ISMS Implementation, Step by Step

What you'll be able to do

• ›Define context, interested-party requirements, and a defensible ISMS scope
• ›Connect risk criteria, assessment, treatment, and justified SoA decisions
• ›Set measurable objectives and maintain controlled information and operating evidence
• ›Classify audit findings and verify corrective-action effectiveness
• ›Evaluate management review and certification readiness without promising certification

Context before paperwork

A bakery protects recipes differently from a delivery company protecting customer addresses. Start with what the business needs. Northstar Parcel Cloud is a fictional 45-person company operating a hosted parcel-routing service from Bristol. Its customers upload delivery addresses and driver schedules. The chief executive officer (CEO) sponsors a 90-day information security management system (ISMS) implementation for that service, not an instant promise of certification. You will build linked decisions and evidence rather than a folder of copied templates.

Begin with internal issues such as rapid hiring, shared administrator accounts, and limited recovery staff. External issues include customer assurance demands, supplier outages, and changing privacy obligations. Record interested parties, their relevant requirements, and who checks changes. customers require contractually agreed recovery, employees need clear reporting routes, regulators require applicable privacy duties, and the cloud provider imposes shared-responsibility terms. Determine whether climate change is a relevant context issue and whether interested parties have related requirements. Document the decision rather than assuming either answer.

Create a context and requirements register with source, owner, review date, and relevance. Review it quarterly and after material changes. This register informs scope, risk criteria, controls, objectives, and management review. It is not a claim that every stakeholder preference is a legal obligation.

Draw a defensible scope

A house insurance policy must say which buildings it covers. A security program also needs clear boundaries. The scope covers design, development, operation, and support of the hosted parcel-routing service. It includes Bristol staff, remote workers, production cloud resources, source repositories, and customer-support systems. Document organizational, physical, and technical boundaries and the interfaces between them. The CEO approves the written scope before implementation starts.

Cloud hosting remains a managed dependency even though the provider operates the building and hardware. Supplier assurance, contracts, identity configuration, and incident interfaces remain Northstar responsibilities. Payroll is outside the service boundary and has no service-data interface in this exercise. Record that rationale, not a blanket exclusion of all corporate processes.

A scope that excludes the production cloud while claiming to cover the hosted service hides the service principal risk. Distinguish the management-system scope from a penetration-test target list or a certification-body sampling plan. Check the actual boundary against contracts and data flows.

Leadership, policy, and measurable direction

A team captain agrees the plan and makes sure people have time to follow it. Leaders must support security work in the same way. The CEO is accountable for ISMS effectiveness and provides a named coordinator, engineering capacity, and an audit budget. The operations director owns service availability risk. Management must integrate security into business processes rather than assigning all accountability to a consultant.

The CEO approves an ISMS policy appropriate to the service, committing to applicable requirements and continual improvement and providing a framework for objectives. Publish the controlled policy to staff and make it available to relevant interested parties as appropriate. Assign decision authority for residual risk acceptance and control operation separately.

Northstar sets an objective of 100 percent of privileged accounts reviewed monthly by the engineering lead. Measure this as reviewed accounts divided by the complete privileged-account population. Another objective is recovery within the contractual four hours, tested quarterly by operations. Each objective needs an owner, resources, due date, evaluation method, and response to missed targets. Training attendance alone does not establish control effectiveness.

Define the method, then assess risk

Two people rating the same damaged roof need the same rating rules. Agree the method before judging the problem. Before scoring, approve consistent risk criteria. For this exercise likelihood and impact each run from 1 to 5, with written anchors. likelihood 1 means unlikely within a year and 5 means expected repeatedly. Impact 1 means negligible service disruption and 5 means prolonged contractual failure or severe data harm. Intermediate levels must also be defined in the working method. Score equals likelihood times impact. Scores 10 or above require treatment. Lower residual scores require operations director approval, not automatic acceptance.

Record each risk as a cause and event affecting an objective, with an owner, existing controls, likelihood, impact, and evidence. R-01 concerns stolen administrator credentials causing unauthorized routing changes. Shared logins and absent multifactor authentication (MFA) support likelihood 4 and impact 4, yielding 16. A cloud outage is a different scenario with different controls and must not be collapsed into the same row.

Use interviews, incident records, service dependencies, and contract requirements to substantiate scores. Reassess after significant changes and at planned intervals. A multiplication result supports prioritization but is not a precise financial forecast, and low scores do not cancel mandatory legal or contractual requirements.

Choose treatment and build the SoA

You might repair a broken lock or stop using the door. Choose a response that addresses the problem. For R-01, Northstar chooses modification through named administrator accounts and MFA. Engineering lead owns delivery by 2027-03-31, with enrollment export and blocked shared-login evidence. Expected residual likelihood 2 and impact 4 give score 8. The operations director must approve both the treatment plan and acceptance of the residual risk. Do not treat a forecast score as proven operating performance. Avoidance, sharing, and informed retention can also be valid treatment choices.

The risk treatment plan links risk identifier (ID), chosen option, necessary controls, action owner, resources, deadline, success evidence, residual assessment, and approval. The Statement of Applicability records necessary controls, justification for inclusion, implementation status, and justification for exclusions from Annex A. Compare your necessary controls with all Annex A controls so none are unintentionally omitted. Additional controls may also be necessary.

In this lab extract A.5.15 Access control and A.8.5 Secure authentication are included but planned. A.8.30 Outsourced development is excluded because all development is performed by employees with no contracted development. A.7.6 Working in secure areas is excluded because no secure areas exist within the assessed scope, subject to annual revalidation. Hosting is not outsourced development. These are exercise-specific determinations, not universal exclusion advice. Other supplier and physical controls still need assessment. This four-row extract is not a complete certification SoA.

Control documented information and build competence

A cook needs the current recipe and the skills to follow it. Security work also needs reliable instructions and capable people. Keep scope, policy, method, risk results, treatment plan, SoA, objectives, and required operating records identifiable and controlled. Each document needs an owner, version, approval, access rules, review date, retention, and disposal arrangements suited to its purpose. Protect confidential audit and risk records while making approved instructions available where work occurs. Prevent obsolete copies from silently directing operations.

Competence requires determining skills for assigned work, addressing gaps, and retaining evidence of competence. Awareness ensures people understand policy, their contribution, and the consequences of not following requirements. Northstar trains staff to report suspicious messages and tests the reporting route using a safe exercise. A signed attendance sheet does not prove someone can restore production or conduct an audit.

Use a change log linking policy version 1.1 to an approved MFA requirement, staff communication, and effective date. Keep original audit evidence and tracked corrections rather than overwriting unfavorable records. Externally supplied documents such as customer security terms also need identification and change control.

Operate controls and retain evidence

A cleaning schedule does not prove a room was cleaned. Keep records of the work actually done. Implement named accounts and MFA, review privileged access monthly, test restoration quarterly, and rehearse supplier incident escalation. Engineering operates identity controls while operations owns recovery. Maintain procedures detailed enough for competent staff, and retain dated evidence showing the population, action, reviewer, exceptions, and resolution.

Validate whether deployed controls work. test a blocked login without MFA, reconcile account exports with human resources (HR) departures, and restore a representative service in the required time. A screenshot of an enabled setting proves configuration at a moment. It does not prove that every privileged identity is covered or that the control operated throughout the period.

Plan and control changes and outsourced processes. A new cloud region triggers a data-flow, obligations, scope, and risk review before release. Failed restore tests create tracked actions and may require risk reassessment. Collect evidence during operation rather than manufacturing a clean history before an audit.

Audit independently against criteria

A person should not be the only judge of their own work. A separate reviewer can challenge the evidence. Plan an internal audit programme considering process importance, changes, and previous audit results. Define each audit scope and criteria, choose competent auditors with objectivity and impartiality, communicate results, and retain evidence. A developer should not independently audit their own access-control work. Use a qualified colleague from another process or an external auditor.

A finding links a specific requirement, objective evidence, and a clear statement of nonfulfilment. Northstar uses a major classification for absence or systemic breakdown of a required process. Minor means an isolated failure within an otherwise effective process. Observation means an improvement opportunity with no demonstrated unmet requirement. These are this exercise classification rules. Certification bodies apply their own procedures and context.

A-01 has no internal audit programme or completed audits at all: major. A-02 has one late access review out of twelve with eleven compliant reviews and no wider breakdown: minor. A-03 proposes clearer chart colours where no accessibility or reporting requirement is breached: observation. An observation must not disguise an actual nonconformity.

Management review and corrective action

A recurring leak needs more than another bucket. Leaders must review results and address the cause. Top management reviews the ISMS at planned intervals. Inputs include previous actions, context and interested-party changes, performance and objective trends, nonconformities and corrective actions. They also include monitoring, audits, stakeholder feedback, risk results and treatment status, and improvement opportunities. Review decisions address improvement opportunities and needed ISMS changes, including resources, with retained results.

For the missing audit programme, first correct the immediate failure by scheduling independent audits. Then investigate why the process was absent: the launch plan assigned no audit owner or funded capacity. Corrective action assigns ownership, adds a release planning gate, and reserves audit capacity. Check for similar failures in other processes and update risks or the ISMS as needed.

Closure requires effectiveness evidence, such as the next audit cycle occurring independently and on time, not just an uploaded procedure. Record the nonconformity, actions taken, and results. Management review should challenge overdue actions and allocate resources rather than merely acknowledge a slide deck.

Check certification readiness without guarantees

Preparing for a driving test does not guarantee a pass. Readiness evidence supports a decision, not a promise. Northstar prepares a readiness index linking scope, context, policy, risk method and assessment, approved treatment plan, and complete SoA. It also links objectives, competence records, operating evidence, internal audit, management review, and corrective-action evidence. Check consistency across records: planned controls cannot simultaneously be described as operating effectively without evidence.

An accredited certification body independently assesses conformity. Stage 1 normally reviews documented readiness and preparedness for Stage 2; Stage 2 examines implementation and effectiveness. Certification applies to the stated scope and is followed by surveillance and recertification. It does not guarantee that incidents cannot happen or that every product is secure.

Run the four build labs, then challenge the eight scenarios. The room awards 400 scenario experience points (XP) as eight tasks of 50. Following the governance room convention, lab points are separate from the room task total. Four labs each carry 40 points. Passing a structured lab checks the exercise fields only. It is not a certification decision or a substitute for a complete International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 27001 assessment.