One page per clause
The duty in our words, the evidence a board or an auditor asks for, the common gaps and what to do before publication.
Open the registerA ten-week path to a governance record a board can use
The plan below is the order the guidance expects. It is a default, not a promise: a small entity can compress it and a group will extend it. The dates are relative to your start, and the planning date of 15 February 2027 is an estimate for the edition, not a deadline for you.
The page adds the calendar dates for week 1 and week 10. With JavaScript off, the relative labels still work.
| When | Clause | What is produced | Owner |
|---|---|---|---|
| Week 1 | Clauses 1, 3 and 6.1 | Scope note, role map with the governing body and top management, separation arrangement | Board secretary |
| Week 1 | Clause 8.2 | Annex B type for each ISMS, membership map, objectives alignment | Group governance lead |
| Week 2 | Clause 7.2.1 | Entity-wide accountability map, external party schedule, physical and logical coordination note | CISO |
| Week 2 to 3 | Clause 7.2.2 | Risk appetite with thresholds, five mapped risks, resource decisions | Risk lead |
| Week 3 | Clause 7.2.3 | Security gates in investment, procurement, merger, technology and outsourcing | Procurement lead |
| Week 4 | Clause 7.2.4 | Requirements register, assurance plan, independent audit scope | Compliance lead |
| Week 4 to 5 | Clauses 7.2.5 and 7.2.6 | Role descriptions, culture measures, agreed level of security, measurement programme | People lead |
| Week 5 to 6 | Clauses 7.3.2 and 7.3.3 | Evaluate and direct slots on the board calendar, strategy and appetite approvals | Board secretary |
| Week 6 to 7 | Clauses 7.3.4 and 7.3.5 | Effectiveness report, alert route, communication plan by audience, incident template | CISO |
| Week 8 | Clause 8.1 | Charter for each ISMS, both scopes, risk process decision, residual risk authority | Group governance lead |
| Week 9 | Clause 6.2 | Two-way matrix of ISO/IEC 27001 clauses 4 to 10 against the six objectives | ISMS manager |
| Week 10 | Clauses 7.3 and 8.2 | First full cycle rehearsal, board pack, gaps closed or dated | CISO |
| At publication | ISO record | Compare the edition 3 text with the record, update the citation, review the policy | Compliance lead |
Print this page for the project wall. The paid kit carries the same plan with an editable date, an owner column and a status column per line.
The role map and the Annex B type come first because every later step depends on who is accountable to whom. The accountability map comes before the risk appetite because the appetite needs an owner. The objectives come before the process cycle because the processes exist to achieve them. The ISMS charter comes after the entity work because the charter records decisions the entity has already taken. A plan that starts with a policy will produce a document, not a governance record.
THE RULES THIS IS BUILT FROM
Read from the real rules, not invented
Every clause answer on this site points to the official rule behind it, so you can check any line yourself. The register holds 28 records, 110 evidence lines and 84 common failure lines. The dates come from the ISO record. The substance comes from the published 2020 edition, which is the baseline that edition 3 replaces.
25 CLAUSES
3 ANNEXES
Guidance, clearly labelled
Annexes A to C are informative. Each page says so, because a finding cannot rest on guidance alone.
Open the annexesONE STAGE RECORD
No invented date
Stage 50.60 is recorded on 12 August 2026. The planning date is an estimate and is labelled wherever it appears.
Read the recordThe edition 3 text is not public and is not reproduced. Each record cites the published clause it comes from. Where the public record is silent, the page says so.