ISO 27001 Implementation Plan: 26 Weeks

What this implementation plan is for

This planning frame is for an organization with functioning business processes that is establishing an ISMS or materially repairing one. It converts the work into a controlled sequence: establish the mandate, define the boundary, assess and treat risk, release controls into operation, evaluate the system, and make management decisions from current records.

It is not a promised certification timetable. The pace depends on the size and complexity of the boundary, the maturity of existing practices, the frequency of real operating events, and the amount of organizational or technical change underway. A control that operates quarterly cannot acquire a quarter of evidence because more people join the project.

Treat certification as a separate business objective. Record why it is wanted, the proposed boundary, and the external dates involved. If the audit date moves, the management reason for operating the ISMS should still remain valid.

Confirm the mandate before building the program

An urgent customer question, tender, group instruction, incident, or risk decision may all start the work, but they do not create the same mandate. Preserve the initiating source and separate the dates hidden inside the request.

State the business result leadership expects from the ISMS, not only an audit or certificate date.
Describe the provisional service boundary and name the sponsor, implementation lead, and authority available to proceed.
Record customer, contractual, regulatory, group, and public commitments already made, including their source.
Separate a tender deadline, procurement decision, audit visit, provider availability, hoped-for certification decision, and any public promise.
Mark each date as fixed or preferred, identify the dependency it controls, and show the consequence of moving it.
Give leadership an explicit choice: proceed, proceed with conditions, hold for a missing fact, replan, or stop.

Keep implementation project time and operating time separate

Both clocks matter. Confusing them creates confident schedules that cannot support the intended evidence or decision.

Clock	What it covers	What can shorten it	What cannot be manufactured
Implementation project time	Inquiry, decisions, design, document adaptation, technical work, configuration, testing, and release into normal ownership.	Clearer decisions, narrower scope, available competence, and additional delivery capacity can shorten some stages.	A missing authority decision or unstable upstream dependency still has to be resolved before dependent work is reliable.
Operating time	Normal use of an approved process or control, including exceptions, failures, owner review, and the retained records created over time.	A process with frequent natural events can provide more observation opportunities than a rare one.	Past operation, a second recovery test, a quarterly review, or a representative population that never occurred.

Implementation project time

What it covers: Inquiry, decisions, design, document adaptation, technical work, configuration, testing, and release into normal ownership.
What can shorten it: Clearer decisions, narrower scope, available competence, and additional delivery capacity can shorten some stages.
What cannot be manufactured: A missing authority decision or unstable upstream dependency still has to be resolved before dependent work is reliable.

Operating time

What it covers: Normal use of an approved process or control, including exceptions, failures, owner review, and the retained records created over time.
What can shorten it: A process with frequent natural events can provide more observation opportunities than a rare one.
What cannot be manufactured: Past operation, a second recovery test, a quarterly review, or a representative population that never occurred.

For each material process, identify the source decision, implementation work, first normal event or cycle in which it can operate, expected population, owner review, earliest supportable evaluation, and every later decision that depends on it.

Build the roadmap by dependency

Workstreams may overlap once their inputs are stable. The sequence is not a one-way waterfall: a supplier fact, failed case, or audit finding may reopen an earlier decision.

Approve the mandate, working authority, resources, and implementation records.
Determine context, interested parties, applicable obligations, scope, interfaces, and governance.
Approve the risk method and assess the in-scope risk population.
Choose treatment, determine necessary controls, compare them with Annex A, and maintain the Statement of Applicability.
Adapt only the policies, standards, procedures, and technical arrangements needed to operate those decisions.
Establish authoritative records and release processes into ordinary ownership.
Run ordinary and difficult cases, retaining the evidence and owner review that normal operation produces.
Monitor, measure, internally audit, and evaluate the ISMS.
Correct nonconformities, address supported causes, and evaluate corrective-action effectiveness.
Conduct management review and transfer its decisions into owned actions.
Prepare for certification only when that objective remains approved and the current evidence supports proceeding.
Hand the ISMS into continuing operation, improvement, audit, and source monitoring.

The 26-week planning frame

Use the periods as a dependency map, not a promise. Extend them when the boundary spans many sites, source inventories are incomplete, major change is underway, or important controls operate infrequently.

Period	Primary implementation work	Operating or assurance work to begin
Weeks 1–2	Preserve sources; confirm the mandate, sponsor, authority, resources, project records, and provisional service boundary.	Sample current records and list external claims and fixed commitments.
Weeks 3–5	Analyse context, interested parties, obligations, interfaces, dependencies, scope, and governance.	Reconcile service, supplier, asset, and responsibility sources; challenge the proposed boundary.
Weeks 5–8	Approve the risk method, establish the population, and identify, analyse, and evaluate risks.	Trial the method with several assessors and resolve gaps in ownership or source evidence.
Weeks 7–10	Select treatment, determine necessary controls, compare Annex A, build the SoA, and define the residual-risk route.	Start high-priority actions and keep current operation separate from the intended target state.
Weeks 9–14	Adapt policies, standards, procedures, exception routes, and document controls.	Walk ordinary and difficult cases, releasing instructions in manageable groups.
Weeks 10–15	Establish authoritative registers, stable identifiers, field rules, access, review, and retention.	Reconcile samples across source systems and migrate only after acceptance checks.
Weeks 13–19	Run the first operating cycles and owner reviews.	Retain ordinary, late, failed, emergency, and exception cases; repair broken dependencies.
Weeks 16–21	Operate objectives, monitoring, measurement, evidence control, and the internal audit program.	Complete suitable audit engagements across the approved program.
Weeks 19–23	Correct current cases, analyse causes, implement corrective actions, and evaluate suitable early results.	Prepare management-review inputs from authoritative periods and populations.
Weeks 22–24	Conduct management review and transfer its decisions.	Confirm action ownership, resources, risk updates, and the next review triggers.
Weeks 23–26	If approved, make the certification-readiness decision and coordinate provider activity.	Preserve ordinary operation; never stage or backfill records for the audit.
Week 26 onward	Complete source applicability, handover, the final trace review, and stabilization.	Continue control cycles, audit, improvement, surveillance where relevant, and source monitoring.

Weeks 1–2

Primary implementation work: Preserve sources; confirm the mandate, sponsor, authority, resources, project records, and provisional service boundary.
Operating or assurance work to begin: Sample current records and list external claims and fixed commitments.

Weeks 3–5

Primary implementation work: Analyse context, interested parties, obligations, interfaces, dependencies, scope, and governance.
Operating or assurance work to begin: Reconcile service, supplier, asset, and responsibility sources; challenge the proposed boundary.

Weeks 5–8

Primary implementation work: Approve the risk method, establish the population, and identify, analyse, and evaluate risks.
Operating or assurance work to begin: Trial the method with several assessors and resolve gaps in ownership or source evidence.

Weeks 7–10

Primary implementation work: Select treatment, determine necessary controls, compare Annex A, build the SoA, and define the residual-risk route.
Operating or assurance work to begin: Start high-priority actions and keep current operation separate from the intended target state.

Weeks 9–14

Primary implementation work: Adapt policies, standards, procedures, exception routes, and document controls.
Operating or assurance work to begin: Walk ordinary and difficult cases, releasing instructions in manageable groups.

Weeks 10–15

Primary implementation work: Establish authoritative registers, stable identifiers, field rules, access, review, and retention.
Operating or assurance work to begin: Reconcile samples across source systems and migrate only after acceptance checks.

Weeks 13–19

Primary implementation work: Run the first operating cycles and owner reviews.
Operating or assurance work to begin: Retain ordinary, late, failed, emergency, and exception cases; repair broken dependencies.

Weeks 16–21

Primary implementation work: Operate objectives, monitoring, measurement, evidence control, and the internal audit program.
Operating or assurance work to begin: Complete suitable audit engagements across the approved program.

Weeks 19–23

Primary implementation work: Correct current cases, analyse causes, implement corrective actions, and evaluate suitable early results.
Operating or assurance work to begin: Prepare management-review inputs from authoritative periods and populations.

Weeks 22–24

Primary implementation work: Conduct management review and transfer its decisions.
Operating or assurance work to begin: Confirm action ownership, resources, risk updates, and the next review triggers.

Weeks 23–26

Primary implementation work: If approved, make the certification-readiness decision and coordinate provider activity.
Operating or assurance work to begin: Preserve ordinary operation; never stage or backfill records for the audit.

Week 26 onward

Primary implementation work: Complete source applicability, handover, the final trace review, and stabilization.
Operating or assurance work to begin: Continue control cycles, audit, improvement, surveillance where relevant, and source monitoring.

Know when your ISO 27001 implementation is ready to move forward

Use these eleven gates in sponsor and owner reviews. Treat a gate as established only when its decision and current records can be shown. If a result is weak, return the work to the owning decision before dependent work continues.

Gate	Minimum established result	If this is weak, return to
G1 · Controlled start	Preserved release and working copy, mandate source, sponsor, implementation lead, and action tracker.	Toolkit control and implementation mandate.
G2 · Approved boundary	Current context, parties, obligations, service boundary, interfaces, scope statement, governance, and role authority.	Scope and governance work; repeat the boundary challenge.
G3 · Repeatable risk method	Approved criteria, defined assessment population, current sources, and named risk owners.	Risk-method design and population testing.
G4 · Governed treatment	Treatment outcomes and actions, necessary controls, Annex A comparison, current SoA, and a residual-risk route.	Treatment and SoA decisions.
G5 · Usable instructions	Adapted documents with testable criteria, ordinary and exception paths, document control, adoption, and change arrangements.	Instruction design and an operational walkthrough.
G6 · Maintained records	Authoritative-source map, stable identifiers, field definitions, access, retention, review, and reconciliation.	Register and source-governance work.
G7 · Observed operation	Priority processes have ordinary and difficult cases, owner review, retained evidence, and scheduled next cycles.	Run and review genuine operating cases.
G8 · Independent evaluation	Objectives and measures operate; evidence is controlled; audit program, engagements, findings, and follow-up are current.	Performance evaluation and internal audit.
G9 · Management response	Corrections and corrective actions are controlled, effectiveness is evaluated, and management review makes owned decisions.	Corrective action and management review.
G10 · External objective controlled	Certification purpose, scope, provider checks, readiness decision, coordination, findings, and claims are governed.	Certification lifecycle, where approved.
G11 · Living-system handover	Sector sources, owners, source watch, open conditions, next cycles, release, and licence routes are transferred.	Operational handover and the complete implementation trace.

G1 · Controlled start

Minimum established result: Preserved release and working copy, mandate source, sponsor, implementation lead, and action tracker.
If this is weak, return to: Toolkit control and implementation mandate.

G2 · Approved boundary

Minimum established result: Current context, parties, obligations, service boundary, interfaces, scope statement, governance, and role authority.
If this is weak, return to: Scope and governance work; repeat the boundary challenge.

G3 · Repeatable risk method

Minimum established result: Approved criteria, defined assessment population, current sources, and named risk owners.
If this is weak, return to: Risk-method design and population testing.

G4 · Governed treatment

Minimum established result: Treatment outcomes and actions, necessary controls, Annex A comparison, current SoA, and a residual-risk route.
If this is weak, return to: Treatment and SoA decisions.

G5 · Usable instructions

Minimum established result: Adapted documents with testable criteria, ordinary and exception paths, document control, adoption, and change arrangements.
If this is weak, return to: Instruction design and an operational walkthrough.

G6 · Maintained records

Minimum established result: Authoritative-source map, stable identifiers, field definitions, access, retention, review, and reconciliation.
If this is weak, return to: Register and source-governance work.

G7 · Observed operation

Minimum established result: Priority processes have ordinary and difficult cases, owner review, retained evidence, and scheduled next cycles.
If this is weak, return to: Run and review genuine operating cases.

G8 · Independent evaluation

Minimum established result: Objectives and measures operate; evidence is controlled; audit program, engagements, findings, and follow-up are current.
If this is weak, return to: Performance evaluation and internal audit.

G9 · Management response

Minimum established result: Corrections and corrective actions are controlled, effectiveness is evaluated, and management review makes owned decisions.
If this is weak, return to: Corrective action and management review.

G10 · External objective controlled

Minimum established result: Certification purpose, scope, provider checks, readiness decision, coordination, findings, and claims are governed.
If this is weak, return to: Certification lifecycle, where approved.

G11 · Living-system handover

Minimum established result: Sector sources, owners, source watch, open conditions, next cycles, release, and licence routes are transferred.
If this is weak, return to: Operational handover and the complete implementation trace.

Run a weekly decision meeting, not a percentage update

Keep one authoritative action row per active item. The meeting should resolve decisions and impediments instead of reconstructing status from slide decks.

Control field	What it lets the team decide
Intended result and completion condition	What closed means for this specific action.
Owner, authority, participants, and deputy	Who performs, approves, contributes, and preserves continuity.
Current state and source	What is known now and where another person can verify it.
Dependency and next observable event	What must happen first and when the result can next be observed.
Due date and reason	Which operating need or real commitment controls the timing.
Blocked decision or resource	What needs escalation rather than another progress report.
Risk created by delay	What exposure the schedule creates.
Interim control or restriction	How the organization operates before the final result exists.
Destination record and reviewer	Where closure is retained and who will challenge it.
Changed assumption	Which earlier decision and dependent work must be reopened.

Intended result and completion condition

What it lets the team decide: What closed means for this specific action.

Owner, authority, participants, and deputy

What it lets the team decide: Who performs, approves, contributes, and preserves continuity.

Current state and source

What it lets the team decide: What is known now and where another person can verify it.

Dependency and next observable event

What it lets the team decide: What must happen first and when the result can next be observed.

Due date and reason

What it lets the team decide: Which operating need or real commitment controls the timing.

Blocked decision or resource

What it lets the team decide: What needs escalation rather than another progress report.

Risk created by delay

What it lets the team decide: What exposure the schedule creates.

Interim control or restriction

What it lets the team decide: How the organization operates before the final result exists.

Destination record and reviewer

What it lets the team decide: Where closure is retained and who will challenge it.

Changed assumption

What it lets the team decide: Which earlier decision and dependent work must be reopened.

An approved procedure can close a document action. It does not prove adoption, operation, or effectiveness; those are separate states with later evidence.

If the external date cannot move

Show exactly what becomes thinner: the operating period, natural events, sample size, treatment delivery, audit coverage, corrective-action evaluation, management-review inputs, provider availability, or owner capacity. Ask the authorized decision-maker to accept or reject that resulting risk and to correct any unsupported external commitment.

Do not compress the plan by inventing history, backdating approvals, turning fictional examples into evidence, or reporting a planned benefit as current operation. Reschedule an external event when the available evidence cannot support it.

Recover a stalled or existing ISMS

Do not begin by rewriting every document. Establish a live baseline and repair the earliest unreliable dependency.

Preserve the current approved scope, risk method, SoA, instructions, audit reports, and management-review record.
Sample an ordinary case and a failed, late, escalated, or disputed case from several material processes.
Compare documented populations, roles, criteria, and evidence with current operation.
Identify the earliest weakness capable of changing later conclusions.
Repair source and authority records before derived dashboards or presentation packs.
Run the affected process again and evaluate the repair.
Expand the work according to risk, change, recurring failure, and audit coverage.

Apply this guidance to your business.

Turn the 26-week plan into owned work
The toolkit includes editable planning records, action trackers and governance files for assigning owners, approvals and due dates without starting from a blank folder. Request a free sample

View pricing · $99

Sources and limits

This chapter is ClausePass27001 implementation guidance. It does not reproduce the standard, decide conformity, or replace competent legal, technical, audit, or certification advice. Check the current authorized sources before relying on a version-sensitive point.

Read another implementation chapter

Open the manual overview