Key takeaways
- Set up, run, maintain and keep improving the ISMS, including the processes it needs and how they interact.
- ISO 27001 asks for a working management system, not just a pile of documents.
- Start here: map the ISMS processes and how they connect: risk, controls, audit, review, improvement.
Purpose
Set up, run, maintain and keep improving the ISMS, including the processes it needs and how they interact.
Requirement
Requirement summaryThe organization shall establish, implement, maintain and continually improve an information security management system, including the processes needed and their interactions, in accordance with the requirements of this document.
Why it matters
ISO 27001 asks for a working management system, not just a pile of documents.
How to implement
- Map the ISMS processes and how they connect: risk, controls, audit, review, improvement.
- Assign owners to each process.
- Make sure each process produces records.
- Review and improve the system as a whole.
What evidence you need to provide
Here is what you will typically need to provide for Clause 4.4. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- A simple overview of how your security programme works: its main processes and how they connect.
Records and examples to show
- Recent records showing the programme runs as a full cycle: risk assessment, controls, internal audit, management review and improvements.
- Your planning calendar showing when key activities happen.
Things you should be able to show or explain
- Be able to walk through the yearly cycle.
How much to show: One complete cycle.
Common mistakes
- Processes exist on paper but don't link together.
- Steps skipped.
- Documents that do not reflect how work happens.
- No overview showing how processes link together.
- Tip: Keep your scope tight for your first certification — you can always expand it later.
Policies & documents to have
- ISMS scope statement
- Information Security Policy (ISMS policy)
FAQ
Can we exclude clause 4.4?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
Evidence the whole system works as a joined-up cycle, not just documents.