Template:IMS Document control ISO 27001 chapter Related documentation 4.1 Understanding the organization and its context ISMS Scope Statement 4.2 Understanding the needs and expectations of interested parties ISMS Scope Statement 4.3 Determining the scope of the information security management system ISMS Scope Statement 4.4 Information security management system 27001 Control Matrix Annex A Control Matrix Policies Procedures Guidelines References Checklists Evidence of measures for Annex A Controls (see example control) 5.1 Leadership and commitment ISMS roles approved by ISMS Sponsor Information Security Policy approved by ISMS Sponsor Commitment to ISMS changes and resource needs (Management review) Active participation of Top Management (as Role Owners, Document Owners, Risk Owners). See ownership info in Role definitions, e.g Head of IT 5.2 Policy Information Security Policy 5.3 Organizational roles, responsibilities and authorities Roles & Responsibilities Organization Chart RACI Chart 6.1 Actions to address risks and opportunities Risk Assessment Methodology Risk Assessment / Risk Register Risk Treatment Plan 6.2 Information security objectives and planning to achieve them KPI tracking 6.3 Planning of changes ISMS Significant Change Events Version and approval history of documents Approval workflow for role assignments (Role owner - > deputy -> ISMS Sponsor) Ticket system ISMS Check Ticket system ISMS Change Mangement project with ISMS Change task template 7.1 Resources Roles & Responsibilities Licenses for services that support the ISMS 7.2 Competence Competencies listed in role definitions Security training evidence Onboarding checklist Read confirmations, e.g.Remote Work Policy read confirmation 7.3 Awareness Security awareness training evidence Read confirmations, e.g. Information Security Policy read confirmation Joiner-Mover-Leaver Procedure 7.4 Communication Communication plan 7.5 Documented information Document control template List of core documents 8.1 Operational planning and control Operational procedures 8.2 Information security risk assessment Risk Assessment / Risk Register 8.3 Information security risk treatment Risk Treatment Plan Statement of Applicability 9.1 Monitoring, measurement, analysis and evaluation KPIs KPI Dashboard 9.2 Internal audit Internal Audit report ISMS Schedule 9.3 Management review Management Review minutes 10.1 Continual improvement Internal Audit report Management Review minutes ISMS Schedule Ticket system ISMS Check Ticket system ISMS Change Mangement project with ISMS Change task template 10.2 Nonconformity and corrective action CAPA Register
