Bộ mẫu bằng chứng và vận hành ISMS

Evidence register for clauses 4 to 10 and all 93 Annex A controls: owner, record, location, frequency, last collected, status, Stage 2 and surveillance use

12-month ISMS calendar: fixed dates, 30 recurring activities with owners and evidence, month view, Gantt chart, size tiers, rescheduling rules

Master list of ISMS documents and records: mandatory items flagged, owner, version, classification, location, retention, external documents, disposal

Criteria for which activities need a procedure, procedure register, model SOP layout, writing rules, lifecycle, worked SOPs for access provisioning and backup verification

Security event reporting: what to report, channels, timing, no-blame rule, triage and hand-off to incident response, reporter feedback, metrics, channel tests

Planned ISMS changes: classification, lifecycle, change record, integrity checklist by clause, typical changes, CB notification, register, review

Event and incident register: field rules, category and regime codes, register rows, GDPR, NIS2 and DORA notification tracking, status lifecycle, period summary

Blameless security incident review: summary, ground rules, timeline, impact, response metrics, 5 whys, fishbone, actions, control changes, risk register update

Supplier inventory: criticality tiers, data and access, services, contract dates, security terms, certifications, last assessment, review cadence, metrics

Restore test plan and log: measurement rules, planned tests per tier, executed restores, RPO and RTO achieved versus target, issues and retests

Remediation service levels from CVSS v4.0, EPSS and CISA KEV, tracker fields, finding register, lifecycle, exceptions, on-time metrics

Key and certificate inventory: field definitions, lifecycle states, register rows, expiry alerts, algorithm checks, post-quantum exposure, change log

Contacts register for A.5.5 and A.5.6: contact rules, authorities, CSIRTs, law enforcement, ISACs, vendor PSIRTs, restricted annex, verification log

Sanitisation method by classification and destination, techniques by media type, verification and validation, chain of custody, certificates, disposal log