Understand the organisation and scope.
Top management commitment and policy.
Address risks and set objectives.
Resources, people and documentation.
Run the processes that manage risk.
Monitor, audit and review.
Fix nonconformities and improve.