# ISMS Process Map: [Organization name] > The process map of an information security management system (ISMS): > which processes run the ISMS, who owns them, what goes in and comes out, > how they connect and how their performance is measured. It supports > ISO/IEC 27001:2022 + Amd 1:2024 clause 4.4, which treats the ISMS as a set of connected processes > rather than a pile of documents, and clause 8.1 on operational planning and control. The > grouping into governance, risk, operational and support processes is > loosely oriented on the process reference model in ISO/IEC TS > 27022:2021, without reproducing it. Replace every `[bracketed]` value > and every row marked *Example*. ## Document control | Field | Value | |---|---| | Document ID | DOC-ISMS-004 | | Version | [1.0] | | Status | [Draft / In review / Approved / Superseded] | | Owner | [@isms-manager] | | Approvers/reviewers | [@ciso], [@coo], [@process-owners] | | Last updated | YYYY-MM-DD | | Classification | [Internal] | | Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024, clauses 4.4 and 8.1; orientation ISO/IEC TS 27022:2021 | | Scope reference | DOC-ISMS-002 | | Roles reference | DOC-ISMS-006 | | Number of processes | [21] | | Next scheduled review | YYYY-MM-DD | ### Approvals | Role | Name | Decision | Date | |---|---|---|---| | ISMS manager | [@isms-manager] | [Prepared] | YYYY-MM-DD | | Chief information security officer | [@ciso] | [Approved / Approved with changes] | YYYY-MM-DD | | Top management representative | [@coo] | [Approved] | YYYY-MM-DD | ### Revision history | Version | Date | Author | Change | |---|---|---|---| | 1.0 *(Example)* | 2027-02-10 | [@isms-manager] | First process map for the certification project | | 1.1 *(Example)* | 2027-09-01 | [@isms-manager] | O-04 vulnerability and threat management split from O-05 incident management; owner of S-02 changed | ## Contents 1. Purpose and scope 2. Process approach and model 3. Process landscape 4. Process register 5. Process interactions 6. SIPOC for key processes 7. Mapping of processes to clauses 8. Process performance indicators 9. Process owner duties and process description minimum 10. Process review and maturity 11. Size tiers 12. Records and evidence 13. References ## 1. Purpose and scope This document defines the processes that establish, run, monitor and improve the ISMS of [Organization name] within the scope set in DOC-ISMS-002. It names an owner for each process, its inputs and outputs, the processes it hands over to, its key performance indicators and the clauses of ISO/IEC 27001 it serves. It covers ISMS processes, not the business processes the ISMS protects. Business processes (for example customer onboarding or software release) appear only where an ISMS process interfaces with them, such as change management or supplier management. Users: top management, the ISMS manager, process owners, control owners, internal auditors and the certification body during Stage 1. ## 2. Process approach and model The ISMS is run as a set of interacting processes, following the plan-do-check-act logic of the management system clauses: - **Governance processes (G)** set direction and check the system: context and scope, leadership and policy, objectives and planned changes, performance monitoring, internal audit, management review and improvement. - **Risk processes (R)** identify, analyse, evaluate, treat and accept information security risks and keep the Statement of Applicability current. - **Operational processes (O)** run the controls day to day: operational planning and control, access and identity, change and configuration, vulnerability and threat management, incident management, supplier security and ICT readiness. - **Support processes (S)** give the other processes what they need: resources, competence and awareness, communication and documented information. ISO/IEC TS 27022:2021 describes a process reference model for ISMS processes. This map follows the same process-oriented idea but uses four groups and its own process names. If you want to align closely with the TS, read it and adjust section 4; do not copy its process descriptions into your documents. The TS is under systematic review, with a preliminary work item for a revision listed in the ISO catalogue on 2026-11-01. ## 3. Process landscape ```mermaid flowchart TD IP["Interested party requirements and issues"] --> G01 subgraph GOV["Governance processes"] G01["G-01 Context and scope"] G02["G-02 Leadership and policy"] G03["G-03 Objectives and planned changes"] G04["G-04 Performance monitoring"] G05["G-05 Internal audit"] G06["G-06 Management review"] G07["G-07 Improvement and corrective action"] end subgraph RSK["Risk processes"] R01["R-01 Risk assessment"] R02["R-02 Risk treatment and SoA"] R03["R-03 Risk acceptance and monitoring"] end subgraph OPS["Operational processes"] O01["O-01 Operational planning and control"] O02["O-02 Access and identity"] O03["O-03 Change and configuration"] O04["O-04 Vulnerability and threat"] O05["O-05 Incident management"] O06["O-06 Supplier security"] O07["O-07 ICT readiness and continuity"] end subgraph SUP["Support processes"] S01["S-01 Resources"] S02["S-02 Competence and awareness"] S03["S-03 Communication"] S04["S-04 Documented information"] end G01 --> R01 G02 --> G03 R01 --> R02 R02 --> R03 R02 --> O01 O01 --> G04 G04 --> G06 G05 --> G06 G06 --> G07 G07 --> R01 G06 --> G03 SUP -.-> OPS SUP -.-> GOV G06 --> OUT["Protected information and evidence for interested parties"] ``` How to read it: context feeds risk assessment, risk treatment drives the operation of controls, operation produces measurements, monitoring and audit feed management review, and management review drives improvement and new objectives, which loops back into the next risk cycle. Support processes serve all the others (dotted lines). ## 4. Process register | ID | Process | Owner | Purpose | Key inputs | Key outputs | Main documents | |---|---|---|---|---|---|---| | G-01 *(Example)* | Context and scope | [@isms-manager] | Determine issues, parties, requirements and scope | Strategy, contracts, legal register, interfaces | Context analysis, scope statement | DOC-ISMS-003, DOC-ISMS-002 | | G-02 *(Example)* | Leadership and policy | [@ceo] | Show commitment, set policy, assign roles | Context, risk appetite, business strategy | Information security policy, topic policies, roles | DOC-ISMS-001, DOC-ISMS-005, DOC-ISMS-006 | | G-03 *(Example)* | Objectives and planned changes | [@ciso] | Set measurable objectives and plan ISMS changes | Policy, risks, review decisions | Objectives register, ISMS change plans | DOC-ISMS-024, DOC-ISMS-025 | | G-04 *(Example)* | Performance monitoring | [@isms-manager] | Measure and evaluate ISMS and control performance | Measurement definitions, operational data | Measurement results, performance report | DOC-ISMS-080, DOC-ISMS-081 | | G-05 *(Example)* | Internal audit | [@internal-audit-lead] | Check conformity and effective implementation | Audit programme, previous results, risks | Audit reports, findings | DOC-ISMS-082, DOC-ISMS-083, DOC-ISMS-084 | | G-06 *(Example)* | Management review | [@ceo] | Decide on suitability, adequacy and effectiveness of the ISMS | Review inputs from all processes | Decisions, actions, resource changes | DOC-ISMS-085 | | G-07 *(Example)* | Improvement and corrective action | [@isms-manager] | Correct nonconformities, remove causes, improve | Findings, incidents, review decisions | Corrective actions, improvement register | DOC-ISMS-087, DOC-ISMS-086, DOC-ISMS-088 | | R-01 *(Example)* | Risk assessment | [@risk-manager] | Identify, analyse and evaluate risks | Method, criteria, assets, threats, context | Risk register, assessment report | DOC-ISMS-010, DOC-ISMS-015, DOC-ISMS-016, DOC-ISMS-017 | | R-02 *(Example)* | Risk treatment and SoA | [@ciso] | Select treatments and controls, keep the SoA current | Evaluated risks, Annex A, requirements | Risk treatment plan, SoA | DOC-ISMS-013, DOC-ISMS-011 | | R-03 *(Example)* | Risk acceptance and monitoring | [@risk-manager] | Obtain acceptance of residual risk, track risk changes | Treatment results, criteria | Acceptance records, risk trend | DOC-ISMS-019, DOC-ISMS-016 | | O-01 *(Example)* | Operational planning and control | [@it-ops-lead] | Plan and control the running of controls, including outsourced processes | Treatment plan, SoA, operating procedures | Operating records, control evidence | DOC-ISMS-049, DOC-ISMS-033 | | O-02 *(Example)* | Access and identity | [@iam-lead] | Grant, review and remove access under least privilege | HR events, access requests, policy | Access records, review results | DOC-ISMS-041 | | O-03 *(Example)* | Change and configuration | [@it-ops-lead] | Control changes and keep secure configurations | Change requests, baselines | Approved changes, configuration records | DOC-ISMS-060, `ops/change-enablement-policy` | | O-04 *(Example)* | Vulnerability and threat | [@security-engineer] | Find and fix vulnerabilities, use threat intelligence | Scans, advisories, intelligence feeds | Remediation tracker, intelligence reports | DOC-ISMS-072, DOC-ISMS-045 | | O-05 *(Example)* | Incident management | [@security-ops-lead] | Detect, respond to and learn from incidents | Event reports, monitoring alerts | Incident records, reviews, notifications | DOC-ISMS-020, DOC-ISMS-021, DOC-ISMS-022, DOC-ISMS-023 | | O-06 *(Example)* | Supplier security | [@procurement-lead] | Assess, contract, monitor and exit suppliers securely | Supplier requests, risk criteria | Supplier register, assessments, agreements | DOC-ISMS-066, DOC-ISMS-067, DOC-ISMS-068 | | O-07 *(Example)* | ICT readiness and continuity | [@bc-manager] | Keep ICT ready to meet continuity objectives | BIA, recovery objectives | ICT readiness plan, test results | DOC-ISMS-047, DOC-ISMS-120, DOC-ISMS-121 | | S-01 *(Example)* | Resources | [@coo] | Provide people, budget and tools | Plans, review decisions | Budget, resource plan | DOC-ISMS-031 | | S-02 *(Example)* | Competence and awareness | [@hr-lead] | Ensure competence and awareness | Role requirements, gaps | Training records, competence matrix | DOC-ISMS-026 | | S-03 *(Example)* | Communication | [@isms-manager] | Plan internal and external communication | Communication needs | Communication plan and log | DOC-ISMS-027 | | S-04 *(Example)* | Documented information | [@isms-manager] | Create, control and retain documents and records | Document requests, retention rules | Document register, controlled documents | DOC-ISMS-028 | Total: 7 governance, 3 risk, 7 operational and 4 support processes, 21 processes in all *(Example)*. ## 5. Process interactions | From | Output handed over | To | Frequency *(Example)* | |---|---|---|---| | G-01 | Issues, requirements, scope | R-01, G-02, O-06 | Annually and on trigger | | G-02 | Policy, roles, risk appetite approval | G-03, R-01, S-02 | Annually | | R-01 | Evaluated risks | R-02, G-06, G-07 (reassessment results) | Annually and on trigger | | R-02 | Treatment plan, SoA | O-01, G-03, S-01 | After each assessment | | R-02 | Residual risks for acceptance | R-03 | After each assessment | | O-01 to O-07 | Control evidence and operational data | G-04, G-05 | Continuous, monthly summary | | O-05 | Lessons learned, new threats | R-01, G-07 | After each significant incident | | O-04 | Emerging threats and unremediated vulnerabilities | R-01, O-05 | Monthly | | O-06 | Supplier risks and incidents | R-01, O-05 | On assessment and event | | G-04 | Measurement results | G-06, G-03 | Quarterly | | G-05 | Audit results, nonconformities | G-07, G-06 | Per audit | | G-06 | Decisions, actions, resource changes | G-03, G-07, S-01 | At least annually | | G-07 | Corrective actions and improvements, action status | R-01, O-01, S-04, G-06 | Continuous | | S-04 | Controlled documents, records | All | Continuous | | S-02 | Competent and aware staff | All | Continuous | | S-03 | Communications to parties | All, interested parties | Per plan | ```mermaid sequenceDiagram participant O as O-05 Incident management participant R as R-01 Risk assessment participant G7 as G-07 Improvement participant G6 as G-06 Management review O->>G7: Post-incident review with root cause G7->>R: Request to reassess affected risks R->>G7: Updated risk scores and new treatment need G7->>G6: Status of corrective actions G6->>G7: Decision on resources and priority ``` The sequence shows one typical chain from the table: an incident leads to a corrective action, a reassessment of risk and a management decision. ## 6. SIPOC for key processes ### 6.1 R-01 Risk assessment | Suppliers | Inputs | Process steps | Outputs | Customers | |---|---|---|---|---| | G-01, asset owners, O-04, O-05, O-06 | Context, asset inventory, threat catalogue, incidents, supplier risks, risk criteria | 1. Plan the cycle. 2. Identify risks (event-based or asset-based). 3. Analyse likelihood and impact on the 5 x 5 scale. 4. Evaluate against bands and criteria. 5. Report | Updated risk register, risk assessment report | R-02, R-03, G-06, risk owners | ### 6.2 O-05 Incident management | Suppliers | Inputs | Process steps | Outputs | Customers | |---|---|---|---|---| | All staff, monitoring provider, customers, suppliers | Event reports, alerts, threat intelligence | 1. Report and log. 2. Assess and classify. 3. Contain, eradicate, recover. 4. Notify where required. 5. Review and learn | Incident records, notifications, post-incident reviews | Customers, authorities where required, R-01, G-07, G-06 | ### 6.3 G-05 Internal audit | Suppliers | Inputs | Process steps | Outputs | Customers | |---|---|---|---|---| | G-06, R-01, previous audits | Audit programme, risk results, previous findings, process changes | 1. Plan the audit. 2. Prepare checklist. 3. Collect evidence. 4. Report findings. 5. Follow up | Audit report, nonconformities, observations | G-07, G-06, process owners | ### 6.4 G-06 Management review | Suppliers | Inputs | Process steps | Outputs | Customers | |---|---|---|---|---| | G-04, G-05, R-01, O-05, G-01, S-01 | Status of previous actions, changes in issues and parties, performance, audit results, risk status, opportunities | 1. Collect inputs. 2. Hold the review. 3. Decide. 4. Record minutes. 5. Track actions | Decisions on improvement and changes, resource decisions, minutes | G-03, G-07, S-01, all owners | ## 7. Mapping of processes to clauses | Clause (ISO/IEC 27001:2022) | Short label (own words) | Process | |---|---|---| | 4.1 | Issues | G-01 | | 4.2 | Interested parties and requirements | G-01 | | 4.3 | Scope | G-01 | | 4.4 | ISMS and its processes | G-01, this document | | 5.1 | Leadership and commitment | G-02 | | 5.2 | Policy | G-02 | | 5.3 | Roles, responsibilities and authorities | G-02 | | 6.1.1 | Risks and opportunities, general | R-01, G-03 | | 6.1.2 | Risk assessment | R-01 | | 6.1.3 | Risk treatment and SoA | R-02, R-03 | | 6.2 | Objectives | G-03 | | 6.3 | Planning of changes | G-03 | | 7.1 | Resources | S-01 | | 7.2 | Competence | S-02 | | 7.3 | Awareness | S-02 | | 7.4 | Communication | S-03 | | 7.5 | Documented information | S-04 | | 8.1 | Operational planning and control | O-01 | | 8.2 | Performing risk assessments | R-01 | | 8.3 | Implementing risk treatment | R-02, O-01 | | 9.1 | Monitoring and measurement | G-04 | | 9.2 | Internal audit | G-05 | | 9.3 | Management review | G-06 | | 10.1 | Continual improvement | G-07 | | 10.2 | Nonconformity and corrective action | G-07 | Annex A control groups mapped to operational processes *(Example)*: | Process | Main Annex A controls (number and own label) | |---|---| | O-02 | A.5.15 to A.5.18 access rules, identity, authentication information, access rights; A.8.2 to A.8.5 privileged access, access restriction, source code access, secure authentication | | O-03 | A.8.9 configuration management, A.8.32 change management | | O-04 | A.5.7 threat intelligence, A.8.8 technical vulnerabilities | | O-05 | A.5.24 to A.5.28 incident planning, assessment, response, learning, evidence; A.6.8 event reporting | | O-06 | A.5.19 to A.5.23 supplier relationships, agreements, ICT supply chain, monitoring, cloud services | | O-07 | A.5.29 security during disruption, A.5.30 ICT readiness, A.8.13 backup, A.8.14 redundancy | | O-01 | A.5.37 documented operating procedures and the remaining controls marked applicable in the SoA | Keep these labels consistent with the SoA (DOC-ISMS-011, `compliance/statement-of-applicability`). ## 8. Process performance indicators | Process | Indicator | Target *(Example)* | Source | Frequency | |---|---|---|---|---| | G-01 | Context analysis reviewed within 12 months | 100% | Revision history | Annually | | G-03 | Objectives on track | At least 80% | Objectives register | Quarterly | | G-05 | Audit programme completed as planned | 100% of planned audits in the cycle | Audit programme | Quarterly | | G-06 | Management review actions closed by due date | At least 90% | Action log | Quarterly | | G-07 | Corrective actions closed within agreed time | At least 85% | CAPA records | Monthly | | R-01 | Risk assessment cycle completed on schedule | Yes | Assessment report | Annually | | R-03 | Accepted risks past their review date | 0 | Acceptance register | Monthly | | O-02 | Leaver accounts disabled within 24 hours | At least 98% | Identity system | Monthly | | O-03 | Changes with security review before production | 100% of high-risk changes | Change records | Monthly | | O-04 | Critical vulnerabilities fixed within target time | At least 95% | Remediation tracker | Monthly | | O-05 | Incidents reported to customers within contract deadline | 100% | Incident register | Monthly | | O-06 | Critical suppliers assessed within 12 months | 100% | Supplier register | Quarterly | | O-07 | ICT recovery tests meeting the recovery time objective | 100% of tests | Test reports | Per test | | S-02 | Staff with current awareness training | At least 95% | Training records | Monthly | | S-04 | Documents past review date | Under 5% | Document register | Monthly | Full definitions (formula, data source, owner, thresholds) belong in the measurement programme (DOC-ISMS-080, `isms/isms-measurement-programme`), and results in the performance report (DOC-ISMS-081). ## 9. Process owner duties and process description minimum Each process owner: 1. keeps the process description current and approved; 2. makes sure the people who run the process are competent and aware; 3. monitors the process indicators and acts on adverse trends; 4. keeps the records listed in section 12 for their process; 5. reports status and issues to the ISMS manager for management review; 6. raises changes to the process through the ISMS change plan when the change affects the ISMS (DOC-ISMS-025); 7. takes part in internal audits of the process and owns its corrective actions. Minimum content of a process description (one page is often enough): ```text Process ID and name: Owner and deputy: Purpose: Trigger (event or schedule): Inputs and their suppliers: Steps (5 to 10 lines): Outputs and their customers: Records produced and where kept: Indicators (link to DOC-ISMS-080): Related procedures and policies (document IDs): Clauses and Annex A controls served: Last review date: ``` ## 10. Process review and maturity Once a year, before management review, each owner rates the process on this simple scale: | Level | Description | |---|---| | 1 Initial | Done, but depends on individuals; few records | | 2 Repeatable | Documented steps, records kept, owner known | | 3 Defined | Description approved, indicators measured, staff trained | | 4 Measured | Indicators reviewed and acted on, targets met most of the time | | 5 Improving | Lessons from audits, incidents and indicators change the process | | Process | Level last year | Level now | Main gap | Improvement action | |---|---|---|---|---| | O-06 *(Example)* | 1 | 2 | No register of critical suppliers before the project | Supplier register built, assessments scheduled (IMP-004) | | G-04 *(Example)* | 2 | 3 | Indicators defined but not reviewed | Quarterly performance report introduced | | [Process] | [n] | [n] | [Gap] | [Action] | Improvement actions go to the continual improvement register (DOC-ISMS-088, `isms/continual-improvement-register`). ## 11. Size tiers | Aspect | Small: Quillmere Analytics Ltd *(Example)* | Medium: Quillmere Health Systems *(Example)* | Large: Quillmere Group *(Example)* | |---|---|---|---| | Profile | 46 staff (38 employees, 8 contractors), B2B SaaS, part-time ISMS manager (0.5 FTE, the Head of Engineering Operations) | 320 staff, full-time ISMS manager plus 3-person security team, two offices and a colocation suite | 2,400 staff, 6 sites in 4 countries, OT and IT, CISO with a 14-person security office, integrated management system with ISO 9001 and ISO 22301 | | Number of processes | About 14, by merging (for example G-03 into G-02, R-03 into R-02, O-02 to O-04 as one "IT security operations" process, S-01 to S-04 as one support process: 6 governance, 2 risk, 5 operational, 1 support) | 21 as in section 4 | 21 group processes plus site-level operational processes for OT (for example plant access and OT change) | | Owners | 4 people own everything: CEO, ISMS manager (the Head of Engineering Operations), CTO, finance and people lead | 13 named owner roles, as in section 4 | Group process owners in the CISO office, with site owners for operational processes | | Segregation guardrail | The ISMS manager must not audit their own processes: internal audit outsourced or done by a trained peer from another function | Internal audit by a separate trained auditor | Internal audit function independent of the CISO office | | Shared processes | None | Change and supplier processes shared with IT operations | Document control, internal audit, management review and improvement shared with the ISO 9001 and ISO 22301 systems | | Description form | One page per merged process | Process descriptions per section 9 | Group process manual plus site annexes | ## 12. Records and evidence | Process | Records that prove it operates | Owner | Where kept | Retention *(Example)* | |---|---|---|---|---| | G-01 | Approved context analysis, scope statement | [@isms-manager] | Document system | 3 years after supersession | | G-02 | Signed policy, communication evidence, role assignments | [@ceo] | Document system | 3 years after supersession | | G-03 | Objectives register, change plans | [@ciso] | GRC tool or register | 3 years | | G-04 | Measurement results, performance reports | [@isms-manager] | Reporting folder | 3 years | | G-05 | Audit programme, reports, checklists | [@internal-audit-lead] | Audit folder | 3 years or one certification cycle | | G-06 | Management review minutes and action log | [@ceo] | Board or ISMS folder | 3 years or one certification cycle | | G-07 | Nonconformity and corrective action records | [@isms-manager] | CAPA register | 3 years after closure | | R-01 to R-03 | Risk register snapshots, assessment reports, acceptance records | [@risk-manager] | GRC tool | 3 years | | O-01 to O-07 | Access reviews, change records, vulnerability tracker, incident register, supplier assessments, test reports | Process owners | Operational systems | Per retention schedule | | S-01 to S-04 | Budget approvals, training records, communication log, document register | Process owners | HR, finance and document systems | Per retention schedule | Link each record type to the controls it evidences in the control evidence matrix (DOC-ISMS-033, `isms/control-evidence-matrix`), and list the process map itself in the documented information register (DOC-ISMS-028). The annual calendar (DOC-ISMS-032, `isms/isms-annual-calendar`) schedules the recurring process activities. ## 13. References | Reference | Edition | Use | |---|---|---| | ISO/IEC 27001:2022, ISMS requirements | 2022, https://www.iso.org/standard/82875.html | Clauses 4.4, 8.1 and the clause mapping | | ISO/IEC 27001:2022/Amd 1:2024 | 2024-02-23, https://www.iso.org/standard/88435.html | Climate action changes to 4.1 and 4.2 (G-01) | | ISO/IEC TS 27022:2021, ISMS processes | 2021, https://www.iso.org/standard/61004.html | Orientation for the process grouping; under systematic review | | ISO/IEC 27002:2022, controls | 2022, https://www.iso.org/standard/75652.html | Control guidance for operational processes | | ISO/IEC 27003:2017, ISMS guidance | 2017, https://www.iso.org/standard/63417.html | Clause explanations; a revision is in progress, check for a newer edition | | ISO/IEC 27004:2016, measurement | 2016, https://www.iso.org/standard/64120.html | Process indicators; under revision | Related templates: `isms/isms-context-interested-parties`, `isms/isms-roles-raci`, `isms/isms-manual`, `isms/isms-measurement-programme`, `isms/isms-performance-report`, `isms/isms-annual-calendar`, `isms/control-evidence-matrix`, `isms/continual-improvement-register`, `compliance/statement-of-applicability`, `isms/iso-27000-family-map`. ## Standard and licence note Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024, clauses 4.4 and 8.1, with the process grouping loosely oriented on ISO/IEC TS 27022:2021. The process names, register, SIPOC tables, indicators, maturity scale and guidance are original text. No ISO or IEC text, process descriptions or tables are reproduced; read the official standards, sold by ISO, IEC and national standards bodies, for the exact requirements. Check the current edition of each standard before use. This is a documentation format, not certification or legal advice. Template licence: MIT.