|

Compliance guide

ISMS Manual: draft, review, approval and version history

Follow the compact manual workbench from first draft to independent approval, with accurate completion and version-history interpretation.

ISMS contributor, Compliance Manager or authorised Compliance Approver 15-minute step-by-step tutorial Updated 15 October 2026

Find the manual and know which version you are editing

From the ISO 27001 workspace, open ISMS Manual configuration. The compact heading shows the manual title, drafting progress, document status and the important actions Preview manual and Submit for review.

The content editor appears immediately below the header. This is intentional: the task of writing and reviewing the manual should not require scrolling past large summary panels. The extra information remains available under Manual overview.

Draft ≠ approved. “36 of 45 sections complete” means 36 saved sections were marked complete for drafting. It does not say that 36 ISO requirements are compliant or that those sections have passed independent review.

1. Draft and save each section

  1. Choose the relevant clause and read its purpose and prompts.
  2. Use Narrative to describe the real organisational approach, and the Register or Evidence tab when available for the clause.
  3. Choose Edit, make your changes and save. Reopen or preview the content to confirm it persisted.
  4. Check the entry against real risks, ownership, adopted Controls, approved policies and working practices.
  5. Mark complete only when the section is sufficiently drafted; use Open next unfinished section for the next gap.

If AI generation is enabled, use it as a draft to verify and edit. Do not disclose credentials, secrets or unnecessary confidential data to AI services. Keep accountability with the organisation's reviewer.

2. Expand Manual overview only when needed

Select Manual overview to reveal the draft → independent review → approved lifecycle, saved-section counts, submission history, supporting records and optional guided setup steps. Use the same control to collapse it. Expanding the section may load history and link summaries from the existing APIs.

Supporting records and traceability presents relationship counts: manual-to-evidence, SoA-to-risk, SoA-to-evidence and SoA-to-policy links. A count is not confirmation that those references are sufficient or still current.

The Guided setup steps help with organisational context, interested parties, scope, leadership and risk planning. They are optional prompts, not extra mandatory certification stages.

3. Prepare and submit for review

  • Confirm the scope and the approved organisational names and descriptions.
  • Check each narrative for factual accuracy; remove placeholder or outdated text.
  • Confirm mandatory planning information, objectives and role assignments exist and are understood.
  • Review linked supporting records for relevance without claiming that a link proves effectiveness.
  • Resolve or explicitly identify known gaps, contradictions and unreviewed AI material.
  • Use Preview manual to inspect the assembled document.

Select Submit for review and follow the confirmation dialog. The submission is a request for an authorised human approval, not a certification submission. A pending-review state can lock editing to protect the reviewer from content changing underneath the request.

4. Independent approver's responsibilities

  1. Open the pending manual review using an account with the applicable reviewer permission.
  2. Examine the submitted manual (and the frozen version where supported), not just the live working document.
  3. Check scope, leadership, consistency across clauses, process ownership, key obligations and what is not yet evidenced.
  4. If the work is acceptable, approve the exact submitted version. Otherwise reject it with actionable review feedback and request correction.
  5. Confirm that the decision appears in the manual submission history.

Separate reviewer and contributor duties where your governance model requires an independent decision. A contributor should not treat their own draft-completion flag as reviewer approval.

5. Understand the frozen-version safeguard

In deployments with the Manual Version Integrity migration applied, each new submission has its own read-only snapshot and fingerprint. The approval operation is tied to that submitted material so a change to the live working manual cannot silently redefine the historical approval. A reviewer can inspect submission history and the submitted version as a historical record.

Know the limits. A frozen manual contains the manual's submitted records; it does not freeze the independently maintained SoA, risk register, policies or external evidence. Older approvals made before the feature was installed cannot be assumed to have equivalent historical snapshots.

6. Maintain the manual after approval

When the organisation changes services, suppliers, risk profile, law, technology or governance, assess which clauses require updating. Make a controlled working revision, record what changed and obtain a new review when appropriate. Retain the previously approved version as the historical position for its period.

Do not change an older approved snapshot to make it resemble today's practices. Update the new working version and its separately governed supporting records.

Troubleshooting

Submit for review is disabled

Check role permissions, current lifecycle state, required fields, incomplete submission prerequisites and any already-pending request.

Editing is locked

Check whether there is a pending review. Resolve it through the authorised reviewer rather than trying to bypass the lock.

Approved version cannot be found

Open Manual overview → Manual submission history. Check whether the approval predates the frozen-version feature or whether the relevant migration was applied.

Progress counts are unexpected

Compare with the saved sections and completion flags; an expanded overview does not change the underlying calculation.