Capability / ControlLedger
ISMS design
Give your management system a useful boundary and an operating rhythm.
What belongs inside the system?
Define the services, information, locations and dependencies that the system needs to cover. We frame the management arrangements around real operating work and make the interfaces with suppliers visible. A certification objective can inform the scope, but it does not replace the need to understand the business.
The record we want to leave
A decision someone else can follow.
A scope statement with documented interfaces and a named decision owner.
We keep the boundary, assumptions and unresolved questions visible. An output is useful when it helps the next person make or review a decision.
Before the work begins
Does this depend on a certification project?
No. The example service model supports broader information security governance and assurance. If certification is an objective, it must be addressed within a separately agreed scope.
What information would be needed first?
A description of the services and information involved, the decision to be made, relevant responsibilities and any known constraints. Avoid including sensitive evidence in an initial brief.
A focused starting point
What needs to become clearer?
Capture the review question, the systems involved and the decision you need to make.
A browser-local example. Nothing is submitted.