Skip to main content
All measures

Measure · ISO 27001 and other standards

Organise day-to-day ISMS operations

Connect security workflows to the business. Set handovers, resources and communication, then check whether the agreed workflow works.

Accountable: Top management and the ISMS lead with process ownersReviewed

Reuse existing records

Reuse the ISMS framework, policy and handbook chapters 2, 5 and 6. Existing process descriptions, meetings and tasks are sufficient when they keep the workflow traceable.

What to do

  1. 1

    Connect processes and handovers

    Start with existing business and security workflows. For example, clarify how a new customer requirement feeds into risk assessment, treatment, working rules and review. At each handover, identify the required result and version and who will use it next. Keep these handovers in the existing process or handbook section.

  2. 2

    Set resources and communication within the workflow

    Apply the authoritative allocation of roles and agree with top management on the time, competence, tools and other resources needed. Address competence gaps through existing training and development planning. Establish what is communicated internally or externally, when, by whom, to whom and through which channel. Keep these details in the existing process or meeting record rather than creating a second communication plan.

  3. 3

    Control operations and changes

    Set suitable criteria for the required processes and operate them accordingly. Retain the information needed to show that the planned workflow took place. Include relevant externally provided processes, products and services in operational control. Plan necessary ISMS changes with their purpose, consequences, responsibilities and resources. Review unintended changes and mitigate adverse effects.

  4. 4

    Follow through on obstacles and improvements

    Use actual work to check whether results and handovers meet the need. Draw on risk assessments, measurements, incidents, audits and management reviews. Decide improvements to suitability, adequacy and effectiveness, assign the work and check its result. A nonconformity follows the existing corrective-action workflow. The next management review brings the development together.

Worked example

A new customer service needs reliable handovers

Fictitious example. A small IT company adds a new service to its ISMS. The people involved use the existing service record and handbook.

Handover before launch
DecisionSales passes on the agreed security requirements. The service owner arranges assessment of risks and necessary safeguards. The operations lead provides the time and competence needed.
EvidenceLinked requirement, risk assessment and approved work in the service record.
Operation and improvement
DecisionThe team records the actual launch and its check of handovers. A missing point of contact is added to the authoritative role section and communicated to the people involved.
EvidenceCheck result, assigned improvement and updated reference.

Record the result

  • Authoritative description of required processes, their handovers and criteria.
  • Traceable resource decisions and the relevant internal and external communication arrangements.
  • Actual operational and change results and improvements followed through in existing records.

Common implementation mistakes

Build a second administration system

Use existing workflows and document sections. A process diagram, communication plan or separate register is not an end in itself.

Only announce a change

Clarify consequences and resources before implementation. Then check the achieved state and address unintended effects.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards

  • ISO/IEC 27001 · 4.4

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    The workflow connects the necessary ISMS processes and their interactions to actual operation and improvement. The organisation establishes and operates processes suited to its requirements.

    Reference

  • ISO/IEC 27001 · 6.3

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    ISMS changes are planned before implementation with purpose, consequences, responsibilities and resources. Specific change planning and implementation remain operational work.

    Reference

  • ISO/IEC 27001 · 7.1

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    The people involved determine with top management the resources needed to establish, operate, maintain and improve the ISMS and address obstacles. Suitable resources must actually be available.

    Reference

  • ISO/IEC 27001 · 7.4

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    The existing workflow identifies the subject, timing, recipients, responsible person and channel for relevant internal and external communication. Actual communication needs and execution must be defined for the organisation.

    Reference

  • ISO/IEC 27001 · 8.1

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    Process criteria, controlled execution, suitable retained information, planned and unintended changes and relevant external provision are connected within existing operations. The user must actually operate and control the processes.

    Reference

  • ISO/IEC 27001 · 10.1

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    The workflow uses actual results to continually improve suitability, adequacy and effectiveness and recheck the achieved state. A prepared instruction alone does not demonstrate improvement.

    Reference

Templates for your implementation

Related resources

Sources and further reading