Template draft. Replace everything in [square brackets] with your own decision,
delete what does not describe what you really do, and approve it through your own document control. It is not legal
advice and does not make an organisation compliant or certified.
1. Purpose
This plan sets the calendar of recurring activities that keep the ISMS operating between audits. It turns requirements spread across the library into dated tasks with one owner each and a named record, so that nothing depends on someone remembering that a review is due.
- Make every recurring ISMS task visible, dated and owned.
- Define the evidence an auditor will be shown for each task.
- Give the Head of Information Security an early warning when a task is slipping.
2. Scope
The plan covers tasks that recur at least once a year and are required by the policies, procedures and plans in the library. It applies to every function head and role holder named as an owner.
- In scope: quarterly, half-yearly and yearly tasks in sections 6 to 8, and the event-driven reviews in section 9.
- Out of scope: daily and weekly operational routines such as monitoring, scanning and backup jobs, which are run under the relevant procedures and reported through the metrics pack.
3. Objectives
- Complete at least [95 percent] of scheduled tasks by their due date in every quarter.
- Leave no task without evidence: [100 percent] of completed tasks have a record in the evidence location.
- Close every missed task, with a reason and a new date, within [10 working days] of the due date.
- Review the plan itself [every 12 months] so that it matches changes to the library.
4. Roles and Responsibilities
| Role | Responsibilities |
|---|
| Head of Information Security | Owns the plan; publishes the calendar [before each year starts]; chases late tasks; reports completion to the ISSC. |
| Task owner | Performs the task by the due date, saves the evidence, and tells the plan coordinator when complete or at risk. |
| Plan coordinator | Keeps the calendar and the completion log; sends reminders [10 working days] and [3 working days] before each due date. |
| Function heads | Make sure their people have the time to perform tasks assigned to them. |
| Internal audit lead | Samples completed tasks and their evidence during the audit programme. |
| Top management | Receives the completion rate and decides on resources when tasks are repeatedly missed. |
| Activity | Responsible | Accountable | Consulted | Informed |
|---|
| Publish the annual calendar | Plan coordinator | Head of Information Security | Task owners | ISSC |
| Perform scheduled tasks | Task owner | Function head | Head of Information Security | Plan coordinator |
| Track completion and chase | Plan coordinator | Head of Information Security | Task owners | ISSC |
| Approve a change of date | Head of Information Security | Head of Information Security | Task owner | ISSC |
| Verify evidence by sampling | Internal audit lead | Top management | Head of Information Security | ISSC |
| Review the plan itself | Head of Information Security | Top management | ISSC; task owners | All task owners |
5. How the Calendar Is Run
- PublishBefore the year starts the plan coordinator copies this plan into [the calendar tool] with a due date for each task, set in the first [month of the quarter]. Output: calendar with owners. Time target: [15 working days] before year start.
- RemindOwners are reminded [10 working days] and [3 working days] before the due date. The reminder links to the detail document and the evidence folder.
- Perform and recordThe owner performs the task and records the date, the result and the evidence location in the completion log (Annexure A).
- VerifyThe plan coordinator checks that the evidence exists and matches the task. Time target: [5 working days] after completion.
- EscalateA task more than [5 working days] late is reported to the Head of Information Security; more than [15 working days] late, to the ISSC with a reason and a recovery date.
- ReportThe completion rate by quarter and the list of late tasks go to the ISSC and into the management review.
- A date may be moved only with the approval of the Head of Information Security and only within the same quarter. A task moved across a quarter boundary is recorded as a missed task.
- Where a task's evidence is produced by a tool, an export or screenshot with the date is acceptable.
- Do not combine tasks in one meeting unless each leaves its own record.
6. Quarterly Tasks
These tasks are performed in every quarter. The due date is [the last working day of the first month after quarter end] unless stated.
| Task | Owner | Evidence | Detail document |
|---|
| Review user access to critical systems and remove unneeded accounts | System owners; Head of IT operations | Signed access review sheet; removal tickets | User Access Management Procedure |
| Review privileged and administrator accounts | Head of IT operations | Privileged account list with approvals | Access Control Policy |
| Hold the Information Security Steering Committee meeting with the metrics pack | Head of Information Security | Agenda, metrics pack, minutes | ISMS Manual |
| Review the risk register and treatment plan progress | Risk manager | Updated register; overdue action list | Risk Management Policy |
| Review vulnerability scan results and the patch backlog against the patch windows | Head of IT operations | Scan report; backlog report; exceptions | Patch Management Procedure |
| Run a phishing simulation and follow up with those who fail | Head of Information Security | Campaign report; follow-up record | HR Security Policy |
| Perform sample restore tests from backup | Head of IT operations | Restore test record with timings | Backup Management and Retention Procedure |
| Review firewall and network access rules | Network lead | Rule review record; removed rules | Network Security Procedure |
| Reconcile the asset register with discovery tools and the finance fixed asset list | Asset manager | Reconciliation report | Asset Management Procedure |
| Review the incident register for trends and lessons learned | Incident manager | Trend report; lessons log | Incident Management Procedure |
| Review critical supplier performance and security incidents | Procurement lead | Supplier review record | Supplier Relationship Management Procedure |
| Review log source coverage and alert rules | Security operations lead | Coverage report; rule changes | Logging and Monitoring Procedure |
| Check training completion and chase overdue staff | HR | Completion report | HR Security Procedure |
| Review the exceptions register and the documents past review date | Head of Information Security; document controller | Exceptions list; overdue documents list | Documents and Records Management Procedure |
| Review physical access lists for secure areas | Facilities lead | Signed access list | Physical and Environmental Security Procedure |
7. Half-Yearly Tasks
Half-yearly tasks fall in the second and fourth quarters unless the calendar sets otherwise. The due date is the end of the month in which the half closes.
| Task | Owner | Evidence | Detail document |
|---|
| Hold the management review of the ISMS | Top management | Minutes, inputs pack and decisions | ISMS Manual |
| Run a recovery or failover test for critical systems | Head of IT operations | Test plan, result and issues log | BCP and DR Procedure |
| Run a tabletop exercise of a major incident | Incident manager | Scenario, attendance, findings | Incident Management Procedure |
| Review the authorities and special interest groups contact list | Legal and compliance | Updated list | ISMS Manual |
| Review the legal and regulatory requirements summary | Legal and compliance | Updated summary; change notes | Internal and External Issues and Interested Parties |
| Audit half of the ISMS clauses and processes | Internal audit lead | Audit report | ISMS Manual |
| Review cryptographic keys and certificates for rotation and expiry | Security engineering lead | Key inventory with dates | Key Management Process |
| Review baseline configurations for critical platforms | Platform owners | Baseline review record | Secure Configuration Policy |
| Review the threat intelligence sources and how they were used | Security operations lead | Source review note | Threat Intelligence Policy |
| Test mobile device wipe and lost-device process on a sample | Head of IT operations | Test record | Mobile Device Management Procedure |
8. Yearly Tasks
Yearly tasks are placed in the calendar so that no month carries more than [four] of them.
| Task | Owner | Evidence | Detail document |
|---|
| Perform the full risk assessment and update the risk treatment plan | Risk manager | Register; treatment plan; acceptances | Risk Management Policy |
| Review the Statement of Applicability | Head of Information Security | Updated statement with approval | Statement of Applicability |
| Review the ISMS scope | Head of Information Security | Signed scope statement | ISMS Manual |
| Review all policies and procedures and re-approve | Document owners | Revision history; approval | Documents and Records Management Procedure |
| Review issues and interested parties | Head of Information Security | Updated registers | Internal and External Issues and Interested Parties |
| Set and approve objectives | ISSC | Objectives register | ISMS Manual |
| Approve the annual internal audit programme and complete it | Internal audit lead | Programme; reports; closure summary | ISMS Manual |
| Commission an external penetration test and retest | Head of Information Security | Report; retest report | Vulnerability Assessment and Penetration Testing Procedure |
| Complete full disaster recovery exercise and business impact review | Business continuity lead | Exercise report; revised plan | BCP and DR Procedure |
| Reassess all critical suppliers | Procurement lead | Assessment records | Supplier Relationship Management Procedure |
| Complete annual awareness training and policy acknowledgement for all staff | HR | Training and acknowledgement records | HR Security Policy |
| Recertify all user access | System owners | Signed recertification | User Access Management Procedure |
| Review data protection records and impact assessments | Data Protection Officer | Updated records; assessments | Data Protection and Privacy Procedure |
| Review retention and destroy information past its period | Document controller; data owners | Destruction log | Documents and Records Management Procedure |
| Review cryptography standards and the Cyber Compliance Plan | Head of Information Security | Review note; updated plan | Cyber Compliance Plan |
| Review cyber insurance cover against risk | Finance lead | Policy review note | Cyber Compliance Plan |
9. Event-Driven Reviews
| Event | Review required | Timing |
|---|
| Major incident | Post-incident review; risk register and controls update | Within [10 working days] of closure |
| Significant change to scope, systems or suppliers | Risk assessment; Statement of Applicability check | Before go-live |
| New or changed law or customer requirement | Update issues, parties and legal summary | Within [10 working days] |
| Critical audit finding | Corrective action under the ISMS Manual | Per severity target |
| Merger, acquisition or reorganisation | Scope and roles review | Before the change takes effect |
10. Annual Calendar
Month 1 is the first month of the Organisation's [financial year]. The table shows where the tasks above fall so that the load is even.
| Month | Quarterly tasks | Half-yearly tasks | Yearly tasks |
|---|
| Month 1 | Quarter review window | None | Set objectives; approve audit programme |
| Month 2 | None | None | Review all policies (first third) |
| Month 3 | None | Authorities list; legal summary | Review all policies (second third) |
| Month 4 | Quarter review window | None | Review issues and parties; scope |
| Month 5 | None | Recovery test | Reassess critical suppliers |
| Month 6 | None | Management review; internal audit of first half; key review | Full risk assessment begins |
| Month 7 | Quarter review window | None | Risk assessment completed; Statement of Applicability |
| Month 8 | None | None | Penetration test and retest |
| Month 9 | None | Tabletop exercise | Awareness training and acknowledgement |
| Month 10 | Quarter review window | None | Access recertification |
| Month 11 | None | None | Data protection review; retention destruction |
| Month 12 | None | Management review; internal audit of second half; recovery test | Full recovery exercise; insurance review |
11. Measures
| Measure | Target | How measured |
|---|
| Tasks completed by due date, each quarter | [95 percent] | Completion log |
| Completed tasks with evidence verified | [100 percent] | Coordinator check and audit sample |
| Tasks more than 15 working days late | [Zero] | Completion log |
| Dates moved across a quarter boundary | [Under 5 percent] | Change record |
| Escalations answered within the deadline | [100 percent] | ISSC minutes |
12. Records and Evidence
| Record | Owner | Where kept | Retention |
|---|
| Annual calendar and its versions | Plan coordinator | [Calendar tool] | [3 years] |
| Completion log with evidence links | Plan coordinator | [Document management system] | [5 years] |
| Evidence for each task | Task owner | [Document management system] | [As stated in the detail document, minimum 3 years] |
| Escalation and date change records | Head of Information Security | [Document management system] | [3 years] |
Annexure A: Completion log
| Task | Owner | Due date | Completed on | Result | Evidence location |
|---|
| Example: quarterly access review | Head of IT operations | [Date] | [Date] | Complete; 12 accounts removed | [Link] |
| | | | | |
| | | | | |
Annexure B: Missed task and date change record
| Task | Original due date | Reason | New date | Approved by | Risk accepted in the meantime |
|---|
| | | | | |
| | | | | |
| | | | | |
13. Exception
Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.
14. Enforcement
Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.
15. Review
This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.
ISO/IEC 27001:2022 references
| Reference | Title |
|---|
| 9.1 | Monitoring, measurement, analysis and evaluation |
| 9.2 | Internal audit |
| 9.3 | Management review |
| 10.1 | Continual improvement |
| A.5.36 | Compliance with policies, rules and standards for information security |
| A.5.37 | Documented operating procedures |