit criteria | Business case approved with a decision record; budget released for year 1; sponsor and ISMS manager named; charter approved |
| Clause focus | 5.1 (leadership commitment, resources) |

### Phase 1: Context and scope

| Item | Content |
|---|---|
| Purpose | Understand the organisation and set the ISMS boundary |
| Entry criteria | Phase 0 gate passed |
| Key activities | Internal and external issues, including whether climate change is a relevant issue (Amd 1:2024); interested parties and their requirements, which may include climate-related ones; legal, regulatory and contractual register; process map; first asset inventory; scope statement with interfaces and dependencies |
| Exit criteria | Context and interested parties document, legal register and scope statement approved; asset inventory covers all in-scope services |
| Clause focus | 4.1, 4.2, 4.3, 4.4 |

### Phase 2: Leadership and policy

| Item | Content |
|---|---|
| Purpose | Set direction and accountability |
| Entry criteria | Draft scope available |
| Key activities | Information security policy; roles, responsibilities and authorities; steering committee terms; policy framework; first ISMS objectives |
| Exit criteria | Policy approved by top management and communicated; RACI approved; steering committee in place; objectives recorded with owners and dates |
| Clause focus | 5.1, 5.2, 5.3, 6.2 |

### Phase 3: Risk and SoA

| Item | Content |
|---|---|
| Purpose | Identify, analyse and evaluate information security risks and decide treatment |
| Entry criteria | Scope approved; asset inventory and context available |
| Key activities | Risk methodology and criteria approved; risk workshops; risk register; risk assessment report; treatment options; Statement of Applicability covering all 93 Annex A controls; risk treatment plan; residual risk acceptance by risk owners |
| Exit criteria | Methodology, risk register, risk assessment report, SoA and risk treatment plan approved; residual risks accepted at the right authority level |
| Clause focus | 6.1.1, 6.1.2, 6.1.3, 8.2, 8.3 |

### Phase 4: Support

| Item | Content |
|---|---|
| Purpose | Put the people and documentation foundations in place |
| Entry criteria | Phase 2 gate passed (can run in parallel with phase 3) |
| Key activities | Competence requirements and training matrix; awareness programme; communication plan; document control procedure and documented information register |
| Exit criteria | Competence evidence held for key roles; awareness launched with completion tracking; communication plan approved; documents under version control |
| Clause focus | 7.1, 7.2, 7.3, 7.4, 7.5 |

### Phase 5: Annex A implementation

| Item | Content |
|---|---|
| Purpose | Implement the controls selected in the SoA and the actions in the treatment plan |
| Entry criteria | SoA and treatment plan approved. High-priority actions already known from the gap assessment may start earlier by sponsor decision, which is why the Gantt charts overlap phases 3 and 5; the phase cannot close before the phase 3 gate |
| Key activities | Topic-specific policies and procedures; technical controls (identity, logging, backup, configuration, vulnerability management); supplier security; incident management; business continuity aspects; control evidence matrix |
| Exit criteria | Treatment actions due before Stage 1 closed or rescheduled with risk owner approval; every applicable control has an owner and a defined record |
| Clause focus | 6.1.3, 8.1, 8.3, Annex A |

### Phase 6: Operate and collect records

| Item | Content |
|---|---|
| Purpose | Run the ISMS as business as usual and produce evidence |
| Entry criteria | Controls in place for the processes being operated (starts as soon as the first controls are live) |
| Key activities | Recurring controls on schedule (access reviews, log reviews, vulnerability scans, backup tests, supplier reviews); incident handling; measurement; change planning under 6.3 |
| Exit criteria | At least one cycle of each recurring control evidenced; measurement results available for management review |
| Clause focus | 6.3, 8.1, 9.1 |

### Phase 7: Internal audit

| Item | Content |
|---|---|
| Purpose | Check independently that the ISMS conforms and is effectively implemented |
| Entry criteria | Audit programme approved; auditors competent and independent of the areas they audit; enough records exist to sample |
| Key activities | Audit plan; audit of clauses 4 to 10 and a sample of Annex A controls covering the SoA; findings recorded; corrective actions raised |
| Exit criteria | Full internal audit of the ISMS scope completed; report issued; nonconformities have corrective action plans |
| Clause focus | 9.2, 10.2 |

### Phase 8: Management review

| Item | Content |
|---|---|
| Purpose | Top management reviews the ISMS and decides on improvements and resources |
| Entry criteria | Internal audit results, measurement results, risk status and other required inputs available |
| Key activities | Performance report; management review meeting with all required inputs; decisions and actions |
| Exit criteria | Minutes approved with decisions on improvement opportunities and changes; actions assigned |
| Clause focus | 9.3, 10.1 |

### Phase 9: Stage 1 audit

| Item | Content |
|---|---|
| Purpose | The certification body reviews documentation, readiness and scope, and plans Stage 2 |
| Entry criteria | Certification body contracted; Stage 1 readiness pack complete; internal audit and management review done (certification body practice, not a clause requirement) |
| Key activities | Readiness pack sent; Stage 1 audit (on site, remote or mixed, as the certification body decides); issues recorded |
| Exit criteria | Stage 1 report received; every issue raised has an owner and a closure date before Stage 2 |
| Clause focus | All clauses (documentation and readiness) |

### Phase 10: Stage 2 audit

| Item | Content |
|---|---|
| Purpose | The certification body evaluates implementation and effectiveness |
| Entry criteria | Stage 1 issues closed or with an agreed plan; evidence index ready; staff briefed and available |
| Key activities | Opening meeting; interviews and sampling; daily debriefs; closing meeting with findings |
| Exit criteria | Stage 2 report received; corrections and corrective action plans submitted within the time the certification body sets; certification decision by the certification body |
| Clause focus | All clauses and the applicable Annex A controls |

## 3. Durations by tier

<!-- Guidance: Durations depend on the gap, the scope and the people available, not only on headcount. Use these as a starting point and change them after the gap assessment. All values are Example values in weeks. -->

| Phase | Small (target 6 months) | Medium (target 10 months) | Large or multi-site (target 15 months) |
|---|---|---|---|
| 0 Decide | 2 | 3 | 4 |
| 1 Context and scope | 3 | 5 | 8 |
| 2 Leadership and policy | 3 | 5 | 8 |
| 3 Risk and SoA | 6 | 8 | 12 |
| 4 Support | 6 | 10 | 16 |
| 5 Annex A implementation | 8 | 16 | 18 (wave 1) and 22 (wave 2) |
| 6 Operate and collect records | 12 | 22 | 40 |
| 7 Internal audit | 2 | 4 | 6 |
| 8 Management review | 1 | 1 | 2 |
| 9 Stage 1 audit and closing its issues | 1 plus 3 | 1 plus 4 | 2 plus 4 |
| 10 Stage 2 audit | 1 | 2 | 3 |
| **Elapsed, start to end of Stage 2** | **about 19 weeks** | **about 43 weeks** | **about 66 weeks** |

Phases overlap, so the elapsed time is shorter than the sum of the rows.
Typical ranges used in this library *(Example)*: small 4 to 6 months,
medium 6 to 12 months, large 12 to 18 months or more. The audit days
inside phases 9 and 10 are set by the certification body; the weeks
shown include preparation and scheduling around the audit.

## 4. Deliverables by phase

<!-- Guidance: Each deliverable has a Document ID from the library register. Mark a deliverable "not needed" only with a reason; for example a small organisation may fold the process map into the manual. -->

| Phase | Deliverable | Document ID | Template |
|---|---|---|---|
| 0 | Gap assessment | DOC-ISMS-098 | `compliance/iso-27001-gap-assessment` |
| 0 | Business case | DOC-ISMS-029 | `isms/isms-business-case` |
| 0 | Budget and resource plan | DOC-ISMS-031 | `isms/isms-budget-resource-plan` |
| 0 | Project charter | DOC-ISMS-009 | `isms/isms-project-charter` |
| 0 | Implementation roadmap (this document) | DOC-ISMS-030 | `isms/isms-implementation-roadmap` |
| 1 | Context and interested parties | DOC-ISMS-003 | `isms/isms-context-interested-parties` |
| 1 | Legal, regulatory and contractual register | DOC-ISMS-014 | `compliance/legal-register` |
| 1 | ISMS scope | DOC-ISMS-002 | `compliance/ms-scope` |
| 1 | ISMS process map | DOC-ISMS-004 | `isms/isms-process-map` |
| 1 | Asset inventory | DOC-ISMS-012 | `compliance/asset-inventory` |
| 2 | Information security policy | DOC-ISMS-001 | `compliance/information-security-policy` |
| 2 | Roles, responsibilities and RACI | DOC-ISMS-006 | `isms/isms-roles-raci` |
| 2 | Steering committee charter | DOC-ISMS-007 | `isms/isms-steering-committee-charter` |
| 2 | Policy framework and policy index | DOC-ISMS-005 | `isms/isms-policy-framework` |
| 2 | Objectives register | DOC-ISMS-024 | `compliance/objectives-register` |
| 3 | Risk assessment methodology | DOC-ISMS-010 | `compliance/risk-methodology` |
| 3 | Risk appetite and risk criteria | DOC-ISMS-015 | `isms/isms-risk-appetite-criteria` |
| 3 | Threat and vulnerability catalogue | DOC-ISMS-018 | `isms/isms-threat-vulnerability-catalogue` |
| 3 | Risk register | DOC-ISMS-016 | `compliance/risk-register` |
| 3 | Risk assessment report | DOC-ISMS-017 | `isms/isms-risk-assessment-report` |
| 3 | Statement of Applicability | DOC-ISMS-011 | `compliance/statement-of-applicability` |
| 3 | Risk treatment plan | DOC-ISMS-013 | `compliance/risk-treatment-plan` |
| 3 | Risk acceptance records | DOC-ISMS-019 | `isms/isms-risk-acceptance-record` |
| 4 | Competence and training matrix | DOC-ISMS-026 | `isms/isms-competence-training-matrix` |
| 4 | Communication plan | DOC-ISMS-027 | `isms/isms-communication-plan` |
| 4 | Documented information register | DOC-ISMS-028 | `isms/isms-documented-information-register` |
| 4 | Awareness programme | (security awareness) | `security/security-awareness-program` |
| 5 | Access control policy | DOC-ISMS-041 | `isms/access-control-policy` |
| 5 | Acceptable use policy | DOC-ISMS-040 | `compliance/acceptable-use-policy` |
| 5 | Supplier register and supplier assessments | DOC-ISMS-066, DOC-ISMS-067 | `isms/supplier-register`, `compliance/supplier-security-assessment` |
| 5 | Incident response plan | DOC-ISMS-020 | `compliance/incident-response-plan` |
| 5 | Backup policy | DOC-ISMS-061 | `isms/backup-policy` |
| 5 | Secure configuration baseline | DOC-ISMS-060 | `isms/secure-configuration-baseline` |
| 5 | Control evidence matrix | DOC-ISMS-033 | `isms/control-evidence-matrix` |
| 5 | Certification body selection | DOC-ISMS-090 | `isms/certification-body-selection` |
| 6 | ISMS annual calendar | DOC-ISMS-032 | `isms/isms-annual-calendar` |
| 6 | Incident register | DOC-ISMS-021 | `isms/incident-register` |
| 6 | Vulnerability remediation tracker | DOC-ISMS-072 | `isms/vulnerability-remediation-tracker` |
| 6 | Backup and restore test log | DOC-ISMS-071 | `isms/backup-restore-test-log` |
| 6 | Measurement programme | DOC-ISMS-080 | `isms/isms-measurement-programme` |
| 6 | ISMS change plan | DOC-ISMS-025 | `isms/isms-change-plan` |
| 7 | Internal audit programme | DOC-ISMS-082 | `compliance/internal-audit-program` |
| 7 | Internal audit checklist | DOC-ISMS-083 | `isms/isms-internal-audit-checklist` |
| 7 | Internal audit report | DOC-ISMS-084 | `isms/isms-internal-audit-report` |
| 7 | Audit findings register | DOC-ISMS-086 | `isms/audit-findings-register` |
| 7 | Nonconformity and corrective action records | DOC-ISMS-087 | `compliance/capa-nonconformity` |
| 8 | ISMS performance report | DOC-ISMS-081 | `isms/isms-performance-report` |
| 8 | Management review minutes | DOC-ISMS-085 | `compliance/management-review` |
| 8 | Continual improvement register | DOC-ISMS-088 | `isms/continual-improvement-register` |
| 9 | Stage 1 readiness pack | DOC-ISMS-091 | `isms/stage-1-readiness-pack` |
| 10 | Stage 2 audit evidence index | DOC-ISMS-092 | `isms/stage-2-audit-evidence-index` |
| 10 | Certification findings action plan | DOC-ISMS-093 | `isms/certification-findings-action-plan` |

Phase 5 lists the deliverables most organisations need; the full set
depends on your SoA. Annex A has 93 controls in four themes: A.5
organizational (37), A.6 people (8), A.7 physical (14) and A.8
technological (34). Topic-specific policies for the other selected
controls are listed in the policy framework (DOC-ISMS-005).

## 5. Gantt charts by tier

<!-- Guidance: Keep only the chart for your tier and replace the dates. Each bar matches a phase in section 2 and a duration in section 3. Dates are Example values starting on Monday 2027-01-04. -->

### 5.1 Small: Quillmere Analytics Ltd (about 6 months)

Part-time ISMS manager (0.5 FTE, the Head of Engineering Operations),
whole company in scope, single cloud provider. Internal audit IA-2027-01
runs from 2027-03-15 to 2027-03-17 (report 2027-03-29), the management
review is held on 2027-04-06, Stage 1 on 2027-04-12 and 2027-04-13 (1.5
audit days) and Stage 2 from 2027-05-10 to 2027-05-12 (3.5 audit days).
Findings response and the certification body's decision (2027-06-15 in
the *Example*) fall inside the six-month target.

```mermaid
gantt
  title Small tier, Quillmere Analytics Ltd (Example)
  dateFormat YYYY-MM-DD
  section Build
  P0 Decide :s0, 2027-01-04, 14d
  P1 Context and scope :s1, 2027-01-11, 21d
  P2 Leadership and policy :s2, 2027-01-18, 21d
  P3 Risk and SoA :s3, 2027-02-01, 42d
  P4 Support :s4, 2027-02-01, 42d
  P5 Annex A implementation :s5, 2027-02-08, 56d
  section Operate and check
  P6 Operate and collect records :s6, 2027-02-15, 84d
  P7 Internal audit :s7, 2027-03-15, 14d
  P8 Management review :s8, 2027-04-05, 7d
  section Certify
  P9 Stage 1 audit :s9, 2027-04-12, 7d
  Close Stage 1 issues :s9b, 2027-04-19, 21d
  P10 Stage 2 audit :s10, 2027-05-10, 7d
```

### 5.2 Medium: Quillmere Health Systems (about 10 months)

Full-time ISMS manager and a 3-person security team; two offices and a
colocation suite. Stage 2 runs in the two weeks starting 2027-10-18,
matching the milestones in the project charter (DOC-ISMS-009).

```mermaid
gantt
  title Medium tier, Quillmere Health Systems (Example)
  dateFormat YYYY-MM-DD
  section Build
  P0 Decide :m0, 2027-01-04, 21d
  P1 Context and scope :m1, 2027-01-25, 35d
  P2 Leadership and policy :m2, 2027-02-08, 35d
  P3 Risk and SoA :m3, 2027-03-01, 56d
  P4 Support :m4, 2027-03-15, 70d
  P5 Annex A implementation :m5, 2027-04-12, 112d
  section Operate and check
  P6 Operate and collect records :m6, 2027-05-17, 154d
  P7 Internal audit :m7, 2027-08-02, 28d
  P8 Management review :m8, 2027-08-30, 7d
  section Certify
  P9 Stage 1 audit :m9, 2027-09-13, 7d
  Close Stage 1 issues :m9b, 2027-09-20, 28d
  P10 Stage 2 audit :m10, 2027-10-18, 14d
```

### 5.3 Large or multi-site: Quillmere Group (about 15 months)

CISO with a 14-person security office; 6 sites in 4 countries; existing
ISO 9001 and ISO 22301 systems. Annex A implementation runs in two
waves: wave 1 covers HQ, the data centre and the service centre; wave 2
covers the 3 plants, including OT. Stage 2 completes in the three weeks
starting 2028-03-20. Wave 2 ends on 2027-12-06, which leaves the plants
about 15 weeks of records before Stage 2: start each plant's recurring
controls as soon as they go live rather than at the end of the wave.
Site sampling for a multi-site certificate is decided by the
certification body under ISO/IEC 27006-1:2024 and IAF MD 1:2023 (now
re-issued by Global ACI as Global ACI-TECH-3-001; check the current
issue), so plan every site to be audit-ready.

```mermaid
gantt
  title Large tier, Quillmere Group (Example)
  dateFormat YYYY-MM-DD
  section Build
  P0 Decide :l0, 2027-01-04, 28d
  P1 Context and scope :l1, 2027-02-01, 56d
  P2 Leadership and policy :l2, 2027-02-15, 56d
  P3 Risk and SoA :l3, 2027-03-29, 84d
  P4 Support :l4, 2027-04-12, 112d
  P5 Wave 1 HQ, data centre, service centre :l5a, 2027-05-03, 126d
  P5 Wave 2 three plants and OT :l5b, 2027-07-05, 154d
  section Operate and check
  P6 Operate and collect records :l6, 2027-07-05, 280d
  P7 Internal audit, all sites :l7, 2027-12-06, 42d
  P8 Management review :l8, 2028-01-17, 14d
  section Certify
  P9 Stage 1 audit :l9, 2028-02-07, 14d
  Close Stage 1 issues :l9b, 2028-02-21, 28d
  P10 Stage 2 audit :l10, 2028-03-20, 21d
```

## 6. Critical path

<!-- Guidance: The critical path is the chain of dependent work that sets the earliest Stage 2 date. Any slip on it moves Stage 2. Watch these items weekly; everything else has some float. -->

The critical path for most organisations is:

1. **Decision and sponsor** (phase 0): no budget, no people.
2. **Scope approved** (phase 1): the risk assessment cannot start on an
   unstable boundary.
3. **Risk assessment, SoA and treatment plan approved** (phase 3): the
   controls to implement follow from them.
4. **Priority controls implemented** (phase 5): especially those that
   generate recurring records (identity and access, logging and
   monitoring, backup, vulnerability management, supplier reviews).
5. **Records period** (phase 6): enough time for recurring controls to
   run at least once and for measurement results to exist.
6. **Internal audit, then management review** (phases 7 and 8): the
   management review needs the audit results as an input.
7. **Stage 1, closing its issues, then Stage 2** (phases 9 and 10): the
   gap between Stage 1 and Stage 2 is agreed with the certification
   body and must leave time to close Stage 1 issues.

```mermaid
flowchart LR
  A["Sponsor and budget"] --> B["Scope approved"]
  B --> C["Risk assessment, SoA, treatment plan"]
  C --> D["Priority controls live"]
  D --> E["Records period"]
  E --> F["Internal audit"]
  F --> G["Management review"]
  G --> H["Stage 1"]
  H --> I["Stage 1 issues closed"]
  I --> J["Stage 2"]
```

Items with float *(Example)*: support activities in phase 4 (as long as
awareness training completes before the internal audit), document
formatting, the policy framework index, and lower-priority treatment
actions scheduled after Stage 2 with risk owner approval.

## 7. Common delays and how to avoid them

<!-- Guidance: Review this list at each steering group meeting. Most delays are about people's time and decisions, not about technology. -->

| ID | Delay | Typical effect *(Example)* | Prevention |
|---|---|---|---|
| DLY-001 | Sponsor not engaged, decisions wait for meetings | 2 to 6 weeks per gate | Fixed gate dates in the charter; decisions by written procedure between meetings |
| DLY-002 | Scope keeps changing | Risk assessment redone | Freeze scope at the phase 1 gate; later changes through a project change request |
| DLY-003 | Risk workshops cannot get risk owners | Phase 3 doubles in length | Book workshops at kick-off; use the threat catalogue to prepare scenarios |
| DLY-004 | Control owners have no time | Phase 5 slips, records period shrinks | Named allocations in DOC-ISMS-031; backfill where needed |
| DLY-005 | Logging, backup testing or vulnerability management needs new tooling | Procurement adds 4 to 8 weeks | Identify tooling needs in the gap assessment; start procurement in phase 3 |
| DLY-006 | Supplier evidence (certificates, reports) arrives late | Supplier controls not evidenced | Request supplier evidence in phase 1; track in the supplier register |
| DLY-007 | Internal auditor not independent or not trained | Audit repeated or results challenged | Contract an external internal auditor or cross-team auditor early |
| DLY-008 | Certification body has no audit slots | Stage 1 moves by 4 to 8 weeks | Select and contract the certification body in phase 5 at the latest |
| DLY-009 | Records produced in a rush just before Stage 1 | Findings on effectiveness | Start recurring controls as soon as each control goes live |
| DLY-010 | Multi-site: one site lags behind | Certificate scope limited or Stage 2 delayed | Site readiness dashboard; phase sites in waves |

## 8. After Stage 2: the certification cycle

<!-- Guidance: Plan beyond the certificate. Surveillance audits test that the ISMS kept running; most surveillance findings come from recurring controls that stopped after the initial audit. -->

After a positive certification decision by the certification body, the
certificate cycle is three years:

- surveillance audits at least once each calendar year, except in
  recertification years, with the first surveillance audit no later
  than 12 months from the certification decision date;
- a recertification audit planned and completed before the certificate
  expires;
- internal audits, management reviews and recurring controls continue
  on the annual calendar.

| Activity | Template |
|---|---|
| Three-year audit and activity plan | `isms/certification-cycle-plan` |
| Annual calendar of recurring ISMS activities | `isms/isms-annual-calendar` |
| Readiness check before each surveillance audit | `isms/surveillance-readiness-health-check` |
| Scope extensions and new sites | `isms/scope-extension-multisite-plan` |
| Use of the certification mark | `isms/certification-mark-usage` |

```mermaid
stateDiagram-v2
  [*] --> Certified: certification decision
  Certified --> Surveillance1: within 12 months
  Surveillance1 --> Surveillance2: next calendar year
  Surveillance2 --> Recertification: before expiry
  Recertification --> Certified: new 3-year cycle
```

## 9. Size tiers

<!-- Guidance: What changes by tier is not only duration: the governance, the number of parallel workstreams and the evidence approach change too. These are the library's working tiers, not official definitions. -->

| Aspect | Small: Quillmere Analytics Ltd | Medium: Quillmere Health Systems | Large: Quillmere Group |
|---|---|---|---|
| Profile | 46 staff (38 employees, 8 contractors), one office plus remote, one public cloud in two regions (primary and DR), processor of customer personal data | 320 staff, two offices, one colocation suite, processor for hospitals and controller for staff and marketing data | 2,400 staff, 6 sites in 4 countries (HQ, 3 plants, 1 service centre, 1 data centre), OT and IT, ISO 9001 and ISO 22301 certified |
| Target *(Example)* | 6 months | 10 months for ISO/IEC 27001, ISO/IEC 27701 the year after | 15 months, phased by site |
| Workstreams | One, run by the part-time ISMS manager | Four (context and policy, risk, controls, audit readiness) | Group workstreams plus one per site; OT security workstream |
| Phase 5 emphasis | Cloud configuration, identity, endpoint management, supplier (cloud provider) evidence | Colocation and data centre controls, clinical customer requirements, incident process | OT segmentation and change control, site physical controls, integration with existing management system processes |
| Phase 6 records period *(Example)* | 12 weeks | 22 weeks | 40 weeks across both waves |
| Internal audit | External auditor contracted for 3 to 5 days *(Example)* | Internal auditor plus external support | Existing internal audit function extended, integrated with ISO 9001 and ISO 22301 audits |
| Typical pitfall | One person holds all knowledge | Security team carries all the work, control owners disengage | Sites move at different speeds; group and local policies conflict |

## 10. Records and evidence

<!-- Guidance: These records show the ISMS was planned (clause 6.2) and operational planning was controlled (clause 8.1). -->

| Record | Proves | Owner | Location | Retention *(Example)* |
|---|---|---|---|---|
| Approved roadmap and versions | Planning of how objectives are achieved | [@isms-manager] | [Document management system] | Life of the ISMS plus 3 years |
| Phase gate decisions | Controlled progress, management involvement | [@sponsor] | [Steering group minutes] | 3 years |
| Progress and RAG reports | Monitoring of the plan | [@isms-project-manager] | [Project workspace] | 3 years |
| Deliverables listed in section 4 | Clause and control requirements met | Each document owner | [ISMS records library] | As set in the documented information register |

List the roadmap in the documented information register
(`isms/isms-documented-information-register`) and link each
deliverable's records in the control evidence matrix
(`isms/control-evidence-matrix`).

## 11. References

<!-- Guidance: Cite exact editions. Accreditation mandatory documents change issue numbers, and IAF's roles moved to the Global Accreditation Cooperation in 2026: check the current issue before relying on one. -->

| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022, information security management systems requirements | 2022, with Amd 1:2024 (published 2024-02-23) | Clauses 4 to 10, Annex A. https://www.iso.org/standard/82875.html, https://www.iso.org/standard/88435.html |
| ISO/IEC 27002:2022, information security controls | 2022 | Control guidance for phase 5. https://www.iso.org/standard/75652.html |
| ISO/IEC 27003:2017, ISMS guidance | 2017 (a revision is in progress; check for a newer edition) | Implementation guidance. https://www.iso.org/standard/63417.html |
| ISO/IEC 27005:2022, information security risk management | 2022 | Phase 3. https://www.iso.org/standard/80585.html |
| ISO/IEC 17021-1:2015, requirements for certification bodies | 2015 | Stage 1, Stage 2, surveillance, recertification. https://www.iso.org/standard/61651.html |
| ISO/IEC 27006-1:2024, requirements for ISMS certification bodies | 2024 | Audit time, multi-site sampling. https://www.iso.org/standard/82908.html |
| ISO 19011:2026, guidelines for auditing management systems | 2026 | Internal audit in phase 7. https://www.iso.org/standard/88984.html |
| IAF MD 1:2023, audit and certification of a multi-site management system, now re-issued by Global ACI as Global ACI-TECH-3-001 | IAF MD 1 issue 3 (2023). Global Accreditation Cooperation Incorporated (Global ACI) replaced IAF and ILAC on 2026-01-01; Global ACI-TECH-3-001 v1.0 issued 2026-07-10, in force 2026-08-28: check the current issue | Multi-site sampling for the large tier; accredited certification under the Global ACI MRA (formerly IAF MLA) |

Related templates: `isms/isms-project-charter`, `isms/isms-business-case`,
`isms/isms-budget-resource-plan`, `isms/certification-cycle-plan`,
`isms/isms-annual-calendar`, `isms/isms-worked-walkthrough`.

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 including Amd 1:2024
(clauses 4 to 10, Annex A) and the certification process in ISO/IEC
17021-1:2015 and ISO/IEC 27006-1:2024. The phases, durations, charts and
examples are original; no ISO/IEC text is reproduced. You need the
official standards for the requirements themselves:
https://www.iso.org/standard/82875.html. Check the current edition of
every standard and accreditation mandatory document before use. Durations and dates are
*Example* values, and certification decisions belong to the accredited
certification body. Template licence: MIT.