When one person holds the whole ISMS: make ISO 27001 survive a holiday, a resignation or a busy quarter
In a lot of small firms, ISO 27001 lives in one person's head. They know where the evidence is, which review is due and who to nudge. It works until they go on holiday, get pulled into a big project or hand in their notice.
For a business owner this is a real risk, and an ordinary one. A customer asks for your certificate, a renewal or a tender depends on it, and the person who keeps it alive isn't there. This guide is about spreading the load so the ISMS survives that.
Why it happens
- The person who led the certification project kept the job afterwards.
- The records are in their own folders, mailbox and memory.
- Nobody else has been asked to own anything.
- Chasing others is awkward, so they do it themselves.
It is understandable, and it makes the whole system only as dependable as one calendar.
What to spread out
- Ownership. Give each recurring task, review and risk a named owner who is not the ISMS lead. The lead coordinates; owners do their own part.
- Knowledge. Write down how each routine is done: where the evidence lives, who supplies it and what good looks like. A short note is enough.
- A deputy. Name someone who can cover the lead's role for a few weeks, and have them do one cycle with the lead.
- Top management attention. ISO 27001 expects leadership to be involved, not just informed. Approvals and the management review belong with them.
- Access. The records, accounts and admin rights should not sit with one person alone. Check this for a leaver before the notice is handed in.
A simple test
Ask: if the ISMS lead were away for four weeks starting tomorrow, what would stop happening? Whatever you list is where to start. Try the same question for a resignation: what would take longest to rebuild?
Handover when someone is leaving
- List every recurring task and its next due date.
- Move owners to named people, not to "whoever is free".
- Make sure open risks, findings and incidents have a current owner.
- Hand over supplier contacts, the auditor's contact and the certification body's schedule.
- Have the successor sit in on the next review or access check.
How ClearIMS helps
ClearIMS works like a virtual ISMS manager. It emails people about their outstanding and overdue actions, so the reminders do not depend on one person's chasing, and people can reply in plain text to update an action. Recurring tasks keep reviews and audits coming round, each record has an owner and a due date, and a Recommended tasks list puts the work in order, so whoever has five minutes or five hours knows where to start. Users are unlimited, and you mark which members are top management for the approvals that need them. Every approval records who approved it, which version and when. Once AI drafting is activated for your organisation, it can help with first drafts, which people review and approve. The AI never approves anything, and a certification body decides whether to certify you.
Why a business owner should care
- Winning bigger customers. A system that carries on through a resignation is more credible than one that depends on a single person.
- Faster questionnaires. Answers come from approved records, not from whoever happens to be in.
- Knowing your risks. Owners accept and manage their own, so the picture is current.
- Less riding on one person. That is the whole point.
Questions people ask
Do we need more staff? Not necessarily. Smaller pieces of ownership across several people is often enough.
Can we bring in outside help for a gap? Yes. An adviser can be added as a user and can work in their clients' ClearIMS alongside them.
Will this guarantee a clean audit? No. It reduces the chance that the system quietly stops, but the audit result is for your certification body.
Next step
The price is £300 a month, monthly with 30 days' notice, unlimited users, no VAT charged. Related reading: what a virtual ISMS manager does day to day, surveillance audit preparation and keeping an existing certificate going. Sector pages: public-sector suppliers, NHS suppliers and ISPs and altnets.
Book a 20-minute call or try the demo company to see it working first.