Planning of a CMS Implementation Based on ISO 37301
This domain tests clause 6 - converting the gap analysis into a risk-based plan with obligations, controls and measurable objectives.
Core requirements
- Actions to address risks and opportunities (6.1) - identify compliance obligations from every source, assess compliance risk against documented criteria (scales for likelihood and consequence, plus risk tolerance), decide treatment, and integrate actions into the organization's own processes rather than a parallel compliance universe.
- Compliance obligations register - for each obligation: source and reference, affected process and role, the control providing assurance, the owner, review frequency, and date last verified.
- Compliance objectives (6.2) - consistent with the compliance policy, measurable where practicable, monitored, communicated and updated. Planning states what will be done, what resources are needed, who is responsible, when it completes, and how results are evaluated.
- Planning of changes (6.3) - carried out purposefully, considering purpose and potential consequences, resource needs and allocation of roles and responsibilities.
Worked example
A new export-control rule adds licensing for dual-use components. Planning: add the obligation to the register with the source citation; rescore risk for the sales process (impact high, likelihood medium, above tolerance); add a screening control before order acceptance; set the objective "100% of new orders screened before acceptance, reviewed monthly", owned by the trade-compliance lead, due within 90 days.
Traps
Copying a legal list into a register with no owners or controls - that is an inventory, not a CMS. Scoring risks without publishing the criteria, so scores cannot be reproduced or defended. Objectives such as "raise awareness" that cannot be measured or evaluated. Treating risk assessment as a one-off instead of re-running it when obligations, context or incidents change.