The setup under Set up ISMS takes you to a working ISMS in 22 steps. This article explains how the steps are structured, what the buttons “Looks good”, “Not relevant”, “Complete step” and “Later” do, and how you adopt an existing ISMS.

Before you start

  • The setup is visible to people who may set up the ISMS. By default, this is the functional role ISMS manager, which every Tenant Admin has automatically.
  • The setup is included in all plans.
  • You can interrupt at any time. Completed items are ticked off automatically based on your entries.

The steps at a glance

The steps are arranged in groups. The order is deliberate: rules first, then data.

  1. Organisation: Enter organisation.
  2. Context: Record internal and external issues, Record interested parties.
  3. Collaboration & approval: Define roles and responsibilities, Invite team, Set up approvals, Define scope. More on this in Regulating approvals with the four-eyes principle.
  4. Leadership: Add information security policy, Define information security objectives.
  5. Risks: Define the risk methodology, Check threat catalogues, Define risk reporting and acceptance.
  6. Requirements: Create requirement catalogue.
  7. Assets: Check asset structure, Define dependency chain, Define checks for assets, Define data protection, Record first assets.
  8. Incidents: Set up incident management.
  9. Employees: Involve employees.
  10. Management: Plan internal audit, Plan first management review.

How to do it

  1. Open Set up ISMS. At the top, you see the progress and the next step.
  2. Click Do it now. Varmo opens the page on which you complete the step.
  3. Read the notice at the top of the page. It is divided into What is it about?, Why does it matter? and What you do now. An info icon explains technical terms.
  4. Enter the details. Once an item is done, it is ticked off. With Do it now next to an item, you jump directly to where something is missing.
  5. Once the step is done, the notice highlights the next step. With Next: …, you go there.

The buttons in a step

  • Looks good

    confirms the preset

    Step completed
  • Complete step

    minimum requirement met

    Step completed as long as the minimum requirement remains met
  • Not relevant

    with justification, for two steps only

    Marked as not applicable
  • Later, next: …

    postponed

    Step remains open, setup continues
What the buttons in a setup step do

Looks good confirms a preset and completes the step. Complete step completes a step involving work over several days as soon as the minimum requirement is met; if it is later no longer met, the step is open again. Not relevant marks a step as not applicable with a justification, for two steps only. Later postpones the step; it remains open and setup continues.

  • Looks good: confirms a preset, for example the prepared role model or the preset risk methodology. It only exists for steps with a preset. For some steps, you confirm several items individually, for example for Define data protection.
  • Complete step: for work over several days, for example Invite team or Record first assets. The button is only available once the minimum requirement is met. If it is later no longer met, the step is open again.
  • Not relevant: marks a step as not applicable with a justification. This is only possible for Involve employees and Plan internal audit. All other steps are marked Mandatory because otherwise the ISMS does not work correctly. Please note: under ISO/IEC 27001, the internal audit (clause 9.2) and employee awareness (clause 7.3) are mandatory. Only choose Not relevant if your organisation does not aim for conformity with ISO/IEC 27001.
  • Later, next: …: postpones a step. It remains open, and setup continues with the next step.

Adopting an existing ISMS

In the Enter organisation step, you answer the question of whether you want to adopt already approved ISMS documents into Varmo. If you choose Yes, we are adopting existing documents, the texts of the setup adapt:

  • Scope: transfer the adopted scope as a draft and choose Adopt existing approval at the top. You state who approved it and when, and upload the evidence as a PDF (signed document or minutes). Top management then confirms the adoption in Varmo; only then is the scope valid.
  • Policy: under Policies, choose Add information security policy, upload the valid version and choose Already approved (existing ISMS) – with evidence. The approvers then confirm the adoption in Varmo.

A new approval is then not required. The version remains marked as an adopted approval; the next revision goes through the approval workflow again.

What happens next

  • My tasks always shows the next open step. Postponed steps only appear there when nothing else is open, then as the task Postponed setup steps. In this case, Set up ISMS shows “Your ISMS is partially set up”, and the menu item remains. You work normally in the ISMS and catch up on the steps.
  • Once all steps are done, Varmo shows “Your ISMS is set up” with your next steps in operation. Set up ISMS disappears from the menu and from the dashboard.
  • Approvals of scope and policy follow in operation as a task for the approver.

Frequently asked questions

Can I reopen a step?

Yes. For a confirmed step or one marked as not relevant, choose Reopen. The step then counts as open again. It appears under My tasks as soon as it is the next open step.

Why is a completed step suddenly open again?

Steps with a minimum requirement check your data continuously. If, for example, you remove the only other person, Invite team is open again.

Where do I change settings after setup?

Under ISMS settings. The setup only guides you to these pages.