A structured set of policies, procedures, roles and controls for managing information security. Being certified means having a working ISMS, not just documents.

The central ISMS document listing all 93 Annex A 2022 controls, justifying the inclusion or exclusion of each. The first document requested at Stage 1.

A process required by practically every ISO standard. It analyses the root cause and prevents the problem recurring.

An Italian legal obligation, separate from ISO 45001 but able to be integrated with it. It remains mandatory even with 45001 certification.

Article 30 of the GDPR requires almost every organisation to keep a register of all processing activities, with purposes, legal bases, recipients and retention periods.

The certification body checks that documentation exists, that the system is running and that there is enough evidence to schedule Stage 2. It usually lasts half a day or a day.

The auditor verifies on site how the system works through interviews, operational evidence and inspections. It ends with a report and any nonconformities to close before the certificate is issued.

After initial certification the body returns each year to verify the system is maintained. Every three years there is a full renewal audit. These are critical moments if the system has not been kept up.

Nonconformities can be minor (resolved with one action) or major (blocking the certificate). The aim is to handle them in a structured way.

It lists 93 controls (down from 114 in the 2013 version) across four themes: organisational, people, physical and technological. The SoA maps them one by one.

Required by almost every ISO standard (27001, 9001, 14001, 45001). It identifies what can go wrong, how likely it is and how serious. It is the basis for deciding which controls to implement.

Root cause analysis (for example 5 Whys or Ishikawa) exists so you do not stop at the symptom. It is explicitly required in the corrective actions of ISO 9001, 27001 and 13485.

A mandatory role for certain categories of controller (public bodies, systematic monitoring, sensitive data). Independent, reporting to leadership and protected from sanctions for their assessments.

Mandatory when processing presents a high risk to rights (new technologies, profiling, sensitive data). The output is a document justifying the choices made.

All ISO management system standards (9001, 14001, 27001, 45001) share ten clauses. This makes integration between systems both possible and worthwhile.

Typically 9001+14001+45001 or 9001+27001. It uses the High Level Structure to avoid duplicated policies and meetings, cutting overhead by 40-60%.

It requires around 50,000 Italian organisations (medium and large companies in critical sectors) to implement security measures, register on the national cybersecurity portal and report incidents.

It receives NIS2 incident notifications, runs the register of in-scope entities, and can inspect and impose penalties. The first step is registering on its portal within the deadlines.

Required by every ISO management system standard. It reviews audit results, nonconformities, objectives, resources and improvement opportunities. It is the moment leadership signs off on the system’s effectiveness.

Required at least annually by every ISO standard. Carried out by trained staff independent of the area being audited. Often supported by qualified external consultants.