\n\n| Scope & Planning<\/td>\n | Scope, leadership alignment, resources<\/td>\n | Depends on organisational complexity<\/td>\n<\/tr>\n |
\n| Risk Assessment<\/td>\n | Asset and risk identification, treatment decisions<\/td>\n | Depends on scope and risk maturity<\/td>\n<\/tr>\n |
\n| SoA & Control Design<\/td>\n | Control selection and documentation<\/td>\n | Depends on existing controls<\/td>\n<\/tr>\n |
\n| Implementation<\/td>\n | Policies, processes, controls<\/td>\n | Depends heavily on readiness<\/td>\n<\/tr>\n |
\n| Evidence Collection<\/td>\n | Operating controls and producing records<\/td>\n | Requires sufficient operating history<\/td>\n<\/tr>\n |
\n| Internal Audit<\/td>\n | Audit, findings, corrective actions<\/td>\n | Cannot be treated as a paperwork exercise<\/td>\n<\/tr>\n |
\n| Management Review<\/td>\n | Performance and governance review<\/td>\n | Requires meaningful ISMS inputs<\/td>\n<\/tr>\n |
\n| Stage 1<\/td>\n | Documentation and readiness assessment<\/td>\n | Certification-body dependent<\/td>\n<\/tr>\n |
\n| Stage 2<\/td>\n | Evidence and implementation audit<\/td>\n | Requires operational evidence<\/td>\n<\/tr>\n |
\n| Certification<\/td>\n | Closing applicable findings<\/td>\n | Depends on audit outcomes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n |