docs: added templates for usecase experiments

examples/TEMPLATE-ISO27001-ISMS.md

@@ -0,0 +1,383 @@
+# ISO/IEC 27001:2022 – ISMS Documentation Template
+
+> Version: 1.0 • Generated: 2025-10-02 21:59 • Standard reference: ISO/IEC 27001:2022
+
+## 0. Introduction
+
+This document is a comprehensive template to help you establish, implement, maintain, and continually improve an Information Security Management System (ISMS) aligned to ISO/IEC 27001:2022. Each chapter begins with a short explanation of its purpose, followed by placeholders for your content.
+  
+Add your content here...
+
+---
+
+## 1. Purpose & Scope of this Document
+
+This section explains why this ISMS manual exists and which parts of the organization and operations it covers (documents included/excluded). It also outlines how this document relates to supporting procedures and records.
+  
+Add your content here...
+
+### 1.1 Intended Audience
+Explain who should read and use this document (management, ISMS team, auditors, all staff, suppliers).
+  
+Add your content here...
+
+### 1.2 How to Use this Template
+Provide guidance for authors, approvers, and reviewers on how to complete each section and keep it current.
+  
+Add your content here...
+
+---
+
+## 2. Normative References (Clause 2)
+
+List standards and documents referenced by the ISMS (e.g., ISO/IEC 27000 family, legal/regulatory sources) that are indispensable for its application.
+  
+Add your content here...
+
+---
+
+## 3. Terms & Definitions (Clause 3)
+
+Define key terms used in this manual for clarity and consistency. Reference ISO/IEC 27000 glossary where applicable.
+  
+Add your content here...
+
+---
+
+# Core Requirements (Clauses 4–10)
+
+> Clauses 4–10 contain the auditable requirements for ISO/IEC 27001:2022. Use these sections to demonstrate conformity in both design and effectiveness.
+
+## 4. Context of the Organization (Clause 4)
+
+Establish the organizational context in which the ISMS operates, including internal/external issues, stakeholders, and ISMS boundaries.
+  
+Add your content here...
+
+### 4.1 Understanding the Organization and its Context (4.1)
+Identify relevant internal and external issues that affect the ISMS’s intended outcomes (strategic, technological, legal, environmental, socio-economic).
+  
+Add your content here...
+
+### 4.2 Understanding the Needs and Expectations of Interested Parties (4.2)
+Identify stakeholders (e.g., customers, regulators, employees, suppliers) and their relevant information security requirements.
+  
+Add your content here...
+
+### 4.3 Determining the Scope of the ISMS (4.3)
+Define ISMS scope (locations, assets, processes, technologies), interfaces and dependencies. Justify inclusions/exclusions.
+  
+Add your content here...
+
+### 4.4 ISMS and its Processes (4.4)
+Describe the ISMS processes, their inputs/outputs, interactions, and criteria for effective operation and control.
+  
+Add your content here...
+
+---
+
+## 5. Leadership (Clause 5)
+
+Demonstrate leadership and commitment to the ISMS, define policy and roles, and ensure responsibilities and authorities are assigned and communicated.
+  
+Add your content here...
+
+### 5.1 Leadership and Commitment (5.1)
+Describe how top management leads, provides resources, integrates ISMS requirements with business processes, and promotes continual improvement.
+  
+Add your content here...
+
+### 5.2 Information Security Policy (5.2)
+State the policy framework, its alignment with strategic direction, availability to interested parties, and review cadence.
+  
+Add your content here...
+
+### 5.3 Organizational Roles, Responsibilities and Authorities (5.3)
+Define roles (e.g., ISMS Manager, Risk Owner, Control Owners), responsibilities, authorities, and reporting lines.
+  
+Add your content here...
+
+---
+
+## 6. Planning (Clause 6)
+
+Plan actions to address risks and opportunities, establish information security objectives, and plan their achievement.
+  
+Add your content here...
+
+### 6.1 Actions to Address Risks and Opportunities (6.1)
+Explain your risk management methodology (criteria, likelihood/impact scales, acceptance criteria), treatment options, and linkage to controls (Annex A). Include legal/regulatory considerations.
+  
+Add your content here...
+
+#### 6.1.2 Information Security Risk Assessment (6.1.2)
+Describe the risk assessment process, frequency, triggers, and records.
+  
+Add your content here...
+
+#### 6.1.3 Information Security Risk Treatment (6.1.3)
+Describe how treatments are selected, justified, implemented, and tracked; reference Statement of Applicability (SoA).
+  
+Add your content here...
+
+### 6.2 Information Security Objectives and Planning to Achieve Them (6.2)
+Define measurable objectives (KPIs/KRIs), owners, targets, timelines, and plans for achieving them.
+  
+Add your content here...
+
+---
+
+## 7. Support (Clause 7)
+
+Detail resources, competencies, awareness, communications, and documented information needed to operate the ISMS.
+  
+Add your content here...
+
+### 7.1 Resources (7.1)
+Identify people, technology, budget, and partner resources required for ISMS effectiveness.
+  
+Add your content here...
+
+### 7.2 Competence (7.2)
+Document competence requirements, training plans, certifications, and evaluation methods.
+  
+Add your content here...
+
+### 7.3 Awareness (7.3)
+Define awareness topics, frequency, onboarding/offboarding coverage, and measurement.
+  
+Add your content here...
+
+### 7.4 Communication (7.4)
+Describe internal/external communication plans (what, when, by whom, channels) related to the ISMS.
+  
+Add your content here...
+
+### 7.5 Documented Information (7.5)
+Explain document/record control: creation, approval, change control, retention, access, format, and protection.
+  
+Add your content here...
+
+---
+
+## 8. Operation (Clause 8)
+
+Plan, implement, and control ISMS operational processes, including risk treatment and change management, and manage information security incidents.
+  
+Add your content here...
+
+### 8.1 Operational Planning and Control (8.1)
+Describe how operational processes meet ISMS requirements and control planned changes.
+  
+Add your content here...
+
+### 8.2 Information Security Risk Assessment (Operational) (8.2)
+Explain how you perform risk assessments when changes occur or at defined intervals.
+  
+Add your content here...
+
+### 8.3 Information Security Risk Treatment (Operational) (8.3)
+Describe how selected controls are implemented, verified, and maintained in operation.
+  
+Add your content here...
+
+---
+
+## 9. Performance Evaluation (Clause 9)
+
+Evaluate ISMS performance via monitoring, measurement, analysis, internal audit, and management review.
+  
+Add your content here...
+
+### 9.1 Monitoring, Measurement, Analysis and Evaluation (9.1)
+Set metrics/KPIs, methods, frequency, responsibilities, and evaluation criteria.
+  
+Add your content here...
+
+### 9.2 Internal Audit (9.2)
+Define audit program, criteria, scope, frequency, auditor independence, reporting, and follow-up.
+  
+Add your content here...
+
+### 9.3 Management Review (9.3)
+Outline inputs (status of actions, changes, risks, opportunities, performance, incidents) and outputs (decisions, actions, resources).
+  
+Add your content here...
+
+---
+
+## 10. Improvement (Clause 10)
+
+Drive continual improvement and address nonconformities with corrective actions.
+  
+Add your content here...
+
+### 10.1 Continual Improvement (10.1)
+Explain how improvement opportunities are identified, prioritized, and implemented.
+  
+Add your content here...
+
+### 10.2 Nonconformity and Corrective Action (10.2)
+Describe how you react to nonconformities, evaluate causes, implement and review corrective actions, and update risks/controls.
+  
+Add your content here...
+
+---
+
+# Annex A Controls & Statement of Applicability
+
+> ISO/IEC 27001:2022 Annex A lists 93 controls grouped into four themes. Use this section to map your selected controls and justify inclusions/exclusions in the Statement of Applicability (SoA).
+
+## A.0 Overview & Control Selection Method
+
+Summarize your control selection approach: mapping from risks and legal/contractual requirements to Annex A controls and additional controls where needed.
+  
+Add your content here...
+
+## A.1 Organisational Controls
+
+Describe organizational-level controls (policies, governance, supplier management, asset management, incident management, etc.). Provide references to procedures and tooling.
+  
+Add your content here...
+
+## A.2 People Controls
+
+Describe people-focused controls (screening, terms of employment, awareness, discipline, responsibilities, remote work).
+  
+Add your content here...
+
+## A.3 Physical Controls
+
+Describe physical security controls (secure areas, entry controls, equipment protection, environmental threats, media handling).
+  
+Add your content here...
+
+## A.4 Technological Controls
+
+Describe technology controls (access control, cryptography, logging/monitoring, backup, network/application security, secure development, vulnerability management).
+  
+Add your content here...
+
+## A.SoA Statement of Applicability
+
+Present a table of all applicable Annex A controls with status (Applied/Not Applied), justification, implementation reference, and verification method.
+  
+Add your content here...
+
+---
+
+# Risk Management & Asset Foundations (Supporting Sections)
+
+## R.1 Information Assets & Owners
+
+Establish an inventory of information assets, owners, classification, lifecycle, and protection requirements.
+  
+Add your content here...
+
+## R.2 Risk Register
+
+Maintain identified risks, assessments, decisions, treatments, residual risks, and review dates.
+  
+Add your content here...
+
+## R.3 Legal, Regulatory, and Contractual Obligations
+
+Track applicable laws, regulations, certifications, customer commitments, and how the ISMS fulfills them.
+  
+Add your content here...
+
+## R.4 Business Continuity & Disaster Recovery Alignment
+
+Describe how ISMS integrates with BC/DR planning, including RTO/RPO, exercises, and lessons learned.
+  
+Add your content here...
+
+---
+
+# Policies, Procedures, and Records Index
+
+Provide a living index of ISMS policies, standards, procedures, guidelines, and records with owners and locations.
+  
+Add your content here...
+
+---
+
+# Appendices
+
+## Appx A. Document Control Log
+Track versions, authors, approvers, change descriptions, and dates.
+  
+Add your content here...
+
+## Appx B. Training & Awareness Records
+Summaries or links to records for competence and awareness activities.
+  
+Add your content here...
+
+## Appx C. Audit & Review Evidence
+Summaries or links to internal audits, management reviews, and KPI dashboards.
+  
+Add your content here...
+
+---
+
+# Best Practice Requirements Checklist (Quality Gate)
+
+Use this checklist as acceptance criteria to review the quality and completeness of this ISMS manual and its supporting evidence.
+
+- **Alignment with ISO/IEC 27001:2022 Clauses 4–10**: Each clause section is completed with organization-specific content, evidence pointers, and responsibilities.  
+  Add your content here...
+- **Risk-Based Control Selection**: Risk methodology defined; risks traced to treatments; SoA includes justification for each control.  
+  Add your content here...
+- **Annex A Coverage**: All 4 themes considered; applicable controls implemented or justified; references to procedures, tooling, and records.  
+  Add your content here...
+- **Measurable Objectives (6.2 & 9.1)**: Objectives are specific, measurable, time-bound; metrics and evaluation methods defined.  
+  Add your content here...
+- **Management Commitment (5.1)**: Evidence of leadership involvement (resources, integration with business, improvement actions).  
+  Add your content here...
+- **Policy Framework (5.2 & 7.5)**: Policy approved, communicated, versioned; document control applied consistently.  
+  Add your content here...
+- **Defined Roles & Competence (5.3 & 7.2)**: Roles, responsibilities, and required competencies documented; training plans and records exist.  
+  Add your content here...
+- **Operational Control (8.1–8.3)**: Change management, risk assessment on change, and risk treatment in operation are defined and evidenced.  
+  Add your content here...
+- **Incident Management & Learning**: Incident response defined; logs/monitoring support detection; post-incident reviews feed continual improvement.  
+  Add your content here...
+- **Audit & Management Review (9.2 & 9.3)**: Audit program executed; findings tracked; management reviews held with decisions and actions recorded.  
+  Add your content here...
+- **Continual Improvement (10.1)**: Improvement pipeline maintained; actions prioritized by risk/impact; outcomes measured.  
+  Add your content here...
+- **Corrective Action (10.2)**: Root cause analysis performed; corrective actions verified for effectiveness; risks/controls updated.  
+  Add your content here...
+- **Legal/Regulatory Mapping**: Obligations identified with controls/evidence mapped; updates monitored.  
+  Add your content here...
+- **Supplier & Outsourcing Controls**: Supplier risk assessment and monitoring defined; contracts include security clauses; evidence available.  
+  Add your content here...
+- **BC/DR Integration**: ISMS aligns with business continuity; exercises conducted; lessons learned tracked.  
+  Add your content here...
+- **Asset Inventory & Classification**: Asset owners, classifications, and handling rules documented and enforced.  
+  Add your content here...
+- **Access Control & Identity Management**: Joiner/mover/leaver processes, least privilege, MFA, and periodic reviews in place.  
+  Add your content here...
+- **Secure Development & Change**: SDLC integrates security; code review, testing, vulnerability management defined.  
+  Add your content here...
+- **Logging, Monitoring & Response**: Logging scope, retention, analysis, and alerting defined; response runbooks tested.  
+  Add your content here...
+- **Cryptography & Key Management**: Policies and procedures for algorithm choices, key lifecycles, and escrow defined.  
+  Add your content here...
+
+---
+
+## Document Approval
+
+- **Owner:**  
+  Add your content here...
+- **Reviewed by:**  
+  Add your content here...
+- **Approved by:**  
+  Add your content here...
+- **Effective date:**  
+  Add your content here...
+- **Next review date:**  
+  Add your content here...
+