Clause 9 is the weakest area at 30 of 100, and carries the heaviest weight. The audit programme, the 90-item checklist, the metrics, and the management review pack all exist and are ready to use. None has been executed: zero audits conducted, zero management reviews held. Every other gap in this portfolio is a matter of work remaining; this one is a matter of two decisions being taken.
| Slot | Delivered project | Doc ID | PDCA | Brief expected | Reconciliation |
|---|---|---|---|---|---|
| 01 | ISMS Scope Definition | SBT-SCP-01 | Plan | ISMS Context and Scope | Delivered — the scope half of the brief's slot 01 |
| 02 | Context of the Organization | SBT-CTX-01 | Plan | Asset Inventory and Classification | Delivered as CONTEXT, not asset inventory |
| 03 | Risk Assessment | SBT-RSK-01 | Plan | Risk Assessment and Risk Treatment | Delivered — matches |
| 04 | Statement of Applicability | SBT-SOA-01 | Plan | Statement of Applicability | Delivered — matches |
| 05 | Information Security Policy Pack | SBT-POL-00 | Do | Policies and Security Controls | Delivered — matches |
| 06 | Internal Audit | SBT-AUD-01 | Check | Internal Audit | Delivered — matches |
| 07 | Certification Readiness Evidence Map | SBT-EVM-01 | Check | Supplier and Third-Party Risk | Delivered as the READINESS map — brief's slot 10 |
| 08 | Supplier Risk Review | SBT-SUP-01 | Do | Incident Management | Delivered as SUPPLIER RISK — brief's slot 07 |
| 09 | Security Awareness Metrics Dashboard | SBT-AWR-01 | Check | Management Review | Delivered as AWARENESS METRICS — not in the brief's list |
| 10 | CAPA Register and Continual Improvement Log | SBT-CAP-01 | Act | Certification Readiness | Delivered as CAPA — not in the brief's list |
| § | Deliverable | Provenance | Source | Why, where it is not consolidated |
|---|---|---|---|---|
| A | Executive Summary | Consolidated | All ten delivered projects | — |
| B | Integrated ISMS Overview | Consolidated | SBT-CTX-00, SBT-CTX-01, SBT-SCP-01 | — |
| C | Master Asset and Information View | Demonstration | No source project | No asset inventory or classification project was ever commissioned. This view is assembled from the asset descriptions embedded in the risk register and the systems named in the scope statement. It is a DEMONSTRATION of the view's structure and is not an asset inventory. |
| D | Master Risk and Risk Treatment View | Consolidated | SBT-RSK-01 | — |
| E | Master Statement of Applicability | Consolidated | SBT-SOA-01 | — |
| F | Master Policy and Control Framework | Consolidated | SBT-POL-00, SBT-SOA-01 | — |
| G | Integrated Evidence Register | Consolidated | SBT-EVM-01 and the ten project evidence indexes | — |
| H | Internal Audit Summary | Consolidated | SBT-AUD-01, SBT-CAP-01 | — |
| I | Supplier and Third-Party Risk Summary | Consolidated | SBT-SUP-01 | — |
| J | Incident Management Summary | Demonstration | No source project | No incident management project was commissioned and NO SECURITY INCIDENT HAS OCCURRED OR IS CLAIMED. The process description derives from SBT-POL-03, which is itself an unapproved draft. The incident record table is empty by design. |
| K | Management Review Pack | Demonstration | No management review has been held | The INPUTS are consolidated and real. The pack itself is a DEMONSTRATION: the portfolio records zero management reviews held, so no decision, minute, or output in this pack has been taken by management. |
| L | Certification Readiness Assessment | Consolidated | SBT-EVM-01, SBT-SOA-01, SBT-AUD-01, SBT-CAP-01 | — |
| M | Integrated Traceability Matrix | Consolidated | All ten delivered projects | — |
| Risk | Title | Asset | L | I | Inherent | Treatment | Owner | Residual |
|---|---|---|---|---|---|---|---|---|
| RSK-001 | Unauthorized access to customer security reports | Customer VAPT reports and vulnerability findings held in… | 4 | 5 | 20 Critical | Reduce / Modify | IT & Infrastructure Manager | 10 High |
| RSK-002 | Ransomware affecting company systems | Company-managed laptops, shared business data, and… | 3 | 5 | 15 High | Reduce / Modify | IT & Infrastructure Manager | 8 Medium |
| RSK-003 | Cloud storage misconfiguration | Customer reports and other customer information stored in… | 3 | 4 | 12 High | Reduce / Modify | Cloud Practice Lead | 8 Medium |
| RSK-004 | Leakage of customer credentials during VAPT | Customer credentials and access details supplied to… | 3 | 5 | 15 High | Reduce / Modify | Head of Delivery | 8 Medium |
| RSK-005 | Unavailability of the security monitoring platform | Managed security monitoring service and the security… | 2 | 4 | 8 Medium | Reduce / Modify | Head of Delivery | 6 Medium |
| RSK-006 | Phishing attack against employees | Microsoft 365 accounts, mailboxes, and the corporate… | 4 | 3 | 12 High | Reduce / Modify | ISMS Manager | 9 Medium |
| RSK-007 | Inadequate vulnerability management of the organization's own estate | Company systems and the platforms supporting… | 3 | 4 | 12 High | Reduce / Modify | IT & Infrastructure Manager | 8 Medium |
| RSK-008 | Loss of a key cybersecurity employee | Specialist knowledge and service delivery capability,… | 4 | 3 | 12 High | Reduce / Modify | Human Resources Manager, supported by the Chief Technology Officer | 8 Medium |
| RSK-009 | Third-party supplier security failure | Customer and employee information shared with, or… | 3 | 4 | 12 High | Share / Transfer | Finance & Procurement Lead, supported by the ISMS Manager | 9 Medium |
| RSK-010 | Loss of availability of customer reports | Customer deliverables and business records held in the… | 2 | 2 | 4 Low | Retain / Accept | IT & Infrastructure Manager | 4 Low |
| Control | Title | Theme | Applicable | Status | Owner | Related risks |
|---|---|---|---|---|---|---|
| A.5.1 | Policies for information security | Organizational | Yes | Planned | ISMS Manager | RSK-001, RSK-002, RSK-004, RSK-006, RSK-007, RSK-008 |
| A.5.15 | Access control | Organizational | Yes | Partially implemented | IT & Infrastructure Manager | RSK-001, RSK-004 |
| A.5.17 | Authentication information | Organizational | Yes | Partially implemented | IT & Infrastructure Manager, supported by the Head of Delivery for customer-supplied credentials | RSK-001, RSK-004, RSK-006 |
| A.5.18 | Access rights | Organizational | Yes | Planned | IT & Infrastructure Manager | RSK-001, RSK-008 |
| A.5.19 | Information security in supplier relationships | Organizational | Yes | Planned | Finance & Procurement Lead, supported by the ISMS Manager | RSK-009 |
| A.5.23 | Information security for use of cloud services | Organizational | Yes | Partially implemented | Cloud Practice Lead | RSK-003, RSK-005 |
| A.6.3 | Information security awareness, education and training | People | Yes | Partially implemented | ISMS Manager, supported by the Human Resources Manager | RSK-002, RSK-006 |
| A.6.5 | Responsibilities after termination or change of employment | People | Yes | Not implemented | Human Resources Manager | RSK-008, RSK-001 |
| A.7.1 | Physical security perimeters | Physical | Yes | Implemented | IT & Infrastructure Manager | RSK-001 |
| A.8.8 | Management of technical vulnerabilities | Technological | Yes | Partially implemented | IT & Infrastructure Manager | RSK-002, RSK-007 |
| A.8.13 | Information backup | Technological | Yes | Partially implemented | IT & Infrastructure Manager | RSK-002, RSK-010 |
| A.8.16 | Monitoring activities | Technological | Yes | Partially implemented | IT & Infrastructure Manager, supported by the Head of Delivery | RSK-001, RSK-002, RSK-005 |
| A.8.30 | Outsourced development | Technological | No | Not applicable | Chief Technology Officer | None — the activity the control governs does not occur |
| Ref | Clause | Grade | Finding | Owner | Target |
|---|---|---|---|---|---|
| SF-01 | 6.1.2 | Major nonconformity | The organization has not established a documented risk assessment methodology. Risk assessments are performed… | ISMS Manager | 30-Nov-2026 |
| SF-02 | 8.1 | Minor nonconformity | One of four access review records lacks documented approval by the relevant system owner, so completion of… | IT & Infrastructure Manager | 31-Oct-2026 |
| SF-03 | 7.4 | Observation | The incident reporting procedure is documented, but awareness of the correct reporting channel is… | ISMS Manager | 30-Nov-2026 |
| SF-04 | 9.1 | Opportunity for improvement | Monitoring and measurement are performed and reported as required. Reporting presents point-in-time values… | ISMS Manager | 31-Dec-2026 |
| SF-05 | 7.5 | Minor nonconformity | A superseded version of the acceptable use policy remains accessible alongside the current version, without… | ISMS Manager | 31-Oct-2026 |
| SF-06 | 10.1 | Observation | Restoration testing is performed and recorded, but lessons learned are not consistently captured, so… | IT & Infrastructure Manager | 30-Nov-2026 |
| SF-07 | 8.3 | Minor or major — depends on evidence | Two High-risk treatment actions are overdue. Neither has been escalated to management nor formally accepted… | ISMS Manager | 31-Oct-2026 |
| SF-08 | 4.2 | Minor nonconformity | Applicable legal and regulatory requirements have not been determined. The gap is recorded but carries no… | Legal & Compliance Advisor | 30-Nov-2026 |
| SF-09 | 6.1.3 | Major nonconformity | The Statement of Applicability is incomplete. Comparison against Annex A has not been performed for 80 of the… | ISMS Manager | 31-Dec-2026 |
| ID | Issue | Priority | Status | Owner | Target | Late |
|---|---|---|---|---|---|---|
| CAPA-001 | Missing approved risk assessment methodology | High | Pending effectiveness verification | ISMS Manager | 30-Nov-2026 | — |
| CAPA-002 | Access review missing approval evidence | Medium | Closed | IT & Infrastructure Manager | 31-Oct-2026 | — |
| CAPA-003 | Overdue high-risk treatment action without extension or acceptance | High | Overdue | Risk owner (Head of Delivery for this action) | 24-Oct-2026 | 37d |
| CAPA-004 | Employees unclear about the incident reporting channel | Medium | Action in progress | Head of Delivery | 31-Dec-2026 | — |
| CAPA-005 | Periodic reassessment of a high-risk supplier is overdue | High | Overdue | Supplier Relationship Manager (performed by the Finance & Procurement Lead) | 15-Nov-2026 | 15d |
| CAPA-006 | Backup recovery test evidence incomplete | Medium | Pending evidence | IT & Infrastructure Manager | 15-Dec-2026 | — |
| CAPA-007 | Repeated phishing simulation clicks by a small persistent group | Medium | Action in progress | ISMS Manager | 31-Jan-2027 | — |
| CAPA-008 | Security metric trends not consistently reported | Low | Action planned | ISMS Manager | 31-Jan-2027 | — |
| Project | Doc ID | Evidence range | Items | Covers |
|---|---|---|---|---|
| 01 | SBT-SCP-01 | EV-001 – EV-008 | 8 | Scope approval, boundary register, exclusion justification |
| 02 | SBT-CTX-01 | EV-009 – EV-020 | 12 | Issue determination, interested parties, needs analysis |
| 03 | SBT-RSK-01 | EV-021 – EV-030 | 10 | Risk method, register, treatment plan, acceptance records |
| 04 | SBT-SOA-01 | EV-031 – EV-038 | 8 | Applicability decisions, control evidence schedule |
| 05 | SBT-POL-00 | EV-039 – EV-041 | 3 | Policy pack, approval records, acknowledgement register |
| 06 | SBT-AUD-01 | EV-042 – EV-052 | 11 | Audit programme, checklist, findings, corrective actions |
| 07 | SBT-EVM-01 | EV-053 – EV-060 | 8 | Evidence map, collection plan, readiness checklist |
| 08 | SBT-SUP-01 | EV-061 – EV-071 | 11 | Supplier register, requirements schedule, due diligence |
| 09 | SBT-AWR-01 | EV-072 – EV-085 | 14 | Awareness metrics, measurement definitions, simulation results |
| 10 | SBT-CAP-01 | EV-086 – EV-099 | 14 | CAPA register, closure record, effectiveness verification |
No asset inventory project and no incident management project were ever commissioned. The asset view below is assembled from asset descriptions already embedded in the risk register and the systems named in the scope statement — it demonstrates the structure of the view and is not an asset inventory. The incident view describes a process derived from SBT-POL-03, which is itself an unapproved draft; no security incident has occurred or is claimed, and the incident record table is empty by design. The supplier view is fully consolidated from SBT-SUP-01.
| ID | Asset | Type | Asset owner | Classification | Criticality | Related risks | Related controls |
|---|---|---|---|---|---|---|---|
| AST-D01 | Customer VAPT reports and vulnerability findings | Information | Head of Delivery | Highly confidential / restricted | Critical | RSK-001, RSK-004 | A.5.15, A.5.17, A.5.18, A.8.16 |
| AST-D02 | Customer-supplied credentials and testing secrets | Information | Head of Delivery | Highly confidential / restricted | Critical | RSK-004 | A.5.17, A.8.24 |
| AST-D03 | Security monitoring platform and customer telemetry | System | Head of Delivery | Highly confidential / restricted | Critical | RSK-005 | A.8.16, A.5.23 |
| AST-D04 | Cloud hosting environments — AWS and Azure | System | Cloud Practice Lead | Confidential | Critical | RSK-003, RSK-005 | A.5.23, A.8.9 |
| AST-D05 | Company-managed laptops | Endpoint | IT & Infrastructure Manager | Confidential | Important | RSK-002, RSK-006 | A.8.1, A.8.7, A.6.7 |
| AST-D06 | Identity and access management | System | IT & Infrastructure Manager | Highly confidential / restricted | Critical | RSK-001, RSK-006 | A.5.15–A.5.18 |
| AST-D07 | Backup and recovery repositories | System | IT & Infrastructure Manager | Confidential | Critical | RSK-002, RSK-010 | A.8.13 |
| AST-D08 | Contracts, customer records, and commercial information | Information | Finance & Procurement Lead | Confidential | Important | RSK-009 | A.5.19–A.5.22, A.5.31 |
| AST-D09 | Employee records | Information | Human Resources Manager | Confidential | Important | RSK-008 | A.6.1, A.5.34 |
| AST-D10 | ISMS documentation and evidence | Information | ISMS Manager | Internal | Important | RSK-007 | A.5.1, A.5.37 |
| ID | Supplier | Inherent | Residual | Data sensitivity | Owner | Review |
|---|---|---|---|---|---|---|
| SUP-001 | CloudHarbor Infrastructure Services | 19 Critical | 16 High | Highly confidential / restricted | Cloud Practice Lead | Level 4 |
| SUP-002 | SentinelDesk Managed Support | 14 High | 12 Medium | Confidential | IT & Infrastructure Manager | Level 3 |
| SUP-003 | ReportVault Secure Storage | 18 Critical | 15 High | Highly confidential / restricted | Head of Delivery | Level 4 |
| SUP-004 | SignalWatch Monitoring Solutions | 18 Critical | 17 Critical | Highly confidential / restricted | Head of Delivery | Level 4 |
| SUP-005 | TalentBridge Staffing Services | 9 Medium | 9 Medium | Confidential | Human Resources Manager | Level 2 |
| SUP-006 | OfficeLink Facilities Management | 7 Low | 7 Low | Internal | Finance & Procurement Lead | Level 1 |
| ID | Category | Owner | Related risk | Related controls |
|---|---|---|---|---|
| INC-C1 | Phishing or social engineering against employees | Head of Delivery | RSK-006 | A.5.24, A.6.8, A.6.3 |
| INC-C2 | Unauthorized access to customer reports or credentials | Head of Delivery | RSK-001, RSK-004 | A.5.15–A.5.18 |
| INC-C3 | Malware or ransomware affecting company systems | IT & Infrastructure Manager | RSK-002 | A.8.7, A.8.13 |
| INC-C4 | Cloud misconfiguration or exposure | Cloud Practice Lead | RSK-003 | A.5.23, A.8.9 |
| INC-C5 | Availability loss of the monitoring platform | Head of Delivery | RSK-005 | A.8.16, A.8.14 |
| INC-C6 | Supplier or third-party security failure | Finance & Procurement Lead | RSK-009 | A.5.19–A.5.22 |
| INC-C7 | Loss or theft of a company-managed endpoint | IT & Infrastructure Manager | RSK-002 | A.7.9, A.8.1 |
| INC-C8 | Accidental disclosure of customer information | Head of Delivery | RSK-001 | A.5.13, A.8.12 |
| Ref | Severity | Area | Why it matters | Required action | Owner | Impact |
|---|---|---|---|---|---|---|
| CR-01 | Critical | Annex A coverage | 80 of 93 controls have no applicability decision. A certification body cannot assess a Statement of Applicability that omits 86% of the annex. | Complete the applicability assessment for all 93 controls | ISMS Manager | Blocking |
| CR-02 | Critical | Internal audit not conducted | Clause 9.2 requires internal audits at planned intervals. The programme exists; no audit has been performed, so there is no audit result to present. | Conduct the first full internal audit against the prepared programme | Internal Auditor | Blocking |
| CR-03 | Critical | Management review not held | Clause 9.3 requires management review at planned intervals. None has been held, so Clause 9.3 has no record whatsoever. | Hold the first management review using the pack in Section K | Managing Director | Blocking |
| CR-04 | High | Policy pack unapproved | Six policies are drafted and none is approved, so 73 requirements are not binding on anyone and Clause 5.2 cannot be evidenced. | Approve the policy pack | Managing Director | Blocking |
| CR-05 | High | Document control not established | EM-7.5-01 is rated Red. Without version, approval, and distribution control, every other document's evidential value is weakened. | Establish the controlled document library | ISMS Manager | Blocking |
| CR-06 | High | No asset inventory | No asset inventory or classification exists. A.5.9 cannot be evidenced and the risk assessment's asset coverage cannot be shown to be complete. | Commission and complete an asset inventory | IT & Infrastructure Manager | Blocking |
| CR-07 | High | Backup restoration never evidenced | A.8.13 restoration has been performed but never evidenced against stated objectives — recorded as the most consequential evidence gap in the control register. | Complete CAPA-006 and evidence a restoration test | IT & Infrastructure Manager | Significant |
| CR-08 | High | Supplier assurance not executed | The supplier programme is designed. Zero reviews are complete, zero due-diligence questions answered, and the population is estimated rather than enumerated. | Enumerate the supplier population and complete Level 4 reviews | Finance & Procurement Lead | Significant |
| CR-09 | Medium | Legal and regulatory requirements undetermined | Clause 4.2 requires the organization to determine applicable requirements. This has not been completed, and it affects incident notification obligations. | Complete the legal and regulatory determination | Legal & Compliance Advisor | Significant |
| CR-10 | Medium | Overdue corrective actions | 2 High-priority corrective actions are overdue, one by more than 30 days without an approved extension. | Close CAPA-003 and CAPA-005 | ISMS Manager | Observation |
| # | Action | Owner | Why this order | Timeframe | Addresses |
|---|---|---|---|---|---|
| 1 | Approve the policy pack | Managing Director | One decision makes 73 requirements binding and moves six evidence items | Immediate | CR-04 |
| 2 | Hold the first management review | Managing Director | Clause 9.3 currently has no record at all; the pack in Section K is ready to table | Immediate | CR-03 |
| 3 | Conduct the first internal audit | Internal Auditor | Clause 9.2 has a prepared 90-item checklist and no result | 30 days | CR-02 |
| 4 | Establish document control | ISMS Manager | Unblocks the evidential value of every other document | 30 days | CR-05 |
| 5 | Complete the Annex A applicability assessment | ISMS Manager | 80 controls undecided; the SoA is not presentable without it | 90 days | CR-01 |
| 6 | Commission the asset inventory | IT & Infrastructure Manager | A.5.9 unevidenced and risk coverage unprovable | 90 days | CR-06 |
| 7 | Evidence a backup restoration against stated objectives | IT & Infrastructure Manager | Closes the most consequential single control gap | 60 days | CR-07 |
| 8 | Enumerate suppliers and complete Level 4 reviews | Finance & Procurement Lead | Zero of an estimated 26 suppliers assessed | 90 days | CR-08 |
| # | Stage | What | Reference | Provenance |
|---|---|---|---|---|
| 1 | Business requirement | Customers require assurance that vulnerability findings are protected | IP-01 customers; EXT-02 customer security expectations | Consolidated |
| 2 | Information asset | Customer VAPT reports and vulnerability findings | AST-D01 | Demonstration |
| 3 | Risk | Unauthorized access to customer security reports | RSK-001 — L4 × I5 = 20, Critical | Consolidated |
| 4 | Risk treatment | Reduce — restrict access, review entitlements, monitor | Residual 12, High — the only risk forecast to remain outside appetite | Consolidated |
| 5 | ISO control | Access control; authentication information; access rights | A.5.15, A.5.17, A.5.18 | Consolidated |
| 6 | Policy or procedure | Access Control Policy | SBT-POL-02 — Draft, unapproved | Consolidated |
| 7 | Evidence | Quarterly access review records with approval | EM-9.1-02 — Amber; the approval field was missing | Consolidated |
| 8 | Internal audit | Access review lacked documented system-owner approval | SBT-AUD-01 SF-02 — minor nonconformity | Consolidated |
| 9 | Corrective action | Procedure amended; mandatory approval field added | CAPA-002 — CLOSED 10-Nov-2026, verified Effective | Consolidated |
| 10 | Management review | CAPA trends and closure evidence tabled | NOT HELD — zero management reviews | Demonstration |
| 11 | Certification readiness | Clause 9 rated the weakest area at 30 of 100 | CR-02, CR-03 — both blocking | Consolidated |
SecureBridge Technologies Pvt. Ltd. is a fictional organization created for portfolio purposes. Every figure is consolidated from the ten delivered project registers, which are themselves illustrative academic deliverables. Sections C, J and K are demonstration data with no source project and are labelled as such throughout. SecureBridge is not certified to ISO/IEC 27001. This is a pre-certification readiness assessment and confers no assurance: certification requires an external audit by an accredited certification body. No management review has been held, no internal audit has been conducted, no policy has been approved, and no supplier review has been completed. The readiness score of 44.6 of 100 is a self-assessment against stated weights and has not been independently verified.