The organization shall establish, implement, maintain and continually improve an information security management system, in accordance with the requirements of this document.
Plain-language meaning
- Establish → Define the ISMS: set its scope, policies, objectives, and resources.
- Implement → Put it into action: deploy controls, train staff, manage risks.
- Maintain → Keep it running: monitor, review, update procedures.
- Continually improve → Use audits, metrics, and feedback to make it better over time.
Essentially, Clause 4.4 is the big-picture requirement that ties together all other clauses — it’s the “you must actually have an ISMS” statement, not just a plan for one.
Clause 4.4 – ISMS Audit Evidence Checklist
| Requirement | What it Means in Practice | Examples of Audit Evidence |
| Established | You have created an ISMS framework aligned with ISO 27001. | - Approved ISMS policy
- Documented ISMS scope (Clause 4.3) - Risk assessment methodology - Statement of Applicability (SoA) |
| Implemented | The ISMS is operational, not just documented. | - Risk assessments and risk treatment plans executed
- Training records for employees - Implemented controls (e.g., access control lists, incident response procedures) - Supplier security agreements |
| Maintained | You keep the ISMS running and up to date. | - Evidence of control monitoring logs
- Security incident reports and resolutions - Access review records - Patch management logs |
| Continually Improved | You use monitoring, audits, and feedback to make the ISMS better. | - Internal audit reports (Clause 9.2)
- Management review minutes (Clause 9.3) - Corrective actions from nonconformities (Clause 10.2) - Updated policies after lessons learned from incidents |
