Building, operating, auditing, and improving an ISO/IEC 27001:2022 Information Security Management System — end to end, across ten connected projects, consolidated into one integrated command center.
Project 11 consolidates all ten projects into a single executive view. If you read one thing in this repository, read that.
From business context to certification readiness: an integrated, evidence-driven ISMS implementation portfolio.
| Interactive dashboard | Six tabs, filterable registers, 5×5 risk heat map — standalone HTML |
| Executive summary | Company, scope, key risks, readiness, decisions required |
| Master risk and control view | 16-field risk register and the full Statement of Applicability |
| Certification readiness | 44.6 / 100 weighted · six blocking risks · not certified |
| Traceability matrix | One risk followed through eleven layers, including where the chain breaks |
The consolidation imports the ten project datasets rather than restating them, so no integrated figure can drift from its source register. Three required views — asset inventory, incident management, and management review — have no source project and are labelled Demonstration throughout rather than invented.
A practitioner portfolio that demonstrates how a cybersecurity professional designs, runs, measures, and improves an ISMS in a realistic company — not a set of theory notes and not a template pack.
The setting is SecureBridge Technologies Pvt. Ltd., a fictional 80-person cybersecurity and managed IT services company in Surat, Gujarat. It sells security services to SMEs, yet in January 2026 it could not evidence its own security governance: no documented scope, no risk register, no Statement of Applicability, no evidence trail. Three clients began demanding proof of a certified ISMS at renewal.
The ten projects in this repository are the work that closes that gap.
| Why it matters | Certification is won or lost on evidence and traceability, not on documents existing. Every artefact here is built so an auditor can trace a management-review claim down to the record that supports it. |
| What was created | Policies, registers, risk assessments, control mappings, audit programmes, corrective-action tracking, supplier assurance, dashboards, and diagrams — as Markdown, Word, Excel, and SVG. |
| Skills demonstrated | Risk-based thinking · control ownership · evidence management · audit readiness · corrective action · supplier risk · management reporting · documentation control. |
ISMS position as at 04-Sep-2026 — Phase 8 of 12. All figures illustrative. No external audit has been performed and no certificate exists. Source data: 00-Portfolio-Overview/README.md.
| Attribute | Detail |
|---|---|
| Organization | SecureBridge Technologies Pvt. Ltd. (fictional) |
| Sector | Cybersecurity services and managed IT |
| Headquarters | Surat, Gujarat, India · second office in Ahmedabad |
| Headcount | 80 employees |
| Service lines | VAPT · Managed security monitoring · Cloud security consulting · IT support |
| Customers | Small and medium enterprises across India |
| Cloud estate | AWS ap-south-1 (Mumbai) · Microsoft Azure Central India |
| Working model | Company-managed laptops · approved hybrid and remote working |
| ISMS initiated | January 2026 · readiness target Q2 2027 (Planned) |
Full detail: 00-Portfolio-Overview/company-context.md
- Establish a bounded, justified ISMS scope tied to how the business actually operates.
- Build a risk register with approved criteria, scored risks, named owners, and treatment plans.
- Assess all 93 Annex A controls for applicability and record the justification in a Statement of Applicability.
- Publish a controlled policy and procedure set with owners, versions, and review dates.
- Implement controls proportionate to an 80-person company with a constrained budget.
- Generate and index retrievable evidence for every control claimed as implemented.
- Run an internal audit programme that produces objective, classified findings.
- Close findings through root-cause analysis, corrective action, and effectiveness verification.
- Report ISMS performance to management in a form that supports real decisions.
- Consolidate everything into a defensible certification-readiness position.
In scope — the provision of VAPT, managed security monitoring, cloud security consulting, and IT
support services from the Surat and Ahmedabad offices, including supporting corporate functions, the
Microsoft 365 and Entra ID tenant, the AWS ap-south-1 and Azure Central India environments,
company-managed endpoints, and approved remote-working arrangements.
Out of scope — client-owned infrastructure under full client control, third-party data-centre physical security beyond contractual assurance, and personally owned devices, which are not permitted for company or client data.
Ten projects mapped to Plan-Do-Check-Act. Each lives in its own numbered folder and is readable on its own, but outputs flow forward: risk → control → evidence → improvement. The eleventh folder consolidates all ten into a single certification-readiness view and is built last.
SecureBridge-ISO27001-GRC-Portfolio/
│
├── README.md ← you are here
├── LICENSE
├── .gitignore
│
├── 00-Portfolio-Overview/ Shared foundation inherited by every project
│ ├── README.md Portfolio dashboard and navigation
│ ├── company-context.md The organization: roles, services, technology, scope
│ ├── portfolio-standards.md Palette, terminology, identifiers, metadata rules
│ ├── portfolio-roadmap.md Ten project slots, PDCA placement, delivery status
│ ├── isms-implementation-journey.md Twelve-phase timeline, Jan 2026 → Q2 2027
│ ├── diagrams/ Organization · architecture · timeline (SVG)
│ └── screenshots/ Rendered dashboard preview (PNG)
│
├── 01-Project-01/ … 10-Project-10/ One folder per project
│ ├── README.md Purpose · portfolio role · skills · deliverables
│ ├── documents/ Word deliverables and Markdown equivalents
│ ├── spreadsheets/ Excel registers, trackers, dashboards
│ ├── diagrams/ Process flows, matrices, traceability (SVG)
│ ├── evidence/ Illustrative evidence artefacts and evidence index
│ └── screenshots/ Rendered PNG previews
│
└── 11-Integrated-ISMS-Portfolio/ Consolidation of all ten — built last
├── executive-summary/
├── integrated-isms-manual/
├── master-risk-and-control-view/
├── master-evidence-map/
├── certification-readiness-report/
├── management-review-pack/
├── cross-project-traceability/
├── portfolio-diagrams/
├── dashboards/
└── screenshots/
| # | Project | PDCA stage | Status |
|---|---|---|---|
| 01 | ISMS Scope Definition | Plan | ✅ Delivered |
| 02 | Context of the Organization | Plan | ✅ Delivered |
| 03 | Risk Assessment | Plan | ✅ Delivered |
| 04 | Statement of Applicability | Plan | ✅ Delivered |
| 05 | Information Security Policy Pack | Do | ✅ Delivered |
| 06 | Internal Audit | Check | ✅ Delivered |
| 07 | Certification Readiness Evidence Map | Check | ✅ Delivered |
| 08 | Supplier Risk Review and Third-Party Security Assessment | Do | ✅ Delivered |
| 09 | Security Awareness Metrics Dashboard | Check | ✅ Delivered |
| 10 | CAPA Register and Continual Improvement Log | Act | ✅ Delivered |
| 11 | SecureBridge Integrated ISMS Command Center | Consolidation | ✅ Delivered |
Project titles and PDCA placement are confirmed as each brief is issued, from the ISO clause the project addresses. Tracked in portfolio-roadmap.md.
How a single project is produced (click to expand)
- Frame — confirm the project's PDCA stage, the ISO 27001 clauses it addresses, and which earlier project outputs it consumes.
- Design the artefacts — decide which registers, documents, diagrams, and evidence items the project must produce for the ISMS to actually work at that stage.
- Populate with consistent data — draw company facts from
company-context.mdand reuse existing identifiers. A risk cited in an earlier project keeps the same ID, score, and owner. - Build the deliverables — Markdown for GitHub readability,
.docx/.xlsxfor the real working artefacts, SVG for diagrams. - Render previews — dashboards and registers are rendered to PNG so the outputs are visible without downloading anything.
- Label provenance — every figure is tagged
Illustrative,Assumed,Sample,Planned,Not Yet Implemented,Evidence Required, orTo Be Verified. - Cross-link — record what the project feeds into, so Project 11 can consolidate without rework.
- Verify — check terminology, identifiers, dates, and chart-to-table consistency against
portfolio-standards.md.
The position the portfolio moves the organization to, as at 04-Sep-2026:
| Indicator | Jan 2026 baseline | Sep 2026 current | Q2 2027 target | Source |
|---|---|---|---|---|
| Documented ISMS scope | None | Approved | Approved | SBT-SCP-01 |
| Internal and external issues determined | 0 | 20 | 20+ | SBT-CTX-01 |
| Risks recorded and owned | 0 | 10 | 40+ | SBT-RSK-01 |
| Annex A controls assessed for applicability | 0 of 93 | 13 of 93 | 93 of 93 | SBT-SOA-01 |
| Policies drafted / approved | 0 / 0 | 6 / 0 | 14 / 14 | SBT-POL-00 |
| Internal audits completed | 0 | 0 | 2 | SBT-AUD-01 |
| Evidence items rated Green in the readiness map | 0 | 14 of 75 (19%) | 95% | SBT-EVM-01 |
| Suppliers with a completed security assessment | 0 | 0 of approximately 26 | All, once enumerated | SBT-SUP-01 |
| Staff completing annual awareness training | Not tracked | 95% for the Jul–Aug 2026 cycle | 98% | SBT-AWR-01 |
| CAPA items recorded, owned, and tracked | 0 | 8 — 1 closed, 2 overdue | All closed within target | SBT-CAP-01 |
| Continual improvement items recorded | 0 | 10 — 1 complete | Reviewed each quarter | SBT-CAP-01 |
All figures are illustrative, generated for demonstration, and each current-position figure is traceable to the named register. They are not measurements of a real organization.
The honest headline. Ten projects in, SecureBridge has a defensible plan, one control that is actually operating, and a mechanism for resolving what the rest of the portfolio found. Its scope, context, risk assessment, and control selection are approved. The awareness programme has been delivered and measured —
A.6.3is the first control to move on operational evidence rather than documentation. The CAPA register has closed one finding with independent verification and reopened another when verification found it wanting, which is the more important of the two.What remains on paper is still most of it: policies drafted and unapproved, no audit conducted, no management review held, no supplier review completed, two High-priority corrective actions overdue. The portfolio's closing position is not that the ISMS works — it is that the organization can now tell whether it does, which is the precondition for everything else.
| Framework | Edition | Role |
|---|---|---|
| ISO/IEC 27001 | 2022 | Primary certification standard — Clauses 4–10 |
| ISO/IEC 27002 | 2022 | Implementation guidance for the 93 Annex A controls |
| ISO/IEC 27005 | 2022 | Information security risk management method |
| ISO 31000 | 2018 | Enterprise risk management principles |
| ISO/IEC 27035 | 2023 | Information security incident management |
| ISO 19011 | 2018 | Guidance for auditing management systems |
| NIST CSF | 2.0 | Cross-mapping and control-maturity framing |
| CIS Controls | v8.1 | Technical safeguard benchmarking |
| DPDP Act (India) | 2023 | Personal data protection legal context |
Annex A structure used throughout: 93 controls in 4 themes — Organizational (A.5, 37), People (A.6, 8), Physical (A.7, 14), Technological (A.8, 34).
| Purpose | Tool |
|---|---|
| Controlled documents | Microsoft Word (.docx) with Markdown equivalents for GitHub |
| Registers, trackers, dashboards | Microsoft Excel (.xlsx) with native charts and conditional formatting |
| Diagrams | Hand-authored SVG — version-controlled, text-diffable, resolution-independent |
| Dashboard previews | HTML rendered headlessly to PNG |
| Version control | Git |
In five minutes — read this page, then the dashboard in 00-Portfolio-Overview/README.md.
In twenty minutes — add company-context.md for the organization and isms-implementation-journey.md for the problem being solved, then open any delivered project folder's README.
In depth — start at portfolio-standards.md to see the conventions, then trace a single risk ID forward through the projects: risk → control → evidence → audit finding → corrective action. That trace is the point of the portfolio.
- SecureBridge Technologies Pvt. Ltd. is fictional. No real organization, client, supplier, auditor, or certification body is represented.
- All data is illustrative. Risk scores, control coverage percentages, training completion rates, and audit findings are constructed to demonstrate method, not to report real measurements.
- No certification exists. No external audit, Stage 1 or Stage 2 assessment, accreditation, or
certificate is claimed. Items dated after 04-Sep-2026 are labelled
Plannedand have not occurred. - Evidence artefacts are samples. Where evidence is shown, it is an illustrative artefact created for the portfolio, not a real system record.
- Constrained by scenario design. The organization is deliberately given limited budget and no dedicated compliance headcount, so control choices favour process and configuration over tooling spend.
- Not legal or certification advice. This portfolio demonstrates practice; it is not a substitute for a qualified assessment against ISO/IEC 27001.
- Complete all ten projects, then build
11-Integrated-ISMS-Portfolio/as the consolidated view. - Extend the master evidence map into a full clause-to-evidence traceability matrix covering Clauses 4–10.
- Add a second annual ISMS cycle to demonstrate continual improvement across two full PDCA rotations.
- Map the control set to a secondary framework (SOC 2 Trust Services Criteria) to show multi-framework control reuse.
- Add automated consistency checks that validate identifiers, dates, and status vocabulary across folders.
This is a fictional portfolio project created for professional demonstration purposes.
SecureBridge Technologies Pvt. Ltd. does not exist. All companies, people, clients, suppliers, assets, incidents, audit findings, metrics, and dates are invented and clearly labelled as illustrative. Nothing in this repository represents a real audit, a real certification, a real approval, or the security posture of any actual organization. No certification body, accreditation mark, or auditor is named or implied.
The material demonstrates ISMS design, operation, and improvement practice. It is not certification advice and must not be relied on as an assessment of conformity to ISO/IEC 27001.
SECUREBRIDGE · Technologies Pvt. Ltd. Fictional organization · Portfolio project · Licensed under MIT