Using Notion for your ISMS

Building and maintaining an ISO 27001 Information Security Management System (ISMS) can be resource-intensive, especially for smaller organizations. It can be helpful to use document management tooling, especially if it is a tool that the organisation already uses, such as Teams/Sharepoint, Google Drive, Confluence or Notion. For organisations that already use Notion, we’ve built a free Notion template that includes a ready-to-use Risk Register.

Notion

Notion is a modern and proven collaboration and productivity platform that aims at simplifying everyday operations at organizations. The main features include structured documents, linked databases and internal and external integrations with other providers like Google or Microsoft. These features are all contained within a single interface. Among the ‘selling points’ are the ease of use, real-time collaboration and the convenience of an all-in-one workspace. For these reasons, many companies choose to build their knowledge base, project roadmaps, or even their complete CRM using Notion.

The above features overlap with the functionality of a ‘management system’, and here at the ICT institute we have extensive experience helping companies setting up their Information Security Management Systems (ISMSs). An ISMS is a structured framework of policies, procedures, and controls designed to protect an organization’s information assets systematically and continuously. It is a fundamental part of the ISO 27001 standard. Companies working towards their ISO 27001 certification, and already Notion users, can set up their ISMS on this familiar platform and use the provided template to speed up the work.

Our latest template allows you to set up an ISMS risk register directly in Notion.

A practical ISMS Notion example: the Risk Register

The Notion template is based on our basic Risk Management Process in a previous article. Risk management is a mandatory component of the ISMS whereby you identify the relevant risks, assess risks and prepare and implement a treatment plan.

We organized the risk management process into a self-contained Notion template with a Risk Register with associated controls and the organizational context in terms of relevant Issues and  the Stakeholder analysis. We link a Statement of Applicability as well, as it is a mandatory document that comes hand-in-hand with the risk register (linking ISO controls to risks).

Following the Risk Management Process, the Risk Register page implements the risk register of the identified risks: relevant risks are clearly described (Event), each risk is associated to its Confidentiality Integrity Availability (CIA) relevance, and a Source of Risk links to where the risk comes from (e.g., a risk assessment session or stakeholders issues). The Applicable in SOA column ensures all applicable controls are covered and linked to the Statement of Applicability page.

Further columns contain the ‘essence’ of a risk register which are the estimated risks: Probability estimates of the likelihood of an event (categorized as low, medium or high) and Impact, the impact on the business (low, medium or high).

You must personalize for the definitions for each low-medium-high category upon setting-up the register. The details on risk level definitions and the risk matrix with the acceptance criteria can be found in the Explanation section of the Risks Register & Context template.

Here the risk matrix maps the likelihood and impact levels to the final risk score. The risk score is used as a threshold for accepting or treating the risk, as shown in the template. We choose the threshold 5 in our examples as it works well for most of the cases. The Notion template automatically calculates the Risk score and the Treatment columns when probability and impact are defined.

If a risk cannot be accepted, it has to be treated. A good strategy on treating risk is PRACT: Prevent, Reduce, Accept, Control or Transfer. The process for deciding what to do with the risk is described in more detail in our previous article. In our example, we flag risks to be treated as Reduce which means that the we want to reduce the probability of the event occurring.

Consequently, you need to describe the Risk Treatment Plan to identify controls needed to mitigate the risk. This plan can be implemented elsewhere in your ISMS, in our case we implement it as part of the Yearly (Action) Plan together with additional documents such as Information Security Procedures. Here comes into play the risk Owner who is the role or person responsible for managing the risk (it can be linked to a team member directly or a Role in the Organizational Roles page). Once the treatment has been implemented, the risk assessment for that event needs to be updated, as in the previous procedure, to assign an after-treatment risk score.

Pros & Cons of your ISMS on Notion

What is also important for building a functional ISMS (and passing an ISO27001 audit) is how you maintain, improve and document all the components and processes of the ISMS. Notion provides features such as tracking changes with version history, integration of messaging tools to make collaboration easier, and to share information on a need-to-know basis. More advanced triggers and integrations allow you to compose automatic action upon specific events. For example, when a new risk is added to the risk register, you can instruct Notion to add the risk to the agenda on Google Calendar for the next IS team meeting, or fire a trigger to create a ticket on Jira. There are plenty of ready-made examples on the Notion Marketplace.

There are of course some limitations for building the ISMS on Notion that require a serious trade-off evaluation. A fundamental limitation is that Notion is an online-first platform, therefore not all features will work in offline mode (such as fetching new content that is not cached). In case of extremely large workspaces, performance can take a hit. It is possible to export single and multiple databases and workspaces (CSV, PDF, Markdown), however relations or links across databases will be lost when exported.

Users familiar with Excel and Word and other established applications can struggle with the Notion logic and workflow: workspaces and databases are mostly simple objects that have more limited flexibility (e.g., no nested cells, no bulk operations or personalization options like fonts or complex layouts). Finally, from the governance and compliance side, relying exclusively on Notion (like on any cloud provider) involves additional security & privacy risks and potential limitations for backups strategies.

Other resources

We also provide a Notion template for the DPIA from the GDPR, and also provide ISO 27001 and GDPR templates based on Word and Excel.