---
title: "Who Should Own Your ISMS After Certification?"
description: "Who should own ISO 27001 after certification: the owner's real duties, hours per month, surviving the owner leaving, and when to bring in a virtual CISO."
canonical: https://www.isosecurity.co.uk/resources/who-should-own-your-isms
updated: 2026-11-10
---

# Who should own your ISMS after certification?

One named person, with authority and a few protected hours a month, a deputy who attends the reviews, and a documented annual rhythm that survives either of them leaving. Most post-certification failures trace back to an ownership vacuum.

## What does an ISMS owner do?

- Keeps the annual calendar: risk reviews, access reviews, supplier checks, internal audit, [management review](/resources/iso-27001-management-review).
- Chases actions and corrective actions to closure, with evidence.
- Makes sure change (new systems, suppliers, services, people) triggers risk and [SoA](/resources/statement-of-applicability) updates.
- Keeps evidence accumulating where it can be retrieved in minutes at [surveillance](/resources/iso-27001-surveillance-audit).
- Reports upward honestly, including when the system is drifting.

The owner needs standing more than technical depth: a coordinator who makes sure technical controls (held by IT and suppliers) are decided, done and evidenced.

## Who should you choose as ISMS owner?

| Candidate                           | Strength                                                  | Watch for                                                        |
| ----------------------------------- | --------------------------------------------------------- | ---------------------------------------------------------------- |
| Operations or compliance lead       | Process discipline, diary control, cross-functional reach | Needs access to senior security judgement for risk decisions     |
| IT manager                          | Understands systems and suppliers                         | System can shrink into a technical checklist; governance starves |
| Founder or director (small firms)   | Authority is unquestioned                                 | Time evaporates; deputy arrangements matter most here            |
| External vCISO owning the programme | Seniority, audit-side experience, continuity              | Management must still visibly own decisions; see below           |

## How much time does ISMS ownership take?

For a small certified organisation with a sensible system, coordination is typically a few hours a month, rising around internal audit, management review and the external visit. If your ISMS needs days a week of upkeep, simplify it (fewer, lived policies; automated evidence where systems provide it) before you add headcount.

My [maintenance guide](/resources/how-to-maintain-iso-27001-certification) lays out the rhythm month by month.

## When does outsourcing the ISMS programme make sense?

When nobody internal has the standing or the time, when the previous owner has left, or when surveillance findings have shown what drift costs, outsourcing the programme makes sense. A [virtual CISO](/resources/what-is-a-virtual-ciso) then owns the calendar and the evidence while your leadership keeps the decisions the standard reserves to it; my [ongoing brief at Chaucer](/case-studies/chaucer-iso-27001) works exactly this way.

It starts with a review of where the system stands today, and it is the core of my [ongoing CISO services](/virtual-ciso-services).

## Frequently asked questions about ISMS ownership

### Who should own ISO 27001 after certification?

One named person with authority, time and a deputy: keeping the risk register current, tracking actions, maintaining evidence, running the internal audit programme and preparing management review. In many organisations this is an operations or compliance lead with a few hours a month, escalating security judgement to senior help where needed.

### What happens when the ISMS owner leaves?

Usually, drift: reviews stop, evidence thins, and the next surveillance audit becomes an emergency. Protect against it by documenting the annual rhythm, keeping evidence in systems rather than personal drives, naming a deputy who attends reviews, and treating the role as part of the post.

### Can ownership of the ISMS be outsourced?

The work can, while the accountability stays with your top management under clause 5 whatever you outsource. A virtual CISO can own the programme (calendar, evidence, audit preparation and reporting) while your leadership retains the decisions: accepting risk, approving policy, resourcing improvements.

## Contact

Certified, but nobody owns the system now? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.