ISO/IEC 27001 implementation plan: the phases, the owners, the deliverables and the decision points

How to run ISO/IEC 27001 as a project

Run certification as a project of eight phases: scope and context, risk assessment and treatment, the Statement of Applicability, control implementation by Annex A theme, documentation, awareness, internal audit with management review, and the certification audits. For each, fix the accountable person, the output, the weeks and the management decision the next phase depends on. Overlapping phases fit the four to eight months a single-site programme needs.

The standard requires no project plan, yet clause 6.1.3 requires a risk treatment plan the risk owners approve, and clause 6.2 requires you to decide what will be done to meet your security objectives, with what resources, by whom, by when and how results will be evaluated. Your plan carries both and starts where ISO/IEC 27001 gap analysis: what it covers and what you get ends.

The eight phases: weeks, deliverables, owners and decision points

Bracketed weeks are for an eight-month programme that must first build logging, access management, backup or supplier assurance.

Phases 2 to 6 overlap on purpose. Controls leave records from the day they go live and phase 7 samples them, so the stretch from the last significant control to Stage 2 cannot be squeezed; ISO/IEC 27001 timeline: how long certification takes, stage by stage gives our working rule. Appoint the certification body during phase 4, since Stage 1 is normally booked four to eight weeks ahead. After the decision the plan becomes the ISMS calendar, kept running under Sustain™.

The roles: sponsor, ISMS lead, risk owners, IT and HR owners, internal auditor

Three clauses shape the team: 5.3 has top management assign responsibility for the ISMS conforming to the standard and for reporting its performance, 6.1.2 requires risk owners to be identified, and 9.2 requires auditors selected so that audits are objective and impartial.

• Sponsor. From top management: owns the target window, provides resources, approves policy and risk criteria, and chairs the management review. Stage 2 auditors test that commitment in interview.
• ISMS lead. Runs the plan weekly, facilitates the risk workshops and keeps the Statement of Applicability and evidence in order. Agree this person's project time in writing; it erodes first.
• Risk owners. Managers accountable for a service, process or platform, who choose treatments and accept what remains. A register where IT owns every risk shows the business stayed out.
• IT and HR owners. IT carries most technological and many organisational controls; HR carries screening, terms of employment, leavers and awareness records; facilities takes the physical theme.
• Internal auditor. A trained colleague from another function, a group auditor or an external one, never auditing their own work; ISO/IEC 27001 internal audit: planning, conduct and reporting explains how to run it.

Design™ or Drive™: two levels of support, one plan

Every Sterling engagement runs on Sterling OS™, our delivery operating system, with a choice of two levels of support. They are alternatives, not consecutive steps; the phases and decisions above stay the same. Under Design™ your team implements with Sterling's structure and coaching; under Drive™ Sterling consultants take on the agreed consulting and documentation work.

Design™ suits an ISMS lead with time and IT and HR teams with capacity; Drive™ suits a contractual deadline, a thin team or several platforms. The operating weeks are the same on both.

Five mistakes that stall ISO/IEC 27001 projects

• A scope still open in week six. While leadership debates whether a client-dedicated environment or an offshore support desk is in, the risk assessment waits; see ISO/IEC 27001 scope: boundaries, interfaces and the mistakes that cost you.
• A risk method nobody can finish. Unagreed criteria or thousands of asset and threat pairs leave the Statement of Applicability without a basis. Agree criteria in the first fortnight and group assets by service.
• Security handed to IT. Leavers, visitors and business risk decisions go unowned until an auditor notices. Name an owner for each Annex A theme at kick-off.
• Policies ahead of controls. A policy promising quarterly access reviews becomes a finding when none has been held. Write each policy as its control goes live.
• Tooling decided late. Logging or single sign-on procured in week ten delays every later phase; settle tools at the phase 2 decision.

How Effivity holds the plan and the evidence

Plans kept in spreadsheets drift from their evidence, and each audit sample becomes a search. In a Sterling engagement both sit in Effivity, the Sterling group's ISO and GRC automation platform, used in 50+ countries, configured by your consultant within the agreed scope and included with the engagement, at no additional cost.

It holds the plan (actions with owners, due dates, reminders, escalation and a sponsor dashboard), the ISMS itself (scope, assets, risk register, Statement of Applicability, versioned policies) and the evidence (access reviews, incidents, supplier assessments, awareness records, vulnerability findings, internal audits, management review). Auditors then sample records where they were created; Effivity for ISO/IEC 27001: the guide covers the set-up.

ISO/IEC 27001 implementation plan: questions buyers ask