Which approach should organizations use to implement an ISMS based on ISO/IEC 27001?

ISO/IEC 27001:2022 does not prescribe a specific approach for implementing an ISMS, but rather provides a set of requirements and guidelines that can be adapted to the organization’s context, scope, and objectives. Therefore, organizations can use any approach that is suitable for their scope, as long as it meets the requirements of the standard and enables the achievement of the intended outcomes of the ISMS. The approach should also consider the needs and expectations of the interested parties, the risks and opportunities related to information security, and the legal and regulatory obligations of the organization.

ISO/IEC 27001:2022, clause 4.1; PECB ISO/IEC 27001 Lead Implementer Course, Module 4, slide 9.