How much time does an ISMS take? Planning your annual ISO 27001 workload

"How much time will this take?" is the first question most businesses ask about running an ISMS, and the honest answer is: it depends on what you've committed to. Every recurring check, governance meeting and audit visit adds hours. The annual workload adds them up, month by month, so you can see whether the plan is realistic before it slips.

Why it matters

ISO/IEC 27001:2022 asks you to plan and resource the ISMS, not just describe it:

• Clause 5.1 (leadership): top management makes sure the resources the ISMS needs are available.
• Clause 6.2 (objectives): plans say what resources are needed and when work will be done.
• Clause 7.1 (resources): you determine and provide the resources to run and improve the ISMS.
• Clause 8.1 (operational planning): processes run as planned.

A plan nobody has time for is how recurring checks get missed, and missed checks are a common audit finding.

What drives the workload

• Recurring tasks: access reviews, backup restore tests, log reviews, supplier reviews, policy reviews. Each is small, but monthly and quarterly ones add up.
• Governance meetings: management reviews and shorter check-ins.
• Audits: internal audits, plus your certification body's visits each year.
• One-off projects: new systems, a scope change, fixing findings.

What an auditor looks for

An auditor won't ask for a workload chart, but they'll see the result:

• Recurring checks done on time, across the year, not bunched before the audit.
• Resources discussed at management review, with decisions when the load is too high.
• Owners who have time for what's assigned to them.

Common reasons it fails: a calendar full of monthly checks for a team of one, so half of them quietly stop.

An example

A 25-person business with one IT manager running the ISMS adds up its year: about four hours a month of recurring checks, a quarterly governance meeting, a yearly management review, two internal audit sittings and a two-day surveillance visit. The busiest month is the one with the surveillance visit. Spotting that early, it moves a quarterly supplier review out of that month and merges three similar monthly checks into one rotating task.

Common mistakes, and how to keep it manageable

• Setting everything to monthly. Match the frequency to the risk. Quarterly or yearly is often enough.
• Forgetting the audit days. Certification visits take people's time too, including preparation.
• Lots of near-identical tasks. Combine similar checks into one series that rotates through them.
• Never revisiting the plan. Look at the total at each management review.

How to do it in ClearIMS

1. Open Annual workload. It shows the next 12 months of ISMS work, in hours per month.
2. See what's counted:
   • recurring tasks, using sensible default minutes for each cadence, which you can override for each series;
   • one-off and recurring governance meetings;
   • planned certification visits, at 8 hours per visit day.
3. Set a limit, if you want one. You can turn on a warning for when the yearly hours go over a limit you choose.
4. Trim the load. Use Merge into one rotating series to combine groups of similar tasks.
5. Take it to management review as evidence for resourcing decisions.

Related pages

• Tasks: the recurring work being counted.
• Home: what's due now.
• Meetings: governance meetings in the plan.
• Certification cycle: the audit calendar.
• By person: who's carrying the load.