ISO/IEC 42001 SIMS as a Service

The service

This is a service for organisations that need an SI management system that meets ISO/IEC 42001, and need it operating, not written as a manual. IT Governance guides the client at every level: the governing body, the managers who own the processes, and the people who perform the work. The work runs on the SI management system platform.

ISO/IEC 42001 requires the organisation to establish, implement, operate, monitor and improve an SI management system. It can be certified. It does not prescribe the full catalogue of management processes. The process model, Control Objectives for SI Systems (AICOB), is what turns those requirements into assigned processes, owners and work products. That is the structure the service uses.

What the service does

IT Governance does not certify the organisation. Certification is a decision for the certification body. The service guides the organisation through the work the standard requires, on the platform, so that an assessor can sample a working system.

• Guidance at every level - the board is advised on what it has to evaluate, direct and monitor. Managers are assisted with the accountability framework, the objectives and the management review. Staff are trained in the duties the system assigns to them, and in how those duties are performed on the platform.
• A working SIMS - context, leadership, planning, support, operation, performance evaluation and improvement are run as processes. Each process has an owner, inputs, outputs and a work product. The record is produced as the work is done.
• The process model - AICOB is IT Governance's intellectual property. It is embedded in the platform. Law, the standard and internal policy are mapped onto it, so a control can be shown to exist for a named clause, not only that it exists. The same model runs through the other systems, so an ISO/IEC 42001 system can sit beside the EN 18286 quality management system, the risk systems and the data-protection work without a second operating model.
• Effectively implemented - an implemented system is one the organisation can show operating: assigned work, records, management review, internal audit and improvement. That is the advantage. A policy pack can be read. A working SIMS can be sampled. The service is aimed at the second.

The platform

The service uses the SI management system platform. The platform is the environment the processes run in: projects, issues, workflows, custom fields, documents and role-based access, structured around the lifecycle of the SI system and the clauses of the standard.

The platform is available in two forms. It can be deployed stand-alone. It can also run on Nextcloud, an open-source collaboration platform an organisation can host itself or have hosted. Nextcloud adds file storage, user and group management, and federation, so selected records can be shared with a group company, an auditor or a key supplier without consolidating every system into one. The process model is the same in both. Nextcloud is the environment the record stays in.

How the engagement runs

• Start - the SI systems, their intended purpose, and the current state of the management system are recorded on the platform.
• Plan - the work is sequenced against ISO/IEC 42001. Owners are assigned. Gates are set.
• Build - the organisation's people complete the processes on the platform. IT Governance guides the sequence, trains the owners, and advises where a duty is incomplete.
• Prepare - management review, internal audit and the evidence an assessor will sample are brought to the point at which the organisation can decide whether to seek certification.
• Hand over - the SIMS stays with the organisation. The platform remains the environment the processes run in. Ongoing operation stays with the named owners.

Who it is for

• Organisations that must show conformity with ISO/IEC 42001, whether they are preparing for certification or running the system after it
• Teams that need the work guided, and their own staff trained to perform the duties
• Boards and managers that need a working system, with an accountability framework and a record an assessor can sample

IT Governance does not certify the organisation and does not declare it compliant. Those decisions sit with the certification body. The service makes the work visible so the decision can be made on evidence.