Running ISO 27001 day to day: tasks, owners and recurring work

Getting certified is a project. Staying certified is a routine. Tasks are how the routine happens: each recurring activity (an access review, a restore test, a policy review) and each one-off action (fix this finding, assess that supplier) has an owner and a due date, and someone notices when it slips.

Most ISMS failures aren't bad controls. They're good controls that quietly stopped happening because nobody was reminded.

Why it matters

ISO/IEC 27001:2022 expects the ISMS to operate, not just exist:

• Clause 6.1.3 and 8.3: risk treatment actions are carried out.
• Clause 8.1: processes are planned, run as planned, and recorded.
• Clause 9.1: monitoring happens on a schedule.
• Clause 10.2: corrective actions are completed.

Auditors check all of these by sampling. Late or missing activities are one of the most common audit findings.

Typical recurring tasks

For a small organisation:

• Monthly: review incidents and overdue actions; check backups ran.
• Quarterly: access reviews; restore test; review threat sources.
• Every six months: review key supplier status; check asset register.
• Yearly: risk reassessment; policy reviews; awareness training refresh; internal audit; management review; continuity exercise.

What an auditor looks for

• Recurring activities happen on time, with records.
• Every action has an owner and a due date.
• Overdue items are visible and dealt with, not hidden.
• Evidence is attached to completed work.

Common reasons it fails: a calendar of activities that nobody followed; actions with no owner; or evidence gathered weeks after the event.

Common mistakes, and how to keep it manageable

• Everything on one person. Spread ownership to the people who do the work.
• Too many tasks. Combine related activities so each task is worth doing.
• No evidence at completion. Attach the record when you close the task, not later.
• Ignoring overdue items. Review them at every governance meeting.

How to do it in ClearIMS

1. Start from the drafts. The onboarding chat sets up your first tasks and recurring activities from what you tell it.
2. Open Tasks to see what's due, overdue and coming up, by owner.
3. Let ClearIMS chase people. It emails owners about outstanding and overdue tasks. They can reply in plain text and the task updates.
4. Attach evidence when you complete a task, so the record is ready for audit.
5. Use Recommended tasks when you're not sure what to do next. It puts the ISO 27001 work in order, most important first: whether you have 5 minutes or 5 hours, every task you finish moves your ISMS forward.

Related pages

• Home: your overview of what needs attention.
• By person: who owns what, and what's slipping.
• Assurance register: the records recurring tasks produce.
• Evidence library: where evidence lives.