ISO 27001, clause by clause, in eramba

Most teams write one short document for 4.1 to 4.3. Keep it where its reviews and approvals are recorded: Program Issues and Scope in the Organisation module, or a policy in the Policy module. A file on a shared drive proves nothing to an auditor.

5.1 asks you to prove that senior management is behind the ISMS. The cheapest proof is the ISMS policy itself (5.2) carrying its review and approval history. Roles (5.3) and objectives, "Goals" in eramba lingo, live in the Organisation module, where Goals can be tested at intervals.

ISO does not care how you classify risks, as long as it is consistent, valid and comparable. The standard has not used the words "threat" or "vulnerability" for risk identification since 2005, and it never mentions "asset" at all, so a list of risks with no relation to those attributes is perfectly certifiable. Risks are found by talking to people, in the coffee corner or with an Online Assessment. eramba records what you decided and who owns it.

7.2 is 5.3 with attachments: certificates and training records on the roles you already documented. For 7.3 a few slides per department are enough, what to be aware of and which controls they operate. 7.5 wants documents approved, reviewed and available, and the Policy module and its portal do all three.

"Plan, implement and control the processes" means laptop encryption, account provisioning, change management, log reviews. Each is an Internal Control that explains what you do and gets tested at intervals. 8.2 and 8.3 send you back to risk: the module forces review dates, so the reassessment cannot quietly not happen.

9.1 is the expensive clause, alongside 8.2 and 8.3: monitoring must be systematic, with who, when and results. Test your own controls through the year the way an auditor would, because when the auditor comes they will lean on your testing. That is the key piece of ISO, testing beforehand. 9.3 is a meeting with slides, and its minutes go into the Policy module.

An auditor favourite. When something is not met, a failed control audit, an incident, an external finding, there has to be a plan to fix it. Projects carry the owner, the deadline and the tasks, and link back to the requirement, risk or control they repair.