Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

If…, then how…

If Stage 1 has raised concerns, then how do we get ready for Stage 2?

6 decision pointsThe pack behind this answer: ISO 27001 Implementation & Certification Readiness

Add to board memo

The short answer

Recommendation
Give every Stage 1 concern an owner and a date, close each at its cause with evidence, and move Stage 2 with the body's agreement if the records or the fixes will not be ready. In the last weeks check populations, not new documents.
Reasoning
Stage 1 is the cheapest place to find a problem. A concern left open is likely to return as a nonconformity at Stage 2, and a symptom patched rather than fixed returns at the first surveillance audit. Stage 2 samples records over time, so new documents written in the last weeks do not help. Moving the date early is cheaper than a major nonconformity.
Considerations
  • The gap between the stages is agreed with the body. If it runs long, the Stage 1 findings go stale and some bodies ask for part of Stage 1 again, so ask yours.
  • The operating period of 3 months and the 2 to 8 week gap are the pack's defaults. Your certification body may require more.
  • The pack grades a Stage 1 finding as an area of concern, with no effect on certification yet. It is likely to be looked at again at Stage 2.
  • Create no record during the audit and back-date nothing. Anything created after the request looks like what it is.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartStage 1 is done and its report lists areas of concernStepLog every concern with an owner and a dateDecisionDoes any concern mean the ISMS has not yet run long enough?DecisionCan every concern be closed with evidence before the Stage 2 date?StepMove Stage 2 with the body's agreementDecisionDoes the new date leave a long gap since Stage 1?StepAsk the body how a longer gap is handledStepClose each concern at its cause, with evidenceStepRe-score readiness and check the blocking itemsDecisionAre audit and review held, and every finding closed or planned?StepHold what is outstanding, then finish the actionsStepSet up the evidence room and the populationsDecisionHas everyone on the audit plan had a mock interview?StepRehearse them before the auditStepAgree rooms, access and the timetable with the bodyDecisionIs any Stage 2 line still open two weeks before the audit?OutcomeReady for Stage 2: go in with the evidence in handOutcomeRaise it with the sponsor this week and decide whether to move

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 18 steps.

  1. Start

    Stage 1 is done and its report lists areas of concern

    The Stage 1 report lists areas of concern to resolve before Stage 2, and the plan for Stage 2. It usually arrives one to two weeks after the audit by the pack's default. Stage 1 is the cheapest place to find a problem. Occasionally the report says Stage 2 should wait or part of Stage 1 must be repeated. If so, ask the body what it needs and agree it in writing first.

    In the pack

  2. Step

    Log every concern with an owner and a date

    Treat each area of concern as a nonconformity in waiting. Give it an owner and a date before Stage 2, sequenced so the blockers close first, and keep the evidence that it was closed.

    In the pack

  3. Decision

    Does any concern mean the ISMS has not yet run long enough?

    Stage 2 samples records over time. If a concern says records are thin, or a control started too late to have the operating period behind it, more documents will not help. If you are not sure, answer yes.

    In the pack

  4. Decision

    Can every concern be closed with evidence before the Stage 2 date?

    Be honest about the owners' time and the date. If a fix needs a purchase, a new process or a cycle of records, check the calendar. If you are not sure, answer no.

    In the pack

  5. Step

    Move Stage 2 with the body's agreement

    The pack's rule is to move Stage 2, with the certification body's agreement, rather than go in expecting a major nonconformity. Tell the executive sponsor the same month. Choose a date by which the fixes are done and the full operating period has run, with some margin.

    In the pack

    See also

  6. Decision

    Does the new date leave a long gap since Stage 1?

    The pack's default gap is 2 to 8 weeks. A gap that is too long means the Stage 1 findings go stale and the operating period stretches without anyone checking it. If the gap is long or you do not know the body's limit, answer yes.

    In the pack

  7. Step

    Ask the body how a longer gap is handled

    Some bodies set a maximum gap and ask for part of Stage 1 to be repeated beyond it. Ask yours, and agree the plan and the new dates in writing.

    In the pack

  8. Step

    Close each concern at its cause, with evidence

    Find the cause, correct it, add the corrective action and check that it worked. Fixing only the symptom is a mistake the pack lists: the same finding returns at the first surveillance audit.

    In the pack

  9. Step

    Re-score readiness and check the blocking items

    Re-run the readiness score from what an auditor could see today. Every blocking item should be at the operating level and no gap on the critical path overdue before Stage 2.

    In the pack

  10. Decision

    Are audit and review held, and every finding closed or planned?

    If the internal audit or management review is still only planned, hold it before Stage 2: the pack's own rule requires both, whatever the body accepted at Stage 1. Every internal audit nonconformity needs a root cause, a correction, a corrective action and an effectiveness check, or a dated plan for one. If any finding is open without a plan, or either has not been held, answer no.

    In the pack

  11. Step

    Hold what is outstanding, then finish the actions

    Hold the internal audit and then the management review if either has not happened, in that order. Close what can be closed, and give the remainder an owner, a date and a check. Report the position to the sponsor.

    In the pack

    See also

  12. Step

    Set up the evidence room and the populations

    Index it by clause and by control, hold the approved version of each document, and prepare the populations an auditor is likely to sample for the whole operating period: joiners, movers and leavers, changes, incidents, suppliers, access reviews, training, restore tests and scans. Name a runner.

    In the pack

  13. Decision

    Has everyone on the audit plan had a mock interview?

    Control owners should answer for their own controls, and nobody should guess. If the ISMS manager is the only one who can answer, the auditor concludes the ISMS belongs to one person. If anyone has not been rehearsed, answer no.

    In the pack

    See also

  14. Step

    Rehearse them before the audit

    Run short mock interviews with the internal auditor. Teach the answer 'I do not know, but I know who does'. Never create or back-date a record.

    In the pack

    See also

  15. Step

    Agree rooms, access and the timetable with the body

    Settle rooms, access, screen sharing and the timetable, and who is available on each day. Give auditors read access to the evidence room, and show live systems by screen share with the control owner.

    In the pack

  16. Decision

    Is any Stage 2 line still open two weeks before the audit?

    Use the Stage 2 checklist: concerns closed, blocking items operating, operating period met, internal audit and management review held, audit actions closed, evidence room indexed, interviews rehearsed, logistics agreed. If any line is open, answer yes.

    In the pack

  17. Outcome

    Ready for Stage 2: go in with the evidence in hand

    Keep the checklist, with the date and name against each line, as evidence of preparation.

    In the pack

  18. Outcome

    Raise it with the sponsor this week and decide whether to move

    Tell the sponsor in the same week and decide whether to add resource or move the date with the body. Do not wait for the audit to decide for you.

    In the pack

    See also

Practical checklist

  1. Put each Stage 1 concern in the gap tracker with an owner and a date.
  2. Decide whether the records and the fixes will be ready, and move Stage 2 with the body if not.
  3. Close each concern at its cause and keep the evidence that it worked.
  4. Hold the internal audit and management review if not yet done, and finish every audit action or give it a dated plan.
  5. Build the evidence room and the populations for the whole operating period.
  6. Rehearse the people on the audit plan and agree rooms, access and timetable.

Evidence to have ready

  • The concern log with owners, dates and closing evidence.
  • The updated readiness score and gap tracker.
  • The internal audit actions with root cause and effectiveness checks.
  • The indexed evidence room and the interview rehearsal record.

Assumptions

  • Stage 1 has been held, or is about to be, and the body's report lists areas of concern.
  • An internal audit and a management review have been held, or are planned with dates because your body accepted that at Stage 1. This flow has you hold both before Stage 2.
  • The operating period and the gap between stages are the CISO Times pack's defaults. Your certification body may set others.

Not covered here