How to implement ISO/IEC 27001:2022: the seven ISMS documents to build first, in order

Most ISO/IEC 27001 projects start in the wrong place. Someone opens the list of 93 controls, turns it into a spreadsheet and begins ticking. Six months later there are a hundred half-finished documents, no agreed scope, and no record that connects any control to a risk the organisation actually faces.

The standard asks for a management system first and controls second. The two awareness articles this month looked at one of those controls up close. This one steps back to the system around it: seven documents, built in order, each one feeding the next.

1. Context and scope

Start with a short document that answers four questions. What internal and external issues affect information security here, including climate change, which the 2024 amendment added to the issues every organisation considers? Who are the interested parties, and which of their expectations does the ISMS take on? What is in scope, and what is deliberately out? Where does the scope touch things it does not control, such as a cloud provider or a group IT function?

Two or three pages are enough; the scope statement is the sentence everything else is tested against, so write it first and date it.

2. Policy, roles and objectives

The information security policy is a page or two of leadership commitment: what the organisation intends, who is accountable, and the promise to improve. Beneath it sits a register of topic-specific policies (access, acceptable use, suppliers and so on) with an owner and a review date for each. Then the objectives: three to six measurable statements, each with a resource, an owner, a due date and a way of evaluating it. Objectives that cannot be measured are intentions, and auditors can tell the difference.

3. The risk method

Before a single risk is recorded, write down how risks will be assessed and treated: the likelihood and impact scales, how they combine into a rating, the threshold above which a risk must be treated, who may accept a residual risk and at what level. If the organisation already runs a service management system or a continuity programme, use the same scales there. One method across the business is easier to run and easier to defend.

4. The risk register and treatment plan

Now record the risks. For each: the asset or process at stake, the threat, the existing controls, the inherent rating, the treatment chosen, the controls that treat it, the residual rating and who accepted it. The treatment plan turns the "treat" decisions into actions with owners and dates.

A first register of fifteen to twenty-five risks that are real and owned beats one of two hundred that are copied from a catalogue.

5. The Statement of Applicability

This is the document people usually start with, and it belongs fifth. The Statement of Applicability lists every control in Annex A by number and, for each, whether it applies, why, whether it is implemented, and which risks it treats. Exclusions need a reason that survives a conversation, not a blank cell.

Written at step five, the statement is a consequence of steps one to four: controls apply because risks and obligations require them. Written at step one, it is a wish list.

6. Documented information and the evidence register

The standard requires certain documents and records, and your own ISMS will add more. List them: what each is, who owns it, where it lives, how often it is reviewed. Alongside that, keep an evidence register by control: for each applicable control, what evidence shows it is operating, where it is, and when it was last checked. This is the file the auditor reads most. If a control says "implemented" in the statement and the evidence register has nothing beside it, you have found your first finding before the auditor does.

7. Internal audit and management review

Finish the first cycle with an internal audit programme (which clauses and controls are audited when, by whom, with what independence), a short audit report format, a corrective action record, and a management review that takes in the audit results, the objectives, the risk status and the incidents, and records decisions. The system is not complete until it has been reviewed once by the people who own it.

The thread that holds it together

The seven documents are connected by one thread: a risk in the register names a control; that control is marked applicable in the statement; the evidence register shows the control working; the audit samples it; the review decides what to change. Break the thread anywhere and the ISMS becomes a collection of files.

Pick one high-rated risk from the register and follow it through all seven documents. If you reach the management review minutes with the same risk still visible, the system works. If you lose it at the statement or the evidence register, that is where the work is.

Where awareness fits

The awareness programme covered in the last two articles is one of those controls. It appears in the statement as applicable for almost every organisation, it treats people-related risks in the register, and its evidence sits in the evidence register beside the other controls. The free Cybersecurity Awareness Programme Kit covers that one control in depth; the documents in this article are the system it reports into.

One system, a second framework

Many organisations are also asked about NIST Cybersecurity Framework 2.0 by a customer, a board or a sector regulator. Do not build a second system. Add a crosswalk that maps the ISMS clauses and the Annex A controls to the six CSF functions and their categories, and keep it with the statement, labelled as your own mapping.

A note on using AI

AI assistants are useful here for first drafts of the policy register and for suggesting evidence types for a control. They must not set a risk rating, decide whether a control applies, or record that evidence exists. Those are decisions a named person makes and signs. Label every AI draft as a draft, keep a log of what the assistant was used for, and never paste real incident details or personal data into a public tool.

The free kit

Each of the seven documents above has a matching file in the ISMS Starter Kit for ISO/IEC 27001:2022: context and scope, policy and objectives, the risk method, a risk register and treatment plan with a built-in check, a Statement of Applicability with all 93 controls described in our own words, a documented information and evidence register, an internal audit and management review pack, a NIST CSF 2.0 crosswalk, an AI prompt pack and an AI-use log, with a worked example in every template. It is free, with no sign-up: ISMS Starter Kit for ISO/IEC 27001:2022. The BCMS Starter Kit for ISO 22301 is also free on brivellis.com.