ISMS Implementation Roadmap Template (ISO/IEC 27001)

ISMS Implementation Roadmap: [Organization name]

Implementation roadmap for building an information security management system (ISMS) and reaching the certification audit under ISO/IEC 27001:2022 including Amendment 1:2024. It sets out eleven phases (0 to 10, from the decision to the Stage 2 audit) followed by the certification cycle, with entry and exit criteria, deliverables by template, durations for small, medium and large organisations, Gantt charts, the critical path and the most common causes of delay. It supports clause 6.2 (turning each objective into a plan with actions, budget, an owner, a date and a way to check success) and clause 8.1 (operational planning and control). Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. How to read this roadmap
2. Phases, entry and exit criteria
3. Durations by tier
4. Deliverables by phase
5. Gantt charts by tier
6. Critical path
7. Common delays and how to avoid them
8. After Stage 2: the certification cycle
9. Size tiers
10. Records and evidence
11. References

1. How to read this roadmap

The roadmap follows the order of ISO/IEC 27001:2022 clauses 4 to 10 and the two-stage initial certification audit described in ISO/IEC 17021-1:2015. Phases may overlap, but each has a gate: the next dependent phase does not close before the previous gate is passed.

Conventions:

• Clause references use the clause number and a short description in this template's own words.
• Durations are Example values in weeks. Audit dates and audit time are set by your certification body, which applies ISO/IEC 27006-1:2024.
• "Records" means documented information that shows an activity took place (clause 7.5), for example a signed access review or a backup restore test log.

2. Phases, entry and exit criteria

Phase 0: Decide

Phase 1: Context and scope

Phase 2: Leadership and policy

Phase 3: Risk and SoA

Phase 4: Support

Phase 5: Annex A implementation

Phase 6: Operate and collect records

Phase 7: Internal audit

Phase 8: Management review

Phase 9: Stage 1 audit

Phase 10: Stage 2 audit

3. Durations by tier

Phases overlap, so the elapsed time is shorter than the sum of the rows. Typical ranges used in this library (Example): small 4 to 6 months, medium 6 to 12 months, large 12 to 18 months or more. The audit days inside phases 9 and 10 are set by the certification body; the weeks shown include preparation and scheduling around the audit.

4. Deliverables by phase

Phase 5 lists the deliverables most organisations need; the full set depends on your SoA. Annex A has 93 controls in four themes: A.5 organizational (37), A.6 people (8), A.7 physical (14) and A.8 technological (34). Topic-specific policies for the other selected controls are listed in the policy framework (DOC-ISMS-005).

5. Gantt charts by tier

5.1 Small: Quillmere Analytics Ltd (about 6 months)

Part-time ISMS manager (0.5 FTE, the Head of Engineering Operations), whole company in scope, single cloud provider. Internal audit IA-2027-01 runs from 2027-03-15 to 2027-03-17 (report 2027-03-29), the management review is held on 2027-04-06, Stage 1 on 2027-04-12 and 2027-04-13 (1.5 audit days) and Stage 2 from 2027-05-10 to 2027-05-12 (3.5 audit days). Findings response and the certification body's decision (2027-06-15 in the Example) fall inside the six-month target.

5.2 Medium: Quillmere Health Systems (about 10 months)

Full-time ISMS manager and a 3-person security team; two offices and a colocation suite. Stage 2 runs in the two weeks starting 2027-10-18, matching the milestones in the project charter (DOC-ISMS-009).

5.3 Large or multi-site: Quillmere Group (about 15 months)

CISO with a 14-person security office; 6 sites in 4 countries; existing ISO 9001 and ISO 22301 systems. Annex A implementation runs in two waves: wave 1 covers HQ, the data centre and the service centre; wave 2 covers the 3 plants, including OT. Stage 2 completes in the three weeks starting 2028-03-20. Wave 2 ends on 2027-12-06, which leaves the plants about 15 weeks of records before Stage 2: start each plant's recurring controls as soon as they go live rather than at the end of the wave. Site sampling for a multi-site certificate is decided by the certification body under ISO/IEC 27006-1:2024 and IAF MD 1:2023 (now re-issued by Global ACI as Global ACI-TECH-3-001; check the current issue), so plan every site to be audit-ready.

6. Critical path

The critical path for most organisations is:

1. Decision and sponsor (phase 0): no budget, no people.
2. Scope approved (phase 1): the risk assessment cannot start on an unstable boundary.
3. Risk assessment, SoA and treatment plan approved (phase 3): the controls to implement follow from them.
4. Priority controls implemented (phase 5): especially those that generate recurring records (identity and access, logging and monitoring, backup, vulnerability management, supplier reviews).
5. Records period (phase 6): enough time for recurring controls to run at least once and for measurement results to exist.
6. Internal audit, then management review (phases 7 and 8): the management review needs the audit results as an input.
7. Stage 1, closing its issues, then Stage 2 (phases 9 and 10): the gap between Stage 1 and Stage 2 is agreed with the certification body and must leave time to close Stage 1 issues.

Items with float (Example): support activities in phase 4 (as long as awareness training completes before the internal audit), document formatting, the policy framework index, and lower-priority treatment actions scheduled after Stage 2 with risk owner approval.

7. Common delays and how to avoid them

8. After Stage 2: the certification cycle

After a positive certification decision by the certification body, the certificate cycle is three years:

• surveillance audits at least once each calendar year, except in recertification years, with the first surveillance audit no later than 12 months from the certification decision date;
• a recertification audit planned and completed before the certificate expires;
• internal audits, management reviews and recurring controls continue on the annual calendar.

9. Size tiers

10. Records and evidence

List the roadmap in the documented information register (isms/isms-documented-information-register) and link each deliverable's records in the control evidence matrix (isms/control-evidence-matrix).

11. References

Related templates: isms/isms-project-charter, isms/isms-business-case, isms/isms-budget-resource-plan, isms/certification-cycle-plan, isms/isms-annual-calendar, isms/isms-worked-walkthrough.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 including Amd 1:2024 (clauses 4 to 10, Annex A) and the certification process in ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024. The phases, durations, charts and examples are original; no ISO/IEC text is reproduced. You need the official standards for the requirements themselves: https://www.iso.org/standard/82875.html. Check the current edition of every standard and accreditation mandatory document before use. Durations and dates are Example values, and certification decisions belong to the accredited certification body. Template licence: MIT.