Start from the Information Security (ISMS) project template in Manager: risk register, Annex A controls, Statement of Applicability and audits, run by your agent. Built around ISO/IEC 27001, as an independent template.
Each risk gets a score, an owner and a treatment, which decides the controls.
Each control runs to Verified with its evidence attached, ready for the audit.
Every finding runs through root cause and corrective action until the fix holds.
ISO/IEC 27001 sets the requirements for an information security management system (ISMS). Clauses 4 to 10 run from context and leadership through planning and operation to evaluation and improvement. At the center: assessing risks against your own criteria and treating them.
Annex A lists reference controls, 93 in four themes in the 2022 edition. The Statement of Applicability records which apply and why. Audits, corrective action and reviews keep the ISMS improving.
Where each part of the standard lives in your project.
| ISO/IEC 27001 | In Manager |
|---|---|
| Scope and risk criteria (clauses 4-6) | A wiki page from the isms-context skill that every other skill checks against. |
| Risk assessment and treatment | Risk items with Likelihood, Impact, Risk Score, Risk Owner and Treatment. |
| Annex A and Statement of Applicability | One Control per control with Control Family and Applicability; the SoA as a wiki page. |
| Internal audit (clause 9.2) | An Audit item; each gap becomes a Finding. |
| Corrective action (clause 10.2) | The Finding runs from Root Cause to Closed; fixes are child Action Items. |
| Management review (clause 9.3) | A dated wiki page per review; decisions become Action Items. |
Connect your AI agent over MCP; it creates the project from the template.
Say to your agentManager: Create a project from the Information Security (ISMS) template.
Fix the scope and when a risk is acceptable. Then score each risk, name an owner and pick a treatment.
Say to your agentManager: Use the isms-context skill to set our scope and risk acceptance criteria with me, then run risk-assessment.
The agent creates a Control per Annex A control. You decide which apply and why.
Say to your agentManager: Run the statement-of-applicability skill against our risk register.
Take each applicable control to Verified. Open work runs as Action Items; evidence goes onto the Control.
Say to your agentManager: Run the control-implementation skill for the applicable controls that are not verified yet.
Audits raise Findings, corrective action closes them, and the management review sets what changes.
Say to your agentManager: Run the next internal audit with the internal-audit skill.
A project created from the Information Security (ISMS) template starts with these work item types and statuses. You can adapt all of them to your team later.
An Annex A reference control, assessed for applicability, driven to Verified.
An information security risk, scored, then treated or accepted.
An audit nonconformity, worked through corrective action to closure.
An internal ISMS audit (clause 9.2).
The default type: a task under a control, risk or finding.
These skills come with the template in Manager:
isms-contextScope, risk method, acceptance criteria. Run it first.
risk-assessmentIdentify, score and treat risks.
statement-of-applicabilitySeed Annex A controls, mark applicability, publish the SoA.
control-implementationDrive controls to Verified, with evidence.
internal-auditPlan an audit, sample controls, raise Findings.
corrective-actionRoot cause, fix, verify, close.
management-reviewPeriodic review; decisions become Action Items.
Certification comes from an accredited certification body; Manager gets you ready for the audit. The standard itself is licensed by ISO, so check the seeded controls against your own copy.
Attach policies and screenshots to the Control they prove. Item Activity, wiki revisions and the audit log show who changed what, when.
Track personal data breaches in a Privacy & Data Protection project; in the app, a link connects them to the Risk here.
Open Findings and Controls In Place show where you stand, and every change is on record for the next audit.
Get early access