Run your ISMS with one shared handbook.

ISO/IEC 27001 · 6.1.2

ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

The procedure connects maintained assessment and acceptance criteria, comparable repeated assessments and CIA risks within scope with owners, reasoned consequences and likelihoods, risk levels and prioritisation. The user must decide suitable criteria and actually carry out and retain assessments.

ISO/IEC 27001 · 6.1.3

ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

Treatment is connected with necessary safeguards, a complete Annex A comparison, SoA justifications and actual implementation status, the treatment plan and explicit risk-owner consent to the plan and residual risk. Specific decisions and actual treatment remain operational work.

ISO/IEC 27001 · 6.2

ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

Objective planning considers the policy, applicable requirements and risk assessment and treatment. The procedure identifies measurability where practicable, communication, monitoring and updates, as well as work, resources, ownership, completion and result evaluation. Objectives must be defined for the organisation and followed up.

ISO/IEC 27001 · 9.1

ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

The procedure defines the subject, suitable method and source, and responsibilities and timing for collection and evaluation. Actual results are retained and assessed for security performance and ISMS effectiveness. A register or software dashboard alone does not evidence this evaluation.

ISO/IEC 27001 · 9.2.1

ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

The individual plan identifies the organisation's own ISMS requirements and ISO requirements. The report connects the actual scope, objective evidence and conclusion on conformity, effective implementation and maintenance. Competent auditors must actually conduct the audit; a prepared or completed file alone does not demonstrate this.

ISO/IEC 27001 · 9.2.2

ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

Programme fields prepare frequency, methods, responsibilities, planning and reporting and take account of process importance and earlier results. Individual plans record criteria, scope and the selection of objective impartial auditors. The report and programme status can evidence execution and reporting. The user must implement the plan, ensure impartiality, actually inform relevant management and retain the result records.

ISO/IEC 27001 · 9.3.1

ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

The record identifies the review date, period considered and top management actually participating. It prepares a reasoned conclusion on continuing suitability, adequacy and effectiveness. Suitable planned intervals and the actual review by management must be ensured organisationally.

ISO/IEC 27001 · 9.3.2

ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

Seven input groups connect authoritative information with its evaluation. Performance trends explicitly include nonconformities and corrective actions, monitoring and measurement, audit results and objective achievement. The user must obtain all actually relevant inputs, evaluate their development and retain a retrievable record of the state considered. A list of links alone is insufficient.

ISO/IEC 27001 · 9.3.3

ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

The result fields record management decisions on improvement opportunities and necessary ISMS changes and the references to agreed work. The conclusion makes the result and participating management traceable. Actual decisions, appropriate document control and implementation of follow-up work remain with the user.