# Stage 1 Readiness Pack: [Organization name]

> Readiness pack and checklist for the Stage 1 certification audit of the
> information security management system (ISMS) of [Organization name]
> against ISO/IEC 27001:2022 + Amd 1:2024. It explains what Stage 1
> reviews under ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024, lists the
> document pack mapped to the documented information the standard
> requires, sets go or no-go readiness criteria, covers logistics, and
> gives typical Stage 1 findings with the way to close them before
> Stage 2. Replace every `[bracketed]` value and every row marked
> *Example*.

<!--
Guidance: How to use this template
- When to use: start eight to ten weeks before the Stage 1 date agreed with
  the certification body (CB), after the CB is selected
  (`isms/certification-body-selection`). Send the pack when the CB asks
  for it, usually two to four weeks before Stage 1.
- Fill first: section 4 (document pack). Every row needs an approved,
  current document with a Document ID; a draft in a shared folder is not
  ready.
- Main pitfall: treating Stage 1 as a formality. Stage 1 findings that are
  not closed before Stage 2 are often raised again as nonconformities at
  Stage 2, and serious gaps can lead the CB to postpone Stage 2.
- Related templates: `isms/stage-2-audit-evidence-index`,
  `isms/certification-findings-action-plan`,
  `isms/isms-documented-information-register`,
  `compliance/statement-of-applicability`, `compliance/internal-audit-program`,
  `compliance/management-review`, `isms/certification-audit-explained`.
-->

## Document control

<!-- Guidance: This pack is an internal working document. The documents it lists are the controlled items; this pack points to their IDs and versions so the auditor sees one consistent set. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-091 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@ciso], [@ceo] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal / Confidential] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024; CB rules ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024 |
| Certification body | [CB name] (selected in DOC-ISMS-090) |
| Stage 1 dates and mode | [YYYY-MM-DD to YYYY-MM-DD, on site / remote / mixed] |
| Lead auditor | [name as notified by the CB] |
| Pack sent to CB | [YYYY-MM-DD, by secure channel] |
| Next scheduled review | [After the Stage 1 report, YYYY-MM-DD] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS manager | [@isms-manager] | [Pack complete] | YYYY-MM-DD |
| Top management | [@ceo] | [Go for Stage 1 / Postpone] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 *(Example)* | 2027-03-22 | [@isms-manager] | Pack assembled, 3 documents still in review |
| 1.0 *(Example)* | 2027-04-07 | [@isms-manager] | All documents approved, go decision at the management review of 2027-04-06, pack sent to CB |
| 1.1 *(Example)* | 2027-04-16 | [@isms-manager] | Stage 1 areas of concern added in section 9 |

## Contents

1. Purpose and scope
2. What Stage 1 reviews
3. Timeline to Stage 1 and Stage 2
4. Document pack checklist
5. Records that show the ISMS operates
6. Readiness criteria (go or no-go)
7. Logistics
8. Typical Stage 1 findings and how to close them
9. Stage 1 report and closure tracker
10. Size tiers
11. Records and evidence
12. References

## 1. Purpose and scope

<!-- Guidance: State which audit this pack prepares and for which scope. Questions to answer: is the scope statement in the pack the same one the CB quoted on and the one that will appear on the certificate? Pitfall: a scope that changed after the quote, which can change audit time and delay Stage 2. -->

This pack prepares [Organization name] for the Stage 1 audit of its ISMS.
It gives the ISMS manager one checklist to confirm that the required
documents exist and are approved, that the ISMS has produced records,
that people and systems are available, and that known weak points are
closed or planned before Stage 2.

| Item | Value |
|---|---|
| Scope statement | [Copy from DOC-ISMS-002, version n] |
| Sites and cloud regions in Stage 1 | [list] |
| Persons in scope (as declared to the CB) | [n] |
| Statement of Applicability version | DOC-ISMS-011, version [n] |
| Planned Stage 2 window | [YYYY-MM-DD to YYYY-MM-DD] |

## 2. What Stage 1 reviews

<!-- Guidance: Explain Stage 1 to the people who will meet the auditor. The CB's own audit plan is the authority: read it when it arrives. Pitfall: staff expecting a document check only, then being surprised by questions on scope boundaries, risk results or internal audit findings. -->

Under ISO/IEC 17021-1:2015 the initial certification audit has two stages.
Stage 1 is mainly about the documented system, its readiness and the
planning of Stage 2. The list below is our own paraphrase of the Stage 1
objectives as commonly summarised from ISO/IEC 17021-1:2015; the standard
and the CB's audit plan are the authority. In practice the auditor will
typically:

1. read your core documents (scope, policy, risk method, SoA, objectives
   and the records listed in section 4) and look for gaps against
   clauses 4 to 10 of ISO/IEC 27001:2022 + Amd 1:2024;
2. test whether the scope on paper matches the real business: which
   entities, sites, teams and suppliers are in or out, and whether the
   headcount and site data behind the audit-day quote are still right;
3. ask how you reached your risk decisions, which laws and contracts
   drive them, and what the business context looks like;
4. look for proof that the improvement loop has started (an internal
   audit done, a management review held) and form a view on whether
   Stage 2 can go ahead;
5. walk a site or a system demonstration and talk to the people who run
   the ISMS, to see whether they understand what the standard expects;
6. settle the practical details of Stage 2 with you: who, where, which
   evidence and when.

ISO/IEC 27006-1:2024 adds ISMS-specific expectations for Stage 1, which in
practice centre on the auditor understanding the ISMS design, the risk
assessment and treatment, the SoA, and the information security policy
and objectives before Stage 2 (check the standard for the exact
requirements). The CB decides whether Stage 1 is on site, remote or mixed
under its rules and IAF MD 4:2025, now re-issued by Global ACI as Global
ACI-TECH-3-003 (check the current issue).

A note on CB practice: certification bodies usually expect one full
internal audit of the ISMS and one management review before Stage 2 (CB
practice, not a clause), and enough operating time for the ISMS to have
produced records. This is CB practice
and the auditor's judgement of readiness, not a clause in ISO/IEC 27001.
Ask your CB what it expects and record the answer in section 6.

```mermaid
flowchart LR
  A["Pack sent to CB"] --> B["Stage 1: documents, scope, readiness"]
  B --> C{"Areas of concern?"}
  C -- "None or minor" --> D["Close before Stage 2"]
  C -- "Serious gaps" --> E["CB may postpone Stage 2"]
  E --> F["Fix, then agree new Stage 2 date"]
  D --> G["Stage 2: implementation and effectiveness"]
  F --> G
```

## 3. Timeline to Stage 1 and Stage 2

<!-- Guidance: Work backwards from the Stage 2 window. Leave time between Stage 1 and Stage 2 to close areas of concern; the CB sets the actual interval. The dates below are an Example for Quillmere Analytics Ltd. -->

Example plan *(Example: Quillmere Analytics Ltd, target certificate within
6 months of project start; audit days as quoted by the selected CB: Stage 1
1.5 days over two calendar days, Stage 2 3.5 days over three calendar
days; certification decision 2027-06-15)*:

```mermaid
gantt
  title Stage 1 readiness, Example dates
  dateFormat YYYY-MM-DD
  section ISMS operation
  Internal audit IA-2027-01          :ia, 2027-03-15, 3d
  Internal audit report issued       :milestone, iar, 2027-03-29, 0d
  Management review                  :mr, 2027-04-06, 1d
  section Pack
  Assemble and approve pack          :pk, 2027-03-22, 15d
  Go or no-go decision               :gn, 2027-04-06, 1d
  Pack sent to CB                    :ps, 2027-04-07, 1d
  section Audit
  Stage 1 audit                      :s1, 2027-04-12, 2d
  Close areas of concern             :cl, 2027-04-16, 22d
  Stage 2 audit                      :s2, 2027-05-10, 3d
```

| Milestone | Date *(Example)* | Owner |
|---|---|---|
| Internal audit IA-2027-01 complete (fieldwork 2027-03-15 to 2027-03-17), report issued | 2027-03-29 | [@internal-auditor] |
| Management review held (go decision), minutes approved | 2027-04-06 | [@ceo] |
| Pack complete and approved | 2027-04-06 | [@isms-manager] |
| Pack sent to CB | 2027-04-07 | [@isms-manager] |
| Stage 1 | 2027-04-12 to 2027-04-13 | CB lead auditor |
| Stage 1 report received | 2027-04-16 | CB lead auditor |
| Areas of concern closed | 2027-05-07 | Action owners |
| Stage 2 | 2027-05-10 to 2027-05-12 | CB audit team |

## 4. Document pack checklist

<!-- Guidance: One row per required item. The first table lists the documented information ISO/IEC 27001 explicitly requires (in our own words, clause numbers only). Mark each row Ready only when the document is approved, current and listed in the documented information register. Pitfall: sending twenty policies but no risk treatment results, or an SoA whose version does not match the risk treatment plan. Auditor check: consistency across scope, SoA, risk results and objectives. -->

### 4.1 Documented information the standard explicitly requires

| # | Clause | Required item (paraphrased) | Our document | Version | Status | Owner |
|---|---|---|---|---|---|---|
| 1 | 4.3 | ISMS scope | DOC-ISMS-002 ISMS scope | [n] | [Ready / Not ready] | [@isms-manager] |
| 2 | 5.2 | Information security policy | DOC-ISMS-001 information security policy | [n] | [Ready / Not ready] | [@ceo] |
| 3 | 6.1.2 | Risk assessment process | DOC-ISMS-010 risk assessment methodology (with DOC-ISMS-015 risk criteria) | [n] | [Ready / Not ready] | [@isms-manager] |
| 4 | 6.1.3 | Risk treatment process | DOC-ISMS-010 and DOC-ISMS-013 risk treatment plan | [n] | [Ready / Not ready] | [@isms-manager] |
| 5 | 6.1.3 d | Statement of Applicability | DOC-ISMS-011 SoA | [n] | [Ready / Not ready] | [@isms-manager] |
| 6 | 6.2 | Information security objectives | DOC-ISMS-024 objectives register | [n] | [Ready / Not ready] | [@ciso] |
| 7 | 7.2 | Evidence of competence | DOC-ISMS-026 competence and training matrix, training records | [n] | [Ready / Not ready] | [@hr-lead] |
| 8 | 7.5.1 b | Other documented information the organization judged necessary | Policies, procedures and standards in DOC-ISMS-005 policy index | [n] | [Ready / Not ready] | Policy owners |
| 9 | 8.1 | Enough operational planning records to show that processes ran the way they were meant to | DOC-ISMS-004 process map, DOC-ISMS-032 annual calendar, operating procedures (DOC-ISMS-049) | [n] | [Ready / Not ready] | [@isms-manager] |
| 10 | 8.2 | Risk assessment results | DOC-ISMS-017 risk assessment report and DOC-ISMS-016 risk register | [n] | [Ready / Not ready] | [@isms-manager] |
| 11 | 8.3 | Risk treatment results | DOC-ISMS-013 risk treatment plan status, DOC-ISMS-019 risk acceptance records | [n] | [Ready / Not ready] | Risk owners |
| 12 | 9.1 | Monitoring and measurement results | DOC-ISMS-080 measurement programme, DOC-ISMS-081 performance report | [n] | [Ready / Not ready] | [@isms-manager] |
| 13 | 9.2.2 | Audit programme and audit results | DOC-ISMS-082 internal audit programme, DOC-ISMS-084 internal audit report | [n] | [Ready / Not ready] | [@internal-auditor] |
| 14 | 9.3.3 | Management review results | DOC-ISMS-085 management review minutes | [n] | [Ready / Not ready] | [@ceo] |
| 15 | 10.2 | Nonconformities and corrective actions | DOC-ISMS-087 nonconformity and corrective action records, DOC-ISMS-086 audit findings register | [n] | [Ready / Not ready] | [@isms-manager] |

Clause 6.3 (planning of changes, new in 2022) has no explicit documented
information requirement, but auditors often ask how changes to the ISMS
are planned. Include DOC-ISMS-025 (ISMS change plan) if you keep one.
Amendment 1:2024 added climate change to the context analysis: decide
whether it matters for your ISMS (4.1) and check whether any
stakeholder has climate-related demands (4.2). Make sure DOC-ISMS-003
shows that decision.

### 4.2 Supporting documents auditors usually ask for

| # | Document | ID | Why the auditor asks | Status |
|---|---|---|---|---|
| 16 | Context and interested parties | DOC-ISMS-003 | Clauses 4.1 and 4.2, including the climate decision | [Ready / Not ready] |
| 17 | Roles, responsibilities and RACI | DOC-ISMS-006 | Clause 5.3 | [Ready / Not ready] |
| 18 | Legal, regulatory and contractual register | DOC-ISMS-014 | Clause 4.2 and A.5.31 | [Ready / Not ready] |
| 19 | Asset inventory | DOC-ISMS-012 | Basis of the risk assessment, A.5.9 | [Ready / Not ready] |
| 20 | Communication plan | DOC-ISMS-027 | Clause 7.4 | [Ready / Not ready] |
| 21 | Documented information register | DOC-ISMS-028 | Clause 7.5, control of documents | [Ready / Not ready] |
| 22 | Incident response plan and incident register | DOC-ISMS-020, DOC-ISMS-021 | A.5.24 to A.5.27 | [Ready / Not ready] |
| 23 | Supplier register | DOC-ISMS-066 | A.5.19 to A.5.22 | [Ready / Not ready] |
| 24 | Business continuity and ICT readiness | DOC-ISMS-121, DOC-ISMS-047 | A.5.29, A.5.30 | [Ready / Not ready] |
| 25 | Control evidence matrix | DOC-ISMS-033 | Shows where evidence for each applicable control sits | [Ready / Not ready] |
| 26 | Organisation chart and site list | [ref] | Scope and audit time | [Ready / Not ready] |

### 4.3 Pack rules

- Send documents as read-only exports with the Document ID, version and
  approval date visible.
- Send through the channel agreed with the CB, following DOC-ISMS-043
  (information transfer policy). Do not send Restricted records (for
  example vulnerability details or personal data); offer them for viewing
  during the audit instead.
- Keep an index of exactly what was sent and when (section 11).

## 5. Records that show the ISMS operates

<!-- Guidance: Stage 1 judges readiness, and readiness means records exist. Questions to answer: how long has each process been running, and how many records has it produced? Pitfall: a pack full of approved policies with no records dated after the approval. -->

| Process | Record | Period covered | Count *(Example)* | Status |
|---|---|---|---|---|
| Internal audit | Audit reports, findings | [from to] | 1 full cycle, 4 findings (AF-2027-001 to 004) | [Ready / Not ready] |
| Management review | Minutes and actions | [date] | 1 review, 9 actions | [Ready / Not ready] |
| Risk management | Risk register updates, acceptance records | [from to] | 62 risks, 1 accepted by top management (ACC-001) | [Ready / Not ready] |
| Objectives and measurement | Measurement results per objective | [from to] | 3 months of results for 6 metrics | [Ready / Not ready] |
| Corrective action | Nonconformity records | [from to] | 7 opened, 4 closed | [Ready / Not ready] |
| Awareness | Training completion | [from to] | 44 of 46 persons complete | [Ready / Not ready] |
| Access reviews | Review records | [from to] | 1 quarterly review of production access | [Ready / Not ready] |
| Incidents and events | Incident register entries | [from to] | 11 events, 2 incidents | [Ready / Not ready] |
| Supplier reviews | Supplier assessments | [from to] | 9 critical suppliers assessed | [Ready / Not ready] |

The counts are *Example* values for Quillmere Analytics Ltd. The 46
persons match the scope headcount (38 employees and 8 contractors); the 2
persons not yet trained must be trained before Stage 2 or the gap shown
with a dated plan.

## 6. Readiness criteria (go or no-go)

<!-- Guidance: Decide go or no-go two weeks before Stage 1, with top management. A no-go is cheaper than a failed Stage 1 followed by a postponed Stage 2. Record the CB's stated expectations here. -->

| # | Criterion | Evidence | Result |
|---|---|---|---|
| R1 | All 15 items in section 4.1 approved and current | DOC-ISMS-028 extract | [Met / Not met] |
| R2 | Scope, SoA version and risk treatment plan are consistent | Cross-check by [@isms-manager] | [Met / Not met] |
| R3 | Risk assessment complete for the whole scope, with owners and treatment decisions | DOC-ISMS-017 | [Met / Not met] |
| R4 | At least one full internal audit cycle completed (CB practice) | DOC-ISMS-084 | [Met / Not met] |
| R5 | At least one management review completed covering all 9.3.2 inputs (CB practice) | DOC-ISMS-085 | [Met / Not met] |
| R6 | Internal audit findings have corrective action plans with owners and dates | DOC-ISMS-086 | [Met / Not met] |
| R7 | Measurement results exist for each objective | DOC-ISMS-081 | [Met / Not met] |
| R8 | No high or critical risk without an approved treatment or acceptance | DOC-ISMS-016, DOC-ISMS-019 | [Met / Not met] |
| R9 | Key people available on Stage 1 dates | Section 7 | [Met / Not met] |
| R10 | CB expectations confirmed in writing: [record the CB's answer] | CB e-mail of YYYY-MM-DD | [Met / Not met] |

Decision rule *(Example)*: go if R1 to R5 and R8 are met and any other gap
has an owner and a date before Stage 2.

## 7. Logistics

<!-- Guidance: Make the audit easy to run. Questions to answer: who meets the auditor, in which room or video call, how evidence is shown, and who takes notes? Pitfall: a key interviewee on leave, or the auditor waiting while someone searches for a document. -->

| Item | Arrangement |
|---|---|
| Audit plan received from CB | [YYYY-MM-DD] |
| Mode | [On site at (address) / remote via (platform) / mixed] |
| Audit guide (escort) | [@isms-manager] |
| Note taker | [@name] |
| Room or call link | [room name / link sent by secure invitation] |
| Interviewees and time slots | Top management [@ceo] [time]; risk owner [@coo] [time]; IT and cloud [@head-of-engineering-ops] [time]; HR [@hr-lead] [time] |
| Evidence display | Screen share from the document store; no uploads of Restricted records |
| Site visit route | [office areas, secure areas, colocation suite if in scope] |
| Visitor rules | Sign-in, badge, escort, confidentiality agreement if the CB contract does not cover it |
| Opening meeting attendees | [@ceo], [@isms-manager], [@ciso] |
| Closing meeting attendees | Same as opening, plus process owners with findings |
| Fallback if the call fails | [phone number, rescheduling rule from the CB contract] |

## 8. Typical Stage 1 findings and how to close them

<!-- Guidance: These are common areas of concern in first certifications, written from general audit practice. Read each one against your own pack before Stage 1. The CB grades its own findings; areas of concern not resolved by Stage 2 may be raised as nonconformities. -->

| # | Typical area of concern | Why it matters | How to close it before Stage 2 |
|---|---|---|---|
| T1 | Scope statement vague or does not match the sites and services quoted | Scope drives audit time and the certificate wording | Rewrite DOC-ISMS-002 with services, sites, entities and exclusions; tell the CB if headcount or sites changed |
| T2 | Interfaces and dependencies with out-of-scope parties not described | Auditor cannot see where responsibility changes | Add an interfaces table to the scope and link supplier controls |
| T3 | Climate change decision missing in context (Amd 1:2024) | Clauses 4.1 and 4.2 changed in 2024 | Add the decision and rationale to DOC-ISMS-003 |
| T4 | Risk criteria not defined or not applied consistently | Clause 6.1.2 needs repeatable, comparable results | Approve DOC-ISMS-015 and re-score inconsistent risks |
| T5 | SoA justifications generic, or exclusions without a reason | Clause 6.1.3 d | Rewrite rows with risk, legal, contractual or business basis (see `compliance/statement-of-applicability`) |
| T6 | Risk treatment plan without owners, dates or risk owner approval | Clause 6.1.3 | Complete DOC-ISMS-013 and record risk owner approval of residual risk |
| T7 | Objectives not measurable or without plans | Clause 6.2 | Add metric, target, owner, resources and due date per objective |
| T8 | Internal audit did not cover all clauses or all Annex A areas planned | Clause 9.2 | Complete the remaining audit scope before Stage 2 |
| T9 | Management review minutes miss required inputs | Clause 9.3.2 | Hold a supplementary review or add the missing inputs with decisions |
| T10 | Competence evidence missing for key roles | Clause 7.2 | Complete DOC-ISMS-026 and attach certificates or training records |
| T11 | Documents not controlled (no version, owner or approval) | Clause 7.5 | Bring documents under DOC-ISMS-028 control |
| T12 | Measurement results missing or started very recently | Clause 9.1 | Collect results for every metric and report them in DOC-ISMS-081 |

## 9. Stage 1 report and closure tracker

<!-- Guidance: Copy each Stage 1 area of concern from the CB report into this tracker the day you receive it. Use the CB's own reference. Link anything that becomes a formal nonconformity to `isms/certification-findings-action-plan`. Pitfall: closing items with a document edit only, when the auditor will look for evidence that the process now runs. -->

| ID | CB ref | Area of concern | Clause or control | Action | Owner | Due | Evidence of closure | Status |
|---|---|---|---|---|---|---|---|---|
| STG1-001 *(Example)* | AOC-01 | Climate change decision not recorded (logged as AF-2027-005 in DOC-ISMS-086) | 4.1 | Add decision to DOC-ISMS-003, approve at steering committee | [@isms-manager] | 2027-04-30 | DOC-ISMS-003 v1.2, minute of 2027-04-29 | Closed |
| STG1-002 *(Example)* | AOC-02 | Management review did not cover feedback from interested parties | 9.3.2 | Supplementary review item at the steering meeting of 2027-05-04 | [@ceo] | 2027-05-05 | Minutes DOC-ISMS-085 of 2027-05-04 | Closed |
| STG1-003 *(Example)* | AOC-03 | Two persons in scope without awareness training | 7.3 | Complete training, add a check to onboarding | [@hr-lead] | 2027-05-07 | Training records dated 2027-05-03, updated onboarding checklist | Closed |
| [STG1-NNN] | [ref] | [concern] | [clause] | [action] | [@owner] | YYYY-MM-DD | [record] | [status] |

Summary *(Example)*: 3 areas of concern, all 3 closed by 2027-05-07,
before the Stage 2 start date of 2027-05-10.

## 10. Size tiers

<!-- Guidance: The required documents are the same for every size. What changes is the number of sites, people to schedule, and the depth of records. These are the library's working tiers, not official definitions. -->

| Aspect | Small: Quillmere Analytics Ltd *(Example)* | Medium: Quillmere Health Systems *(Example)* | Large: Quillmere Group *(Example)* |
|---|---|---|---|
| Profile | 46 persons, one office plus remote staff, one cloud provider in two regions | 320 staff, two offices, one colocation suite | 2,400 staff, 6 sites in 4 countries, OT and IT, ISO 9001 and ISO 22301 certified |
| Pack owner | Part-time ISMS manager (0.5 FTE, Head of Engineering Operations) | Full-time ISMS manager with a 3-person security team | CISO's 14-person security office with site coordinators |
| Stage 1 mode | Remote, with a short office visit | Mixed: remote document review, visit to one office and the colocation suite | Phase 1 sites only (for example HQ and data centre), on site, under the phased plan in `isms/scope-extension-multisite-plan` |
| Pack size | 15 required items plus about 10 supporting documents | Same plus colocation contract and 27701 readiness notes for next year | Same per phase, plus integrated management system documents shared with ISO 9001 and ISO 22301 |
| Main risk | Too few records because the ISMS started recently | Health-sector legal register incomplete | Different practices per site and country, weak central control |
| Readiness check | ISMS manager and CEO | Steering committee | Group steering committee and site leads, site-by-site go or no-go |

## 11. Records and evidence

<!-- Guidance: Keep the evidence that the pack was complete, approved and sent. These records also help at recertification. -->

| Record | Owner | Location | Retention |
|---|---|---|---|
| Index of documents sent to the CB, with versions and date | [@isms-manager] | [ISMS document store] | Certification cycle + 3 years *(Example)* |
| Go or no-go decision (section 6) | [@ceo] | [Steering committee minutes] | Certification cycle + 3 years |
| CB audit plan and Stage 1 report | [@isms-manager] | [ISMS document store] | Certification cycle + 3 years |
| Closure tracker (section 9) with evidence | [@isms-manager] | [ISMS document store] | Certification cycle + 3 years |
| Attendance at opening and closing meetings | [@isms-manager] | [ISMS document store] | Certification cycle + 3 years |

Register these in DOC-ISMS-028 and link the evidence locations in
`isms/control-evidence-matrix`.

## 12. References

<!-- Guidance: Cite editions exactly and read the CB's audit plan, which is the binding description of your Stage 1. -->

| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022 (https://www.iso.org/standard/82875.html) | 2022 | Clauses 4 to 10 and Annex A |
| ISO/IEC 27001:2022/Amd 1:2024 (https://www.iso.org/standard/88435.html) | 2024-02-23 | Climate change in 4.1 and 4.2 |
| ISO/IEC 17021-1:2015 (https://www.iso.org/standard/61651.html) | 2015 | Two-stage initial certification audit |
| ISO/IEC 27006-1:2024 (https://www.iso.org/standard/82908.html) | 2024 | ISMS-specific audit requirements |
| ISO/IEC 27007:2020 (https://www.iso.org/standard/77802.html) | 2020, under revision | ISMS auditing guidance |
| IAF MD 4:2025, ICT for conformity assessment, re-issued as Global ACI-TECH-3-003 | Issue 3, application 30 Jan 2026; Global ACI v1.0 in force 28 Aug 2026 (check the current issue) | Remote Stage 1 |

Related templates: `isms/certification-body-selection`,
`isms/stage-2-audit-evidence-index`, `isms/certification-findings-action-plan`,
`isms/isms-documented-information-register`, `isms/control-evidence-matrix`,
`compliance/ms-scope`, `compliance/statement-of-applicability`,
`compliance/internal-audit-program`, `compliance/management-review`,
`isms/certification-audit-explained`.

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (clauses 4 to 10
and the documented information they require) and with the Stage 1
requirements for certification bodies in ISO/IEC 17021-1:2015 and ISO/IEC
27006-1:2024. The checklists, readiness criteria, typical findings and
examples are original; no ISO/IEC text is reproduced, and the required
items are paraphrased by clause number. ISO and IEC standards are
copyrighted: obtain the official text from ISO
(https://www.iso.org/standard/82875.html) or your national standards body.
Check the current editions and your certification body's audit plan and
rules before use. Completing this pack does not guarantee certification;
the certification decision belongs to the certification body. Template
licence: MIT.