Bộ mẫu ISMS doanh nghiệp đa địa điểm

Governing body vs management roles, evaluate/direct/monitor/communicate processes, governance calendar, board KPIs and KRIs, board report format, escalation, NIS2/DORA duties

Committee purpose, membership, quorum, cadence, decision rights, inputs, standing agenda, minutes and action log, link to management review 9.3

ISMS role definitions, authorities and decision rights, RACI for clauses 4 to 10 and Annex A, audit independence, deputies, combined-role guardrails

Cost lines (effort, consultant, tooling, training, pentest, certification fees, remediation), 3-year budgets per tier, FTE by role, funding tranches

Intended outcomes, PESTLE and threat landscape issues, internal issues, climate change determination (Amd 1:2024), interested parties, requirements adopted, interfaces, triggers

21 ISMS processes in governance, risk, operational and support groups, owners, inputs and outputs, interactions, SIPOC, clause mapping, KPIs, maturity

Management system scope (cl. 4.3): 4.1 issues incl. climate and AI role, 4.2 parties, scope sentence (QMS and ISO 42001 examples), interfaces, exclusions

Scope change classification, ISMS impact by clause, multi-site eligibility, site register and sampling groups, site readiness checklist, CB notification log, timeline

Risk criteria and score-only bands, acceptance authority, criteria for assessments, event or asset-based steps, calibration, treatment, outputs, size tiers, AI variant

Appetite and tolerance per category, criteria for performing assessments, 5x5 scales (C, I, A, financial, legal, reputation, OT safety), bands, approvals

One cycle: scope, method refs, participants, results by band, current and residual heat maps, top risks, changes since last cycle, treatment hand-off

All 93 Annex A controls with basis, justification, status, reference document (DOC-ISMS IDs) and evidence, exclusions, additional controls, size tiers, records

IMS scope and integration level, clause mapping 27001/20000-1/9001/22301, 27013 service management integration points, common processes, document consolidation, integrated audits

Evidence register for clauses 4 to 10 and all 93 Annex A controls: owner, record, location, frequency, last collected, status, Stage 2 and surveillance use

Periodic ISMS report to management: KPI table with trend, objectives, risk by band, incidents, audits, actions, decisions, one-page dashboard

Crisis team and deputies, activation criteria, decision log and battle rhythm, stakeholder communication matrix, notification clocks, holding statements, ransomware scenario, exercises

CB selection for ISO/IEC 27001: accreditation check, impartiality, audit time, multi-site, remote audit, 3-year cost, transfer, RFQ, scoring, decision

3-year certificate cycle, timing rules, Gantt timeline, audit coverage, change notifications, suspension and withdrawal, recertification, transfers, budget

Pre-surveillance self-check: changes since last audit, previous findings, required records, internal audit, management review, KPIs, controls, scope and claims