Managed ISMS: keep your information security system alive between audits.

What is actually managed

The six standing jobs behind a functioning ISMS.

A functioning management system is more than a folder of policies. It needs an accurate risk picture, control owners, review evidence, corrective actions, competent oversight and a planned audit cycle. The service is designed around these operating tasks, with an agreed division of responsibilities.

The operator coordinates records and reviews within your approved systems. Technical staff remain responsible for controls such as backups, identity configuration or vulnerability remediation. Senior management retains accountability for accepting risk and approving changes.

• Risk assessment and treatment: review material change and overdue actions
• Control ownership: identify missing evidence and responsible operators
• Policies and records: review at the agreed cadence, maintain version history
• Internal audit readiness: schedule independent audit and remedial follow-up
• Management review: produce a clear agenda, status pack and decision log
• Surveillance readiness: maintain the assessment calendar and evidence trail

Working cadence

A service that works in ordinary months, not only audit month.

The monthly programme should be visible: due control reviews, newly identified risks, suppliers with expiring evidence, outstanding findings and decisions awaiting approval. That rhythm prevents a last-minute scramble from becoming the default operating model.

At take-on, the existing scope, Statement of Applicability, risk methodology, last internal audit, open findings and certification timetable are reviewed. Any remediation backlog is assessed separately; it must not be silently bundled into ordinary maintenance.

• Monthly: action register, review calendar, risk changes and status reporting
• Quarterly: management review support and risk/priority refresh as agreed
• Annually: scheduled internal audit by independent personnel and certification-cycle planning
• When material changes occur: reassess relevant risks, controls and commitments

Independent assurance

Internal audit and certification are different jobs.

An internal audit must be conducted objectively and impartially. A lead operating the ISMS should not be presented as independently auditing their own work. We would scope suitably independent audit support separately, whether by a different qualified person or an external provider.

A certification body independently decides whether to award or retain ISO 27001 certification. Managed ISMS support can help prepare evidence, address findings and maintain the programme, but it cannot guarantee a certificate.

When it is a fit

The service is most useful when an owner is missing.

Common buying triggers include the resignation of an ISMS manager, a surveillance visit approaching with an outdated evidence register, a growing SaaS team that has inherited a certification from an earlier stage, or customer assurance requests that repeatedly pull engineering staff away from product work.

It is less appropriate when the business has no functioning controls and requires substantial new technical implementation. In those cases, we would start with a separate scoped implementation or remediation plan rather than misrepresent it as routine monthly maintenance.

• You already have an ISO 27001 scope and responsible technical owners
• You need a monthly programme rather than a one-off audit preparation sprint
• You want to keep control of your own documents and evidence
• You can provide internal stakeholders with authority to approve changes

Operational sample

What the client should receive every month.

A credible monthly ISMS pack can be short, provided it links to the underlying evidence. It should identify the status of each scheduled review, material changes since the previous month and the owners of overdue treatment actions. It should not invent a single universal compliance percentage.

The following is an illustrative example of a monthly output register; actual control coverage, risk thresholds and review intervals must be agreed against the organisation's scope and Statement of Applicability.

Beyond surveillance

A certificate does not prove that every control worked yesterday.

ISO/IEC 27001 is a management-system standard. The certified scope matters, as do the audit's date and sampling basis. The correct promise is a maintained process for checking risk and control evidence—not that certification eliminates cyber incidents or demonstrates continuous effectiveness of every technical control.

That distinction should be visible in proposals and customer security questionnaires. If a buyer requests proof beyond the certified scope, record the question, the additional evidence needed and who may approve release.