ISO 27001 ISMS Skill

ISO 27001 certifies a system (the ISMS), not a checklist — auditors check that you scoped it, assessed risk, and can justify which Annex A controls you applied or excluded (the Statement of Applicability). This skill builds that backbone: scope, risk treatment, and a defensible SoA, so certification is a documented management system rather than a scramble.

Required Inputs

Ask for these only if they aren't already provided:

• ISMS scope — the products, locations, and information assets in scope (and what's deliberately out).
• Context & interested parties — the business, its regulatory/customer security obligations, and key risks.
• Risk approach — how you identify, assess, and treat information-security risk (the SoA flows from the risk assessment, not the other way round).
• Current controls — what's already implemented across the Annex A domains.

Output Format

ISO 27001 ISMS: [organisation]

1. Scope statement — the boundary of the ISMS: assets, locations, exclusions and why.

2. Context & risk — interested parties and their requirements; the risk assessment method and risk acceptance criteria.

3. Statement of Applicability (SoA) — the heart of it: each Annex A control, applicable or not, status, and justification:

Annex A control	Applicable?	Status	Justification
A.5 Access control policy	Yes	met	Required for customer data
A.8 Teleworking	No	n/a	No remote-access to in-scope systems — excluded with rationale

(Excluding a control is fine — excluding it without a justification is an audit finding.)

4. Risk treatment plan — the top risks, the treatment (mitigate/accept/transfer/avoid), and the controls that address each.

5. Implementation roadmap — prioritised: mandatory clauses 4–10 (management system) first, then the highest-risk Annex A gaps, with owners and dates.