Setting up your ISMS in ClearIMS: the onboarding chat, step by step

Setting up an ISMS from a blank page takes most small organisations months. In ClearIMS, setup starts with a conversation: you describe your business in plain English, the onboarding chat asks follow-up questions, and ClearIMS builds a first draft of your ISMS from your confirmed answers.

Everything it produces is a draft until a named person approves it. Setup gives you a head start; it doesn't make decisions for you.

Why it matters

The first months of ISO 27001 are spent on the same groundwork every organisation needs:

• Context and scope (clauses 4.1 to 4.3): what you do, who for, where, with which systems and suppliers.
• Risk assessment (6.1.2) and a Statement of Applicability (6.1.3) covering the 93 Annex A controls.
• Policies (5.2 and Annex A 5.1) and the recurring work that keeps the system running.

Setup turns your answers into first drafts of all of these, so your time goes on reviewing and adjusting rather than writing from scratch.

What setup produces

From your confirmed answers, ClearIMS drafts:

• Your ISMS scope.
• Registers: suppliers, assets, interested parties and legal duties.
• Risks with owners, and Statement of Applicability proposals for all 93 controls. These register records are built from your confirmed answers by rules, not by AI.
• Policies and documents: the AI drafts these once the answers they depend on are confirmed. You can see progress as it goes, for example how many policies are drafted.
• Recurring tasks, such as access reviews, restore tests and policy reviews.

What an auditor looks for

An auditor doesn't care how your first draft was made. They care that:

• The ISMS describes your organisation, not a generic one. Drafts must be checked against how you actually work.
• A named person approved each document and decision, with the right authority, for example top management for the information security policy and the SoA.
• You can explain your decisions: why a control applies, why a risk is scored as it is.

Common reasons it fails: drafts approved without reading; documents describing processes the organisation doesn't follow; or nobody able to explain a decision.

Common mistakes, and how to keep it manageable

• Rushing the answers. The drafts are only as good as what you tell the chat. Be specific about services, locations, systems and suppliers.
• Approving everything at once. Review in an order that builds: scope, then risks, then the SoA, then policies.
• Leaving gaps unconfirmed. If you're unsure of an answer, find out rather than guessing; you can come back to the chat.
• Doing it alone. Ask the people who know each area to check their part.

How to do it in ClearIMS

1. Open Setup and describe your business in plain English: what you do, who your customers are, how many people, where you work, which systems and suppliers you use.
2. Answer the follow-up questions. The chat asks what it needs to know. If you give a wrong answer, you can go back and change it.
3. Confirm each chapter. Completing a chapter queues the drafting of the documents that depend on it, so the first drafts appear while you carry on.
4. Review and approve. Work through the drafts in ISMS scope, Risk register, Statement of Applicability and Controls and policies. The AI never approves anything.
5. Use Recommended tasks to see what to do next, most important first.

Already have documents? See Import existing documents.

Related pages

• ISMS scope: the first draft to review.
• Risk register and Statement of Applicability: the core of the draft.
• Choose frameworks: ISO 27001, Cyber Essentials and others.
• Import existing documents: bringing in what you already have.