ISO 27001 Certification Guide: ISMS Implementation and Audit Preparation

┌─────────────────────────────────────────────────────────────────────┐
│                    ISO 27001:2022 Structure                         │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  ┌──────────────────────────────────────────────────────────────┐  │
│  │              ISMS Requirements (Clauses 4-10)                 │  │
│  │                    [MANDATORY]                                │  │
│  │                                                               │  │
│  │  4. Context    5. Leadership   6. Planning                   │  │
│  │  7. Support    8. Operation    9. Performance                │  │
│  │  10. Improvement                                             │  │
│  └──────────────────────────────────────────────────────────────┘  │
│                              │                                      │
│                              ▼                                      │
│  ┌──────────────────────────────────────────────────────────────┐  │
│  │              Annex A Controls (93 Controls)                   │  │
│  │              [SELECTED BASED ON RISK]                         │  │
│  │                                                               │  │
│  │  Organizational (37)    People (8)                           │  │
│  │  Physical (14)          Technological (34)                   │  │
│  └──────────────────────────────────────────────────────────────┘  │
│                              │                                      │
│                              ▼                                      │
│  ┌──────────────────────────────────────────────────────────────┐  │
│  │              ISO 27002:2022 Implementation Guidance           │  │
│  │                    [REFERENCE]                                │  │
│  └──────────────────────────────────────────────────────────────┘  │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────────┐
│              ISO 27001 Certification Timeline                        │
├─────────────────────────────────────────────────────────────────────┤
│                                                                      │
│  Month 1-2          Month 3-6           Month 7-9        Month 10+  │
│  ═════════         ═════════          ═════════        ═════════    │
│                                                                      │
│  ┌─────────┐      ┌─────────┐        ┌─────────┐      ┌─────────┐  │
│  │   GAP   │      │  ISMS   │        │ INTERNAL│      │  CERT   │  │
│  │ANALYSIS │─────▶│  BUILD  │───────▶│  AUDIT  │─────▶│  AUDIT  │  │
│  └─────────┘      └─────────┘        └─────────┘      └─────────┘  │
│       │                │                   │                │       │
│       ▼                ▼                   ▼                ▼       │
│  • Current state   • Policies         • Test ISMS      • Stage 1   │
│  • Risk assess     • Procedures       • Find gaps      • Stage 2   │
│  • Scope define    • Controls         • Mgmt review    • Certify   │
│  • Resource plan   • Training         • Corrective     • Maintain  │
│                                         actions                     │
│                                                                      │
└─────────────────────────────────────────────────────────────────────┘

// ISMS Scope Definition Template
interface ISMSScope {
  organization: {
    name: string;
    locations: Location[];
    departments: string[];
    headcount: number;
  };

  boundaries: {
    included: {
      businessProcesses: string[];
      informationTypes: string[];
      systems: string[];
      locations: string[];
      personnel: string[];
    };
    excluded: {
      items: string[];
      justifications: string[];
    };
  };

  interfaces: {
    thirdParties: ThirdParty[];
    dataFlows: DataFlow[];
    dependencies: Dependency[];
  };

  context: {
    internalFactors: string[];
    externalFactors: string[];
    interestedParties: InterestedParty[];
    requirements: Requirement[];
  };
}

interface InterestedParty {
  name: string;
  type: 'customer' | 'regulator' | 'supplier' | 'employee' | 'shareholder' | 'partner';
  securityRequirements: string[];
  expectations: string[];
}

// Gap Analysis Findings Tracker
interface GapAnalysisFinding {
  clause: string;  // e.g., "6.1.2 Information security risk assessment"
  control?: string;  // e.g., "A.5.1 Policies for information security"
  currentState: 'not_implemented' | 'partially_implemented' | 'implemented' | 'not_applicable';
  evidence: string;
  gap: string;
  effort: 'low' | 'medium' | 'high';
  priority: 1 | 2 | 3;
  recommendation: string;
  owner: string;
  targetDate: Date;
}

// Sample gap analysis function
function assessClauseCompliance(
  clause: string,
  requirements: string[],
  evidence: Evidence[]
): GapAnalysisFinding {
  const assessment = {
    clause,
    currentState: 'not_implemented' as const,
    evidence: '',
    gap: '',
    effort: 'medium' as const,
    priority: 2 as const,
    recommendation: '',
    owner: '',
    targetDate: new Date()
  };

  // Assess each requirement
  const implementedRequirements = requirements.filter(req =>
    evidence.some(e => e.satisfies.includes(req))
  );

  const coverage = implementedRequirements.length / requirements.length;

  if (coverage === 0) {
    assessment.currentState = 'not_implemented';
    assessment.priority = 1;
  } else if (coverage < 1) {
    assessment.currentState = 'partially_implemented';
    assessment.priority = 2;
  } else {
    assessment.currentState = 'implemented';
    assessment.priority = 3;
  }

  return assessment;
}

// Risk Assessment Framework
interface RiskAssessmentMethodology {
  approach: 'asset-based' | 'scenario-based' | 'hybrid';

  assetIdentification: {
    categories: AssetCategory[];
    valuationCriteria: ValuationCriteria;
  };

  threatIdentification: {
    sources: ThreatSource[];
    catalogue: ThreatCatalogue;
  };

  vulnerabilityIdentification: {
    assessmentMethods: string[];
    sources: string[];
  };

  riskCalculation: {
    formula: string;  // e.g., "Risk = Likelihood × Impact"
    likelihoodScale: Scale;
    impactScale: Scale;
    riskMatrix: RiskMatrix;
  };

  riskCriteria: {
    acceptableRiskLevel: number;
    treatmentThreshold: number;
  };
}

interface Scale {
  levels: ScaleLevel[];
  guidance: string;
}

interface ScaleLevel {
  value: number;
  label: string;
  description: string;
  examples: string[];
}

// Risk Assessment Implementation
const likelihoodScale: Scale = {
  levels: [
    { value: 1, label: 'Rare', description: 'May occur only in exceptional circumstances', examples: ['Once in 10+ years'] },
    { value: 2, label: 'Unlikely', description: 'Could occur but not expected', examples: ['Once in 5-10 years'] },
    { value: 3, label: 'Possible', description: 'Might occur at some time', examples: ['Once in 1-5 years'] },
    { value: 4, label: 'Likely', description: 'Will probably occur in most circumstances', examples: ['Once per year'] },
    { value: 5, label: 'Almost Certain', description: 'Expected to occur in most circumstances', examples: ['Multiple times per year'] }
  ],
  guidance: 'Consider historical incidents, threat intelligence, and industry benchmarks'
};

const impactScale: Scale = {
  levels: [
    { value: 1, label: 'Insignificant', description: 'Minimal impact on operations', examples: ['<$10K loss, no data breach'] },
    { value: 2, label: 'Minor', description: 'Minor impact requiring some effort to recover', examples: ['$10K-$100K, minor data exposure'] },
    { value: 3, label: 'Moderate', description: 'Significant impact on operations', examples: ['$100K-$500K, customer data affected'] },
    { value: 4, label: 'Major', description: 'Major impact affecting business viability', examples: ['$500K-$5M, regulatory action'] },
    { value: 5, label: 'Catastrophic', description: 'Severe impact threatening survival', examples: ['>$5M, criminal prosecution, business closure'] }
  ],
  guidance: 'Consider financial, operational, reputational, legal, and safety impacts'
};

// Risk Treatment Options
type TreatmentOption = 'avoid' | 'transfer' | 'mitigate' | 'accept';

interface RiskTreatment {
  riskId: string;
  treatment: TreatmentOption;
  controls: string[];  // Annex A control references
  residualRisk: number;
  owner: string;
  implementation: {
    actions: Action[];
    timeline: Date;
    resources: string[];
    budget: number;
  };
}

function selectTreatment(
  risk: AssessedRisk,
  riskAppetite: number,
  constraints: Constraints
): RiskTreatment {
  // Avoid: Change plans to eliminate risk
  if (risk.inherentRisk > riskAppetite * 2 && constraints.canAvoid) {
    return { ...risk, treatment: 'avoid', controls: [] };
  }

  // Transfer: Insurance, outsourcing
  if (risk.transferable && constraints.budgetForTransfer) {
    return { ...risk, treatment: 'transfer', controls: [] };
  }

  // Mitigate: Apply controls
  const applicableControls = selectApplicableControls(risk, constraints);
  const projectedResidual = calculateResidualRisk(risk, applicableControls);

  if (projectedResidual <= riskAppetite) {
    return { ...risk, treatment: 'mitigate', controls: applicableControls };
  }

  // Accept: Document and monitor
  if (risk.inherentRisk <= riskAppetite) {
    return { ...risk, treatment: 'accept', controls: [] };
  }

  // Multiple treatments may be needed
  return combineTreatments(risk, constraints);
}

┌─────────────────────────────────────────────────────────────────────┐
│              ISO 27001:2022 Annex A Control Themes                  │
├─────────────────────────────────────────────────────────────────────┤
│                                                                      │
│  ┌─────────────────────────────────────────────────────────────────┐│
│  │ A.5 ORGANIZATIONAL CONTROLS (37)                                ││
│  │                                                                  ││
│  │ A.5.1  Policies for information security                        ││
│  │ A.5.2  Information security roles and responsibilities          ││
│  │ A.5.3  Segregation of duties                                    ││
│  │ A.5.4  Management responsibilities                              ││
│  │ A.5.5  Contact with authorities                                 ││
│  │ A.5.6  Contact with special interest groups                     ││
│  │ A.5.7  Threat intelligence                         [NEW 2022]   ││
│  │ A.5.8  Information security in project management               ││
│  │ A.5.9  Inventory of information and other assets                ││
│  │ A.5.10 Acceptable use of information and assets                 ││
│  │ ...through A.5.37                                               ││
│  └─────────────────────────────────────────────────────────────────┘│
│                                                                      │
│  ┌─────────────────────────────────────────────────────────────────┐│
│  │ A.6 PEOPLE CONTROLS (8)                                         ││
│  │                                                                  ││
│  │ A.6.1  Screening                                                ││
│  │ A.6.2  Terms and conditions of employment                       ││
│  │ A.6.3  Information security awareness/training                  ││
│  │ A.6.4  Disciplinary process                                     ││
│  │ A.6.5  Responsibilities after termination                       ││
│  │ A.6.6  Confidentiality or non-disclosure agreements             ││
│  │ A.6.7  Remote working                              [NEW 2022]   ││
│  │ A.6.8  Information security event reporting                     ││
│  └─────────────────────────────────────────────────────────────────┘│
│                                                                      │
│  ┌─────────────────────────────────────────────────────────────────┐│
│  │ A.7 PHYSICAL CONTROLS (14)                                      ││
│  │                                                                  ││
│  │ A.7.1  Physical security perimeters                             ││
│  │ A.7.2  Physical entry                                           ││
│  │ A.7.3  Securing offices, rooms and facilities                   ││
│  │ A.7.4  Physical security monitoring                [NEW 2022]   ││
│  │ ...through A.7.14                                               ││
│  └─────────────────────────────────────────────────────────────────┘│
│                                                                      │
│  ┌─────────────────────────────────────────────────────────────────┐│
│  │ A.8 TECHNOLOGICAL CONTROLS (34)                                 ││
│  │                                                                  ││
│  │ A.8.1  User endpoint devices                                    ││
│  │ A.8.2  Privileged access rights                                 ││
│  │ A.8.3  Information access restriction                           ││
│  │ A.8.4  Access to source code                                    ││
│  │ A.8.5  Secure authentication                                    ││
│  │ A.8.6  Capacity management                                      ││
│  │ A.8.7  Protection against malware                               ││
│  │ A.8.8  Management of technical vulnerabilities                  ││
│  │ A.8.9  Configuration management                    [NEW 2022]   ││
│  │ A.8.10 Information deletion                        [NEW 2022]   ││
│  │ A.8.11 Data masking                                [NEW 2022]   ││
│  │ A.8.12 Data leakage prevention                     [NEW 2022]   ││
│  │ ...through A.8.34                                               ││
│  └─────────────────────────────────────────────────────────────────┘│
│                                                                      │
└─────────────────────────────────────────────────────────────────────┘

// Statement of Applicability Generator
interface SoAEntry {
  controlRef: string;
  controlTitle: string;
  theme: 'organizational' | 'people' | 'physical' | 'technological';
  applicable: boolean;
  justification: string;
  implementationStatus: 'implemented' | 'in_progress' | 'planned' | 'not_started';
  relatedRisks: string[];
  evidenceReferences: string[];
  implementationDetails: string;
  owner: string;
  lastReview: Date;
}

// Sample SoA entries
const soaEntries: SoAEntry[] = [
  {
    controlRef: 'A.5.1',
    controlTitle: 'Policies for information security',
    theme: 'organizational',
    applicable: true,
    justification: 'Required for governance framework and mandatory ISMS requirement',
    implementationStatus: 'implemented',
    relatedRisks: ['R001', 'R015', 'R042'],
    evidenceReferences: ['POL-001', 'POL-002', 'DOC-ISMS-001'],
    implementationDetails: 'Information Security Policy approved by board, reviewed annually, communicated to all staff via intranet and new hire onboarding',
    owner: 'CISO',
    lastReview: new Date('2026-01-01')
  },
  {
    controlRef: 'A.5.7',
    controlTitle: 'Threat intelligence',
    theme: 'organizational',
    applicable: true,
    justification: 'Required to identify and respond to emerging threats to our cloud infrastructure',
    implementationStatus: 'in_progress',
    relatedRisks: ['R008', 'R019', 'R027'],
    evidenceReferences: ['PRO-TI-001', 'TOOL-SIEM-001'],
    implementationDetails: 'Subscribed to industry threat feeds, integrated with SIEM. Threat analysis process documented. Weekly threat review meetings.',
    owner: 'Security Operations Manager',
    lastReview: new Date('2026-01-10')
  },
  {
    controlRef: 'A.7.4',
    controlTitle: 'Physical security monitoring',
    theme: 'physical',
    applicable: false,
    justification: 'Organization operates fully remote with cloud-only infrastructure. No physical facilities requiring monitoring.',
    implementationStatus: 'not_started',
    relatedRisks: [],
    evidenceReferences: ['DOC-SCOPE-001'],
    implementationDetails: 'N/A - Cloud-only organization with remote workforce',
    owner: 'N/A',
    lastReview: new Date('2026-01-01')
  },
  {
    controlRef: 'A.8.12',
    controlTitle: 'Data leakage prevention',
    theme: 'technological',
    applicable: true,
    justification: 'Required to protect customer PII and intellectual property from unauthorized exfiltration',
    implementationStatus: 'implemented',
    relatedRisks: ['R003', 'R011', 'R025'],
    evidenceReferences: ['TOOL-DLP-001', 'PRO-DLP-001', 'CONF-M365-DLP'],
    implementationDetails: 'Microsoft Purview DLP policies configured for PII patterns, endpoint DLP enabled on all corporate devices, email DLP rules active',
    owner: 'Security Engineering Lead',
    lastReview: new Date('2026-01-05')
  }
];

// Generate SoA summary statistics
function generateSoASummary(entries: SoAEntry[]): SoASummary {
  const applicable = entries.filter(e => e.applicable);
  const byStatus = applicable.reduce((acc, e) => {
    acc[e.implementationStatus] = (acc[e.implementationStatus] || 0) + 1;
    return acc;
  }, {} as Record<string, number>);

  const byTheme = entries.reduce((acc, e) => {
    if (!acc[e.theme]) acc[e.theme] = { total: 0, applicable: 0, implemented: 0 };
    acc[e.theme].total++;
    if (e.applicable) acc[e.theme].applicable++;
    if (e.implementationStatus === 'implemented') acc[e.theme].implemented++;
    return acc;
  }, {} as Record<string, ThemeStats>);

  return {
    totalControls: entries.length,
    applicableControls: applicable.length,
    excludedControls: entries.length - applicable.length,
    implementationProgress: byStatus,
    progressByTheme: byTheme,
    percentComplete: (byStatus['implemented'] / applicable.length) * 100
  };
}

┌─────────────────────────────────────────────────────────────────────┐
│              ISO 27001 Mandatory Documentation                       │
├─────────────────────────────────────────────────────────────────────┤
│                                                                      │
│  MANDATORY DOCUMENTS (Cannot exclude)                                │
│  ════════════════════════════════════                                │
│                                                                      │
│  ┌─────────────────────────────────────────────────────────────┐    │
│  │ Clause 4.3  │ Scope of the ISMS                             │    │
│  │ Clause 5.2  │ Information Security Policy                    │    │
│  │ Clause 6.1.2│ Risk assessment process                       │    │
│  │ Clause 6.1.3│ Risk treatment process                        │    │
│  │ Clause 6.1.3│ Statement of Applicability                    │    │
│  │ Clause 6.2  │ Information security objectives               │    │
│  │ Clause 7.2  │ Evidence of competence                        │    │
│  │ Clause 8.1  │ Operational planning and control              │    │
│  │ Clause 8.2  │ Risk assessment results                       │    │
│  │ Clause 8.3  │ Risk treatment results                        │    │
│  │ Clause 9.1  │ Monitoring and measurement results            │    │
│  │ Clause 9.2  │ Internal audit program and results            │    │
│  │ Clause 9.3  │ Management review results                     │    │
│  │ Clause 10.1 │ Nonconformities and corrective actions        │    │
│  └─────────────────────────────────────────────────────────────┘    │
│                                                                      │
│  COMMONLY NEEDED PROCEDURES (Based on Annex A controls)              │
│  ═══════════════════════════════════════════════════════             │
│                                                                      │
│  • Access control policy (A.5.15)                                    │
│  • Asset management procedures (A.5.9, A.5.10, A.5.11)              │
│  • Supplier security policy (A.5.19-A.5.22)                         │
│  • Incident management procedure (A.5.24-A.5.28)                    │
│  • Business continuity procedures (A.5.29, A.5.30)                  │
│  • Change management procedure (A.8.32)                             │
│  • Secure development policy (A.8.25-A.8.31)                        │
│  • Backup procedures (A.8.13)                                        │
│  • Key management procedures (A.8.24)                               │
│                                                                      │
└─────────────────────────────────────────────────────────────────────┘

// Document Management System
interface ISMSDocument {
  id: string;
  title: string;
  type: 'policy' | 'procedure' | 'guideline' | 'record' | 'form' | 'register';
  clause: string[];  // ISO 27001 clause references
  controls: string[];  // Annex A control references

  metadata: {
    version: string;
    status: 'draft' | 'review' | 'approved' | 'superseded' | 'retired';
    classification: 'public' | 'internal' | 'confidential' | 'restricted';
    owner: string;
    approver: string;
    effectiveDate: Date;
    nextReviewDate: Date;
  };

  history: DocumentVersion[];
}

interface DocumentVersion {
  version: string;
  date: Date;
  author: string;
  approver: string;
  changes: string;
}

// Document hierarchy structure
const documentHierarchy = {
  level1: {
    type: 'policy',
    description: 'High-level management intent and direction',
    approver: 'Board/Executive',
    reviewCycle: '12 months',
    examples: [
      'Information Security Policy',
      'Acceptable Use Policy',
      'Access Control Policy'
    ]
  },
  level2: {
    type: 'procedure',
    description: 'How to implement policies - who, what, when',
    approver: 'CISO/Security Manager',
    reviewCycle: '12 months',
    examples: [
      'Incident Response Procedure',
      'Change Management Procedure',
      'User Access Management Procedure'
    ]
  },
  level3: {
    type: 'guideline/standard',
    description: 'Detailed technical or operational guidance',
    approver: 'Process Owner',
    reviewCycle: '12 months',
    examples: [
      'Password Standard',
      'Secure Configuration Baseline',
      'Encryption Standard'
    ]
  },
  level4: {
    type: 'record/evidence',
    description: 'Proof of activities performed',
    approver: 'N/A (generated)',
    reviewCycle: 'Retention period',
    examples: [
      'Risk Assessment Reports',
      'Audit Logs',
      'Training Records',
      'Change Requests'
    ]
  }
};

// Internal Audit Planning
interface AuditProgram {
  period: string;  // e.g., "2026"
  objectives: string[];
  scope: string[];

  audits: PlannedAudit[];
  auditors: Auditor[];

  methodology: {
    approach: 'process-based' | 'clause-based' | 'risk-based';
    samplingApproach: string;
    evidenceRequirements: string[];
  };
}

interface PlannedAudit {
  id: string;
  title: string;
  scheduledDate: Date;
  clauses: string[];
  controls: string[];
  departments: string[];
  leadAuditor: string;
  auditTeam: string[];
  estimatedDuration: number;  // hours
  status: 'planned' | 'in_progress' | 'completed' | 'postponed';
}

interface AuditFinding {
  id: string;
  auditId: string;
  type: 'major_nonconformity' | 'minor_nonconformity' | 'observation' | 'opportunity';
  clause: string;
  control?: string;

  finding: {
    title: string;
    description: string;
    evidence: string[];
    requirement: string;
    gap: string;
  };

  correction: {
    immediateAction: string;
    dueDate: Date;
    owner: string;
    status: 'open' | 'in_progress' | 'implemented' | 'verified';
  };

  correctiveAction: {
    rootCause: string;
    preventiveAction: string;
    dueDate: Date;
    owner: string;
    status: 'open' | 'in_progress' | 'implemented' | 'verified';
    effectivenessVerification: string;
    verificationDate?: Date;
  };
}

// Audit execution checklist
const auditChecklist = {
  preparation: [
    'Review previous audit findings',
    'Review relevant documentation',
    'Prepare audit questions/checklist',
    'Confirm audit schedule with auditees',
    'Book meeting rooms/video calls',
    'Gather sampling lists'
  ],

  execution: [
    'Opening meeting - explain purpose and approach',
    'Interview process owners',
    'Review documented procedures',
    'Examine evidence and records',
    'Observe processes in action',
    'Test control effectiveness',
    'Document findings with evidence',
    'Closing meeting - present preliminary findings'
  ],

  reporting: [
    'Classify findings (NC major/minor, observation)',
    'Document root causes',
    'Agree corrective actions and timelines',
    'Issue formal audit report',
    'Track corrective action completion',
    'Verify effectiveness of corrections'
  ]
};

// Finding classification criteria
const findingClassification = {
  majorNonconformity: {
    criteria: [
      'Complete absence of a required process',
      'Total breakdown of a process',
      'Multiple minor NCs indicating systemic failure',
      'Situation presenting immediate significant risk',
      'Direct violation of legal/regulatory requirement'
    ],
    response: 'Must be addressed before certification/continued certification'
  },

  minorNonconformity: {
    criteria: [
      'Isolated lapse in following procedure',
      'Minor documentation gaps',
      'Single instance of non-compliance',
      'Control weakness not presenting immediate risk'
    ],
    response: 'Corrective action plan required, verified at next audit'
  },

  observation: {
    criteria: [
      'Potential for improvement',
      'Best practice not being followed',
      'Emerging risk not yet addressed',
      'Minor deviation that could escalate'
    ],
    response: 'Recommended action, not mandatory'
  }
};

// Management Review Meeting Structure
interface ManagementReview {
  date: Date;
  attendees: Attendee[];

  inputs: {
    // Required inputs per clause 9.3.2
    previousReviewActions: ActionStatus[];
    changesInExternalContext: string[];
    changesInInternalContext: string[];

    performanceInformation: {
      nonconformities: NonconformitySummary;
      monitoringResults: MetricResults[];
      auditResults: AuditSummary;
      objectivesProgress: ObjectiveStatus[];
      incidentTrends: IncidentSummary;
      riskTrends: RiskChanges;
    };

    stakeholderFeedback: Feedback[];
    riskAssessmentResults: RiskSummary;
    opportunitiesForImprovement: string[];
  };

  outputs: {
    // Required outputs per clause 9.3.3
    improvementDecisions: Decision[];
    resourceDecisions: ResourceAllocation[];
    policyChanges: PolicyChange[];
    objectiveChanges: ObjectiveChange[];
    actions: Action[];
  };

  nextReview: Date;
}

// Management review agenda template
const managementReviewAgenda = `
## ISMS Management Review Meeting

**Date:** [DATE]
**Attendees:** CEO, CISO, CTO, Legal, HR, Operations leads

### 1. Opening (5 min)
- Welcome and objectives
- Review of previous actions

### 2. Context Changes (10 min)
- External: Regulatory changes, threat landscape, market conditions
- Internal: Organizational changes, new systems, personnel changes

### 3. Performance Review (30 min)
- Security metrics dashboard
- Incident summary and trends
- Audit findings status
- Risk assessment changes
- Objective achievement status

### 4. Resource Review (10 min)
- Current resource allocation
- Budget status
- Training and competence gaps
- Tool and technology needs

### 5. Improvement Opportunities (15 min)
- Corrective action effectiveness
- Process improvement proposals
- Control enhancement recommendations

### 6. Decisions and Actions (15 min)
- Policy updates needed
- Resource allocation decisions
- New objectives or targets
- Assign actions with owners and deadlines

### 7. Close (5 min)
- Summarize decisions
- Confirm next review date
`;

┌─────────────────────────────────────────────────────────────────────┐
│              ISO 27001 Certification Audit Process                   │
├─────────────────────────────────────────────────────────────────────┤
│                                                                      │
│  STAGE 1: Documentation Review                                       │
│  ═══════════════════════════════                                     │
│  Duration: 1-2 days (typically off-site or hybrid)                  │
│                                                                      │
│  ┌─────────────────────────────────────────────────────────────┐    │
│  │ Auditor reviews:                                             │    │
│  │ • ISMS scope and context documentation                       │    │
│  │ • Information security policy                                │    │
│  │ • Risk assessment methodology and results                    │    │
│  │ • Statement of Applicability                                 │    │
│  │ • Internal audit program and results                         │    │
│  │ • Management review records                                  │    │
│  │                                                              │    │
│  │ Outcomes:                                                    │    │
│  │ • Confirm scope is appropriate                               │    │
│  │ • Identify any documentation gaps                            │    │
│  │ • Plan Stage 2 audit                                         │    │
│  │ • Determine if ready to proceed                              │    │
│  └─────────────────────────────────────────────────────────────┘    │
│                         │                                            │
│                         ▼                                            │
│            ┌─────────────────────────┐                              │
│            │  Gap Resolution Period  │ (typically 2-4 weeks)        │
│            │  Address Stage 1 issues │                              │
│            └─────────────────────────┘                              │
│                         │                                            │
│                         ▼                                            │
│  STAGE 2: Implementation Verification                                │
│  ════════════════════════════════════                                │
│  Duration: 3-10 days (on-site or hybrid depending on scope)         │
│                                                                      │
│  ┌─────────────────────────────────────────────────────────────┐    │
│  │ Auditor assesses:                                            │    │
│  │ • Control implementation effectiveness                       │    │
│  │ • Staff interviews across departments                        │    │
│  │ • Evidence review (logs, records, configurations)            │    │
│  │ • Technical control verification                             │    │
│  │ • Process observation                                        │    │
│  │                                                              │    │
│  │ Outcomes:                                                    │    │
│  │ • Audit report with findings                                 │    │
│  │ • Classification of nonconformities                          │    │
│  │ • Certification recommendation                               │    │
│  └─────────────────────────────────────────────────────────────┘    │
│                         │                                            │
│                         ▼                                            │
│  ┌─────────────────────────────────────────────────────────────┐    │
│  │ If MAJOR NCs found:        │ If no MAJOR NCs:               │    │
│  │ • Corrective action plan   │ • Certificate issued           │    │
│  │ • Follow-up audit          │ • 3-year certification cycle   │    │
│  │ • Re-assessment            │ • Annual surveillance audits   │    │
│  └─────────────────────────────────────────────────────────────┘    │
│                                                                      │
└─────────────────────────────────────────────────────────────────────┘

// Audit Preparation Checklist
const auditDayPreparation = {
  documentation: [
    'Organize all ISMS documentation in accessible location',
    'Prepare evidence files for each Annex A control',
    'Print/prepare SoA with implementation evidence references',
    'Have risk register and treatment plan readily available',
    'Prepare internal audit reports and corrective action logs',
    'Have management review minutes accessible'
  ],

  logistics: [
    'Book appropriate meeting rooms with A/V equipment',
    'Arrange escorts for auditors',
    'Prepare attendee schedule (who is available when)',
    'Notify all departments of audit schedule',
    'Arrange meals/refreshments if applicable',
    'Test video conferencing if hybrid audit'
  ],

  personnel: [
    'Brief interviewees on audit process (not coached answers)',
    'Ensure key personnel are available',
    'CISO/ISMS manager available throughout',
    'Technical staff available for control demonstrations',
    'Designate note-taker for each session'
  ],

  systems: [
    'Ensure auditor accounts/access prepared if needed',
    'Have evidence systems accessible (SIEM, ticketing, etc.)',
    'Prepare screenshots/exports as backup',
    'Test any demo environments'
  ]
};

// Common audit questions by clause
const typicalAuditQuestions = {
  clause4: [
    'How did you determine the scope of your ISMS?',
    'What external and internal issues affect your ISMS?',
    'Who are your interested parties and what are their requirements?'
  ],

  clause5: [
    'How does top management demonstrate commitment to the ISMS?',
    'How is the information security policy communicated?',
    'How are information security responsibilities assigned?'
  ],

  clause6: [
    'Walk me through your risk assessment methodology.',
    'How do you determine risk acceptance criteria?',
    'How do you decide which controls to implement?'
  ],

  clause7: [
    'How do you ensure staff are competent to perform security roles?',
    'What security awareness training is provided?',
    'How do you manage ISMS documentation?'
  ],

  clause8: [
    'How do you ensure operational processes are controlled?',
    'Show me evidence of recent risk assessment updates.',
    'How do you manage changes to the ISMS?'
  ],

  clause9: [
    'What security metrics do you track?',
    'Walk me through your internal audit process.',
    'Show me your most recent management review.'
  ],

  clause10: [
    'How do you handle nonconformities?',
    'Show me examples of corrective actions taken.',
    'How do you identify opportunities for improvement?'
  ]
};

// ISMS Maintenance Calendar
interface MaintenanceCalendar {
  monthly: Task[];
  quarterly: Task[];
  annually: Task[];
  asNeeded: Task[];
}

const maintenanceCalendar: MaintenanceCalendar = {
  monthly: [
    {
      task: 'Security metrics review',
      owner: 'Security Operations',
      description: 'Review KPIs, incident trends, vulnerability status'
    },
    {
      task: 'Access review sampling',
      owner: 'IT Operations',
      description: 'Review subset of user access rights'
    },
    {
      task: 'Threat intelligence update',
      owner: 'Security Operations',
      description: 'Review threat feeds, update controls if needed'
    }
  ],

  quarterly: [
    {
      task: 'Risk register review',
      owner: 'CISO',
      description: 'Review and update risk assessments, treatment status'
    },
    {
      task: 'Policy compliance check',
      owner: 'Compliance',
      description: 'Sample audit of policy compliance across departments'
    },
    {
      task: 'Supplier security review',
      owner: 'Vendor Management',
      description: 'Review critical supplier security posture'
    },
    {
      task: 'Security awareness metrics',
      owner: 'HR/Security',
      description: 'Review training completion, phishing simulation results'
    }
  ],

  annually: [
    {
      task: 'Full risk assessment',
      owner: 'CISO',
      description: 'Comprehensive reassessment of all information risks'
    },
    {
      task: 'Policy review cycle',
      owner: 'Policy Owners',
      description: 'Review and update all ISMS policies'
    },
    {
      task: 'Internal audit program',
      owner: 'Internal Audit',
      description: 'Execute full internal audit covering all clauses'
    },
    {
      task: 'Management review',
      owner: 'CISO',
      description: 'Annual ISMS management review meeting'
    },
    {
      task: 'SoA review',
      owner: 'CISO',
      description: 'Review Statement of Applicability for changes'
    },
    {
      task: 'Business continuity test',
      owner: 'Operations',
      description: 'Test disaster recovery and continuity plans'
    },
    {
      task: 'Surveillance audit preparation',
      owner: 'Compliance',
      description: 'Prepare for certification body surveillance visit'
    }
  ],

  asNeeded: [
    {
      task: 'Incident response',
      owner: 'Security Operations',
      description: 'Respond to security incidents per procedure'
    },
    {
      task: 'Change impact assessment',
      owner: 'Change Manager',
      description: 'Assess ISMS impact of significant changes'
    },
    {
      task: 'Corrective actions',
      owner: 'Process Owners',
      description: 'Address nonconformities when identified'
    },
    {
      task: 'New asset classification',
      owner: 'Asset Owner',
      description: 'Classify and add new information assets to register'
    }
  ]
};

// Continual Improvement Framework
interface ImprovementOpportunity {
  id: string;
  source: 'audit' | 'incident' | 'metric' | 'feedback' | 'management_review' | 'external';
  description: string;
  expectedBenefit: string;
  effort: 'low' | 'medium' | 'high';
  priority: 'critical' | 'high' | 'medium' | 'low';
  status: 'identified' | 'evaluated' | 'approved' | 'implementing' | 'completed' | 'deferred';
  owner: string;
  targetDate?: Date;
  actualBenefit?: string;
}

// Improvement tracking
function trackImprovement(
  opportunity: ImprovementOpportunity
): ImprovementMetrics {
  return {
    timeToImplement: calculateDuration(opportunity),
    benefitRealized: assessBenefit(opportunity),
    lessonsLearned: captureLessons(opportunity),
    replicability: assessReplicability(opportunity)
  };
}

// Certification Body Evaluation Criteria
interface CertificationBodyEvaluation {
  body: string;

  accreditation: {
    accreditationBody: string;  // e.g., UKAS, ANAB, DAkkS
    scope: string[];
    valid: boolean;
  };

  experience: {
    yearsInBusiness: number;
    iso27001Certifications: number;
    industryExperience: string[];
  };

  auditorQuality: {
    qualifications: string[];
    industryKnowledge: boolean;
    languageCapabilities: string[];
  };

  commercials: {
    stage1Cost: number;
    stage2Cost: number;
    surveillanceCost: number;
    recertificationCost: number;
    dayRate: number;
    travelPolicy: string;
  };

  logistics: {
    leadTime: number;  // weeks
    auditorAvailability: string;
    remoteAuditCapability: boolean;
    multiSiteExperience: boolean;
  };

  reputation: {
    references: string[];
    marketRecognition: 'high' | 'medium' | 'low';
    complaints: number;
  };
}

// Major accredited certification bodies
const certificationBodies = [
  { name: 'BSI', accreditation: 'UKAS', strength: 'Global recognition, extensive experience' },
  { name: 'Bureau Veritas', accreditation: 'UKAS/ANAB', strength: 'Multi-standard expertise' },
  { name: 'DNV', accreditation: 'Multiple', strength: 'Technical depth, industry focus' },
  { name: 'SGS', accreditation: 'Multiple', strength: 'Global presence' },
  { name: 'TÜV SÜD', accreditation: 'DAkkS', strength: 'German market, engineering focus' },
  { name: 'Schellman', accreditation: 'ANAB', strength: 'Tech sector, SOC 2 combo' },
  { name: 'A-LIGN', accreditation: 'ANAB', strength: 'Multi-framework, US tech sector' }
];