Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we get the top management commitment and resources an ISO 27001 project needs?

6 decision pointsThe pack behind this answer: ISO 27001 Implementation & Certification Readiness

Add to board memo

The short answer

Recommendation
Take one approval paper to top management before the risk assessment starts: the scope, the policy direction and the resources, with a named sponsor and ISMS manager. Minute the decision, then keep top management in the monthly reports, the objectives and the management review.
Reasoning
The pack's first rule is that top management approves the scope, the policy and the resources before the project starts, and the next phase does not begin until that evidence exists. An ISMS is a management system: approvals, objectives, resources and the review belong to top management. An auditor who finds nobody at the top able to describe the objectives or the last review's decisions will doubt the commitment, whatever the paperwork says.
Considerations
  • Top management means the board or a committee it has delegated to, the management board in a two-tier structure, or executive management where there is no board.
  • Effort and cost figures are the pack's defaults for an organisation of 100 to 300 people. Replace them with your own estimates and real quotes before the paper goes up.
  • Internal effort is usually larger than every external cost together, so budget it as time released from other work.
  • The standard's text is paywalled. The duties here come from the pack and public guides, so confirm what evidence your certification body accepts.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
  • Loop back
StartWe need top management behind our ISO 27001 projectDecisionCan you say in one paragraph why you want the certificate?StepAsk the sponsor to write the reason downDecisionIs there an executive sponsor who can secure people and money?StepName a sponsor with authority over the budgetStepName the ISMS manager and the control owners, with their timeStepCost the project from quotes and your own effort estimateDecisionIs the scope drafted and tested against the services customers buy?StepDraft the scope firstStepTake one approval paper to top managementDecisionDid top management approve the scope, policy direction and resources?StepChange the ask: add resource, narrow the scope or move the dateStepAgree what top management does after the startDecisionWill top management sit in the management review themselves?StepPut the review and the objectives on top management's own agendaStepKeep the records of commitment as you goDecisionWill top management look at a revised request?OutcomeTop management has not committed: do not start the projectOutcomeCommitment and resources approved: start the risk assessment

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 19 steps.

  1. Start

    We need top management behind our ISO 27001 project

    The pack's first rule is that top management approves the scope, the policy and the resources before the project starts. This is the first gate, and the next phase does not begin until its evidence exists. Auditors test it later by asking top management, not the ISMS manager.

    In the pack

  2. Decision

    Can you say in one paragraph why you want the certificate?

    The reason sets the scope and the date: which customers, tenders or regulators will read the certificate, and by when. The pack says to ask the sponsor to write one paragraph and not to start without it. If you cannot write it, answer no.

    In the pack

  3. Step

    Ask the sponsor to write the reason down

    Without a stated reason the scope has no test to pass and the date has no basis. If a customer, tender or regulator has set a deadline, write it down too and plan back from it, then tell top management at the first gate whether the plan meets it.

    In the pack

  4. Decision

    Is there an executive sponsor who can secure people and money?

    The sponsor secures people and money, clears blockers, takes decisions to top management and decides when the Stage 2 date moves. The pack's default effort is one to two hours a month plus the approvals at each gate. If nobody holds this role, answer no.

    In the pack

  5. Step

    Name a sponsor with authority over the budget

    Ask the person who can release money and people to take the role, or ask top management to appoint one. A project run only from the security team has nobody to settle a clash over time or cost.

    In the pack

  6. Step

    Name the ISMS manager and the control owners, with their time

    Name people, not roles, in the plan. The pack's defaults are half to full time for the ISMS manager for the length of the project, and one to three days a month for each control owner while controls are being put in place. In a small organisation one person may hold two roles.

    In the pack

  7. Step

    Cost the project from quotes and your own effort estimate

    Cost the scope you have drafted, because audit days and effort follow its size. Internal effort is usually larger than every external cost together. Budget it as time released from other work or the project slips. Indicative quotes from at least two accredited certification bodies are enough at this point (“How do we choose a certification body and agree our audit dates?” covers choosing one). Ask for days per stage, and include the surveillance audits in years two and three, because the certificate lapses without them.

    In the pack

    See also

  8. Decision

    Is the scope drafted and tested against the services customers buy?

    Top management approves the scope, so it must exist as a draft that names the organisation, locations, services, interfaces and any exclusion with its reason. If you have not drafted it, or are not sure it passes the tests, answer no.

    In the pack

    See also

  9. Step

    Draft the scope first

    The scope decides the size of everything else, so settle it before you ask for resources. A scope that is too wide multiplies the work. One that is too narrow produces a certificate customers do not value.

    In the pack

    See also

  10. Step

    Take one approval paper to top management

    Put three decisions in it: the scope with what it leaves out; the direction of the policy, a half-page saying what the policy will commit to (“How do we write an information security policy and objectives that stand up to an ISO 27001 audit?” covers the wording); and the people, time and money. Add the plan's gates and the forecast date, and say plainly if the forecast misses a customer's deadline. Ask for a decision at the meeting, not a note of interest.

    In the pack

  11. Decision

    Did top management approve the scope, policy direction and resources?

    All three are needed before the risk work starts. The direction of the policy is the half-page of commitments, not the finished policy. If only some were approved, or the approval is not minuted, the next phase should not start. Answer no for a partial or unrecorded approval.

    In the pack

  12. Step

    Change the ask: add resource, narrow the scope or move the date

    If top management will not approve as asked, the choices the pack gives when a plan does not fit its date are to add resource, narrow the scope or move the date. Narrow the scope only where the smaller scope still passes the scope tests. A scope cut only to leave out what is not ready fails them.

    In the pack

  13. Step

    Agree what top management does after the start

    Approval at the start is not enough. Top management receives the monthly readiness figures from the start of implementation, sets the objectives, accepts the residual risk and holds the management review. The auditor will ask them about these directly. Top management also tells the organisation, in its own name, why security matters, and backs managers who put it ahead of a deadline.

    In the pack

  14. Decision

    Will top management sit in the management review themselves?

    The review is theirs, not the security team's. Delegation to a deputy is recorded in the minutes, and a review attended only by the security team is not a management review. If attendance is uncertain, answer no.

    In the pack

    See also

  15. Step

    Put the review and the objectives on top management's own agenda

    Ask the sponsor to chair or sponsor the review, and give top management the decisions to take: resources, scope, policy and objectives, and risks accepted. Send the papers in advance so the meeting decides rather than notes.

    In the pack

    See also

  16. Step

    Keep the records of commitment as you go

    Keep the dated approval, the budget decision, the named roles and the review minutes. Test it by asking a member of top management what the objectives are and what the last review decided. The pack lists the lack of an answer as a common reason a first audit goes wrong.

    In the pack

  17. Decision

    Will top management look at a revised request?

    If they will not approve, find out what they would approve. If they will look again, take the revised paper back. If they will not, the project cannot start honestly. If you are not sure, answer no.

    In the pack

  18. Outcome

    Top management has not committed: do not start the project

    Do not start the risk assessment, and do not tell customers a certificate is coming or that the project is under way. Take the reason to the sponsor, record what top management would approve and why not the rest, and come back when something changes.

    In the pack

  19. Outcome

    Commitment and resources approved: start the risk assessment

    With the approval dated and minuted, the next phase can begin. The risk method comes first, before anyone scores a risk.

    In the pack

    See also

Practical checklist

  1. Write one paragraph on why you want the certificate and who will read it.
  2. Name an executive sponsor, an ISMS manager and the control owners, and agree the time each has.
  3. Draft the scope and test it against the services customers buy.
  4. Build the cost from at least two quotes plus the internal effort, including the later surveillance audits.
  5. Take scope, policy direction and resources to top management and have the decision minuted.
  6. Put the monthly readiness figures, the objectives and the management review on top management's own agenda.

Evidence to have ready

  • The minute or signed record of approval, dated before the risk assessment started.
  • The budget approval and the named roles with their agreed time.
  • Management review minutes showing who attended and what they decided.
  • Leadership messages on security sent in an executive's name.

Assumptions

  • You have decided to certify against ISO/IEC 27001:2022, or you are asking top management to take that decision.
  • There is at least one senior person who can secure people and money, or the sponsor role can be given to one.
  • Role effort, audit days and cost ranges are the CISO Times pack's defaults for an organisation of 100 to 300 people, and your own figures may differ.

Not covered here