An ISMS That Lives Only on the Shared Drive

At-risk requirements:

• Clause 7.5 - control of documented information (five versions, an uncontrolled printed copy).
• Clause 7.3 - awareness (12 of 600 trained; 34% phish click rate is the outcome measure).
• Clause 7.2 - competence for those with security-relevant roles (onboarding staff, ERP administrators).
• Clause 8.1 - operational control of outsourced/agency staff and of the backup process.
• Annex A supplier theme - the payroll provider is unmanaged (supplier relationships, agreements, monitoring).
• Annex A access-control and privileged-access controls - temps with admin rights.
• Clause 5.1 - 'the ISMS is the CISO's project' is a leadership symptom, not an IT symptom.

Sequencing logic: fix by exposure and irreversibility, not by clause order.

1. Today: revoke and re-grant ERP admin rights under named approval; add a security step to onboarding. Cheap, immediate, stops an active exposure.
2. This month: bring payroll into the supplier process - due diligence, contractual security terms, review cadence, exit consideration. Then prove one backup restore end-to-end and record the result.
3. This quarter: document control (single controlled set, version and date, withdrawal of superseded copies) and a risk-based awareness programme targeted at the 34% failure, not a generic annual slide deck.
4. Throughout: reassign each item to a named process owner so the work visibly stops being the CISO's.

Judgement: the temptation is to start with document control because it is easy and produces tidy evidence. That would leave admin rights and an unvetted payroll provider live for weeks.

Clause 7.5 requires documented information to be controlled to ensure it is available where and when needed and suitable for use, and to be protected (from loss of confidentiality, integrity, improper use). Controls include distribution, access, retrieval and use; storage and preservation including legibility; control of changes (version control); retention and disposition; and identification and control of documents of external origin.

Applying it to the print-out:

• A printed copy of a superseded policy is an uncontrolled copy by definition. Either it is marked as uncontrolled and withdrawn when superseded, or the practice of printing is disallowed for controlled documents.
• 'Nothing has changed' is an assertion that must be tested: if the 2021 policy differs from the approved current version in any requirement, staff are following rules that management has not approved.

But do not stop at bureaucracy. The deeper question is whether five versions exist because the document process is broken or because nobody agrees on content. Version sprawl is often a symptom of ownership ambiguity. Practical answer: designate one controlled location with a single owner, a version identifier, an approval record and an acknowledgement mechanism for role-relevant staff; and check whether the plant actually uses the policy or a local work instruction, in which case the work instruction is what needs controlling.

Tone: frame it as protecting the plant manager - an auditor who finds an uncontrolled printed policy will also interview the person holding it.

Superficial fix: add the payroll provider to a supplier register, tick 'supplier controls applied', move on. This satisfies nobody: it produces an artefact with no risk assessment, no contractual basis and no monitoring.

Proper handling:

1. Risk assessment (6.1.2). Payroll data includes identity, bank and salary data of 600 people. Assess confidentiality and integrity risk, and the dependency risk of losing the service mid-cycle.
2. Supplier relationship controls. Contractual security requirements are the leverage point: confidentiality obligations, breach notification timescales, sub-processor rules, audit or assurance rights, data return and deletion on exit.
3. Due diligence proportionate to the data. For a payroll bureau, evidence of its own controls (assurance report, certification, or a completed questionnaire) plus a named contact.
4. Monitoring and review. An agreed review cadence and defined triggers (service changes, incidents, sub-processor changes) rather than an annual email.
5. Exit. Confirm the organisation could process payroll itself or transition within a stated period.
6. Competence and awareness (7.2, 7.3). HR staff who hand data to the provider must know the rules.

Judgement: the CISO should resist signing a long security schedule with a supplier that has been in place for two years without raising the commercial impact. Sequencing the contractual ask against the next renewal is a business decision to be recorded, not ignored.