Define boundaries that match delivery
Establish organisational context, relevant interested parties and their requirements before fixing the ISMS scope. Describe included services, teams, locations and information. Consider dependencies and interfaces with activities outside the boundary, especially shared IT, central HR and outsourced administration.
Avoid drawing the scope around a convenient team while overlooking the systems on which its service depends. Document the boundary and explain shared responsibilities. Existing gap analysis can identify where current arrangements differ from ISO/IEC 27001:2022 requirements.
Build governance around actual decisions
Give top management clear responsibilities for direction, resources and integration with business processes. Define security roles, risk ownership and escalation routes. Set measurable objectives with owners, resources, timescales and a way to evaluate results, rather than an unqualified objective to prevent every incident.
Agree assessment criteria, evaluate risks and determine treatment before producing extensive documentation. Develop the Statement of Applicability alongside control decisions. Separate approval authority from administrative maintenance so the person updating a register is not automatically authorised to accept business risk.
Make controls produce usable evidence
Design workable routines for access management, supplier review, incident handling, change control and other necessary controls. Identify each routine's trigger, responsible role, expected output and escalation path. Reuse existing service-management processes where they meet the requirement rather than creating parallel compliance paperwork.
Test evidence retrieval during implementation. Can a manager show the latest access review, explain an exception and identify corrective action? Apply proportionate document controls, competence arrangements and communication. Cloud-provider assurance should supplement, not replace, evidence of your own configuration and responsibilities.
Evaluate the system before external assessment
Plan monitoring, internal audit and management review so they examine operation and effectiveness. Preserve auditor objectivity and impartiality. Management review should consider required inputs and record decisions about improvement, changes and resources. Correct nonconformities, investigate causes and check whether corrective action works.
Continue through the existing implementation and internal audit services below. Horizon organises risks, controls, owners, evidence and reviews across that cycle; it does not replace management judgement, decide risk acceptance or certify the ISMS.