ISMS Manual
Describes the Organisation's information security management system clause by clause and maps every policy, procedure and plan in the library.
A set of drafted policies and procedures for an information security management system, written to the structure an auditor expects, with a Statement of Applicability covering all 93 Annex A controls.
ISO/IEC 27001 asks for documented information, not a particular set of documents. Most organisations end up needing the same core: an information security policy, a defined scope, a risk method, internal audit and management review procedures, and policies for the areas their risk assessment says matter. These templates give you that starting set.
Each one follows the same controlled-document layout (document details, revision history, contents, purpose, scope, roles, the policy or procedure, records, exceptions, enforcement and review) and cites the clauses and Annex A controls it helps to satisfy. Decisions that are yours to make, such as periods, thresholds and tool names, are left in square brackets.
Describes the Organisation's information security management system clause by clause and maps every policy, procedure and plan in the library.
The top-level information security policy: management commitment, the ISMS framework and a policy statement for every one of the 93 Annex A controls.
Sets the method, scales, acceptance criteria and templates the Organisation uses to assess, treat and monitor information security risk.
Records the external and internal issues and the interested parties whose requirements shape the Organisation's ISMS scope, risks and objectives.
Calendar of the recurring quarterly, half-yearly and yearly ISMS activities, with owners, due dates and the evidence each must leave behind.
How ISMS documents are identified, approved, versioned, distributed and withdrawn, and how records are kept, protected, retained and disposed of.
Plans how the Organisation meets its cyber, privacy and contractual obligations through governance, technical controls, response, vendor oversight and review.
A ready-to-complete Statement of Applicability listing all 93 Annex A controls with space for applicability, justification and status.
Rules for who may reach the Organisation's information and systems, how access is granted, reviewed, logged and removed.
How user accounts, passwords, remote and privileged access are granted, reviewed and removed, with forms.
Security rules for the whole employment lifecycle: screening, terms, awareness, discipline, role changes and exit.
Security steps across the people lifecycle: screening, agreements, training, disciplinary action, leaving or changing role, contractors and remote work.
Rules for how people use the Organisation's devices, networks, accounts, email and internet, including personal use and monitoring.
Rules for identifying, recording, owning, using, moving and retiring the Organisation's hardware, software, data and cloud assets.
Step-by-step handling of physical, information, software and cloud assets from acquisition to disposal.
Controlled steps for retiring, sanitising, destroying, reselling or recycling equipment and media, with proof that data cannot be recovered.
Defines the classification levels, how information is labelled and the handling rules for each level in every state and medium.
How the Organisation classifies, labels, handles, stores, transfers and disposes of information and media at each classification level.
Security rules for phones, laptops and tablets, personally owned devices, and for working from home or any remote location.
How mobile devices are acquired, enrolled, configured, used under BYOD, changed, lost and retired so that Organisation data on them stays protected.
How the Organisation identifies critical roles, names successors and keeps knowledge, access and duties covered when people leave.
Plain-language rules for staff using generative AI tools: what is allowed, what data never goes in, how to check output and report mistakes.
Sets what the Organisation backs up, how often, where copies are kept, how they are protected and how restoration is proven by testing.
How data is selected, backed up, monitored, retained, restored, tested and securely disposed of.
Sets when encryption, signatures and hashing are required, which algorithms are approved, and how cryptographic keys are protected through their life.
How the Organisation decides where encryption is needed, selects products and algorithms, manages keys through their lifecycle and encrypts data.
How cryptographic keys are generated, distributed, stored, used, rotated, revoked, backed up and destroyed across their whole life.
Rules for secure day-to-day operation: procedures, change, backup, networks, media, information exchange, logging, malware and capacity.
How the Organisation designs, documents, hardens, segregates, accesses, monitors and tests its wired, wireless, remote and cloud networks.
Security requirements for buying, building, testing, changing and retiring information systems, including test data and source code.
Secure lifecycle steps for planning, designing, building, testing, deploying and maintaining the Organisation's software and systems.
Controls how changes to systems, networks, applications and services are requested, assessed, approved, implemented, reviewed and communicated.
Sets the security rules and the onboarding procedure for acquiring, using, monitoring and exiting cloud services, including data, access and contract terms.
Defines which events are logged, how logs are protected and retained, and how systems are monitored so that security events are detected and investigated.
What the Organisation logs for each class of system, how logs are protected and retained, how often they are reviewed and what triggers an alert.
Sets the preventive, detective and response controls against malicious software on endpoints, servers, email, web traffic and removable media.
Sets how software updates and security patches are identified, risk-rated, tested, deployed and verified within defined deadlines across all systems.
How the Organisation finds, rates, tests, deploys and verifies security and stability patches within set timelines, including emergencies and exceptions.
Defines how recurring or serious incidents are analysed for root cause, worked around, fixed permanently and recorded so that they do not return.
Requires hardened, documented and monitored configuration baselines for every system, and controls on deviation, drift and default settings.
Sets how the Organisation collects, analyses, shares and acts on information about threats so that defences and decisions reflect real attacker activity.
How the Organisation measures, forecasts and plans the capacity of systems, networks, storage and people so that services do not fail through lack of resource.
How the Organisation scans for, rates, fixes and verifies technical weaknesses, and how penetration tests are authorised and run.
Rules for lawful, fair and secure handling of personal data, individual rights, breaches, DPIAs, third parties and records of processing.
Step-by-step handling of personal data: finding it, protecting it, getting consent, assessing risk, honouring rights, purging it and reporting breaches.
How the Organisation handles personal data in line with Indian data protection law, covering rights, consent, security, breaches, transfers and retention.
Ownership, quality, classification, lifecycle, sharing and cross-border handling of the Organisation's data, with classification matrix and agreement templates.
How the Organisation identifies legal and contractual duties, checks its own compliance and audits systems without harming operations.
Rules for securing premises, secure areas, equipment, power, cabling and the working environment against intrusion, damage and loss.
How the Organisation protects premises, secure areas, equipment, utilities and assets from physical and environmental threats, with visitor and asset forms.
How information security events are reported, prioritised, contained, resolved and learned from, with response times and cyber incident reporting duties.
How information security events are detected, reported, assessed, contained, resolved, notified to authorities and learned from, with roles, severity levels and a register.
How information security is kept in place during disruption: requirements, recovery strategies, redundancy, testing and review of continuity arrangements.
How the Organisation plans for, responds to and recovers from disruption, with BIA, teams, steps and exercises.
Sets how suppliers are classified, assessed, contracted, monitored and offboarded so that supplier access to information and services stays controlled.
How the Organisation selects, contracts, secures, monitors and exits suppliers that handle its information or services.
Governance of the Organisation's AI systems: committee, roles, data protection, bias and fairness, third parties, risk assessment, incidents and training.
Rules for ethical, transparent and recorded engagement with governments, regulators and industry bodies on public policy and regulation.
A structured method to find, rate and treat security risks in a product using STRIDE threat modelling, recovery planning and secure configuration.
No template can. Certification depends on your own risk assessment, on the controls you actually run, and on evidence that you follow your documents. These give you well-structured drafts to adapt, so the effort goes into your decisions rather than the layout.
Not necessarily. The scope, risk, audit, management review and policy documents are the core. The rest map to Annex A controls: keep those your Statement of Applicability marks as applicable, and record the reason for those you leave out.
They are provided as PDF so the layout and references stay intact. Use them as a reference to build your own controlled documents in your document system, and download the Statement of Applicability as a CSV to complete in a spreadsheet.
ISO/IEC 27001:2022, with its 93 Annex A controls in four themes, taken from ISO/IEC 27002:2022. Control titles are given for reference; the full text is in the standard, which you need to buy from ISO or your national body.