ISO 27001 requirements: clauses 4 to 10 in plain English

You must work out which external and internal issues matter to your organisation's purpose and affect what the ISMS is meant to achieve. External issues are things like regulation, threats and your market. Internal issues are things like your structure, systems and culture.

Since Amendment 1:2024, you must also decide whether climate change is one of those issues. The answer can be no, but expect an auditor to ask why.

You must identify which interested parties (people or organisations that can affect, or be affected by, your security decisions) matter to the ISMS, such as customers, regulators, staff, suppliers and owners. Then:

• work out which of their requirements are relevant, which can include legal, regulatory and contractual obligations
• decide which of those requirements the ISMS will address

Amendment 1:2024 adds a note that these parties can have requirements about climate change.

You must decide the boundaries of the ISMS and what it applies to, and keep that scope as documented information (ISO's term for documents and records in any format, including a wiki or a ticketing tool). When you set it, consider:

• the issues from 4.1
• the requirements from 4.2
• where your activities connect with or depend on work done by other organisations, such as a cloud provider or an outsourced IT team

You must set up an information security management system (ISMS) that meets this standard, then run it, maintain it and keep improving it. That includes the processes it needs and how those processes work together. An ISMS is the set of policies, processes and responsibilities you use to manage information security risk. Clauses 5 to 10 spell out what that involves.

Top management must show leadership of the ISMS by:

• making sure the policy and objectives exist and fit the organisation's strategic direction
• building ISMS requirements into normal business processes, such as procurement and onboarding, and making the resources available
• communicating why effective security and following the ISMS matter
• making sure the ISMS achieves its outcomes, directing and supporting people, promoting continual improvement and supporting other managers in their own areas

Top management must set an information security policy that:

• suits the organisation's purpose
• includes security objectives, or a framework for setting them
• commits to meeting applicable security requirements
• commits to continually improving the ISMS

The policy must be kept as documented information, communicated inside the organisation and made available to interested parties where appropriate.

Top management must make sure that people in roles relevant to information security have clear responsibilities and authorities, and that these are communicated across the organisation. It must also give someone the responsibility and authority for:

• making sure the ISMS meets this standard
• reporting to top management on how the ISMS is performing

When you plan the ISMS, you must use the issues from 4.1 and the requirements from 4.2 to work out which risks and opportunities need attention, so that the ISMS can achieve its outcomes, undesired effects are prevented or reduced, and it keeps improving. In practice these are risks to the ISMS itself, such as a key person leaving, rather than the security risks in 6.1.2. You must then plan actions to address them, how those actions fit into your ISMS processes, and how you will check they worked.

You must define and use a risk assessment process that:

• sets and maintains risk acceptance criteria (how much risk you accept) and criteria for carrying out assessments
• gives valid, consistent and comparable results when repeated, usually through defined rating scales
• identifies risks to the confidentiality, integrity and availability of information in scope, and names the risk owners (who answers for each risk)
• analyses consequences and realistic likelihood to set risk levels, then compares them with your criteria and ranks them for treatment

You must keep documented information about this process.

You must define and use a risk treatment process that:

• chooses treatment options (reduce, avoid, share or accept) from the assessment results and sets the controls they need, from any source
• checks those controls against Annex A so nothing necessary is missed
• produces a Statement of Applicability: the necessary controls, why they are included, whether they are implemented and why any Annex A control is excluded
• creates a treatment plan that risk owners approve, accepting the residual risk (what remains after treatment)

You must keep documented information about this process.

You must set security objectives, such as cutting the time to fix critical vulnerabilities, where relevant across functions and levels (a small organisation may need one set), and plan how to reach them. Objectives must:

• fit the policy and reflect applicable security requirements and risk results
• be measurable where practicable, monitored, communicated and updated as needed
• be kept as documented information

Your plan must say what will be done, with what resources, who is responsible, when it will finish and how results will be evaluated.

When you decide the ISMS needs to change, you must make the change in a planned way. That applies to changes to the ISMS itself, such as adding a site to the scope, a restructure or a new risk method. The standard sets no format, so a plan can be as simple as the change, the reason, who is responsible, when it happens and what else it affects.

You must work out and provide the resources needed to set up, run, maintain and continually improve the ISMS. Resources include people, time, budget, tools and outside expertise. The standard sets no minimum level and asks for no particular record here, so the test is whether the ISMS can do what it says. Audits running late or actions stuck for lack of staff point to a gap.

You must decide what competence people need when their work affects your security performance, including contractors and others working under your control. Then:

• make sure they are competent through education, training or experience
• where they fall short, take action such as training, mentoring, reassignment or hiring, and check it worked
• keep documented information that proves their competence

Everyone doing work under your control must know:

• the information security policy
• how they contribute to an effective ISMS, including the benefits of better security performance
• what follows if they do not meet ISMS requirements

This reaches further than 7.2 because it covers all staff and contractors. The standard sets no method, so inductions, briefings and reminders all count if people really know these things.

You must decide what needs communicating about the ISMS, inside and outside the organisation, and for each item work out:

• what to communicate
• when to communicate it
• who to communicate it to
• how to communicate it

A simple table often does the job. It can cover routine items such as policy updates and performance reports, and messages to customers, suppliers and regulators.

Your ISMS must include the documents and records this standard requires, plus any others you decide it needs to work well. The amount can vary with your size, activities, complexity and how competent your people are. You must:

• identify each one, use a suitable format, and review and approve it
• keep it available where needed and properly protected
• control distribution, access, storage, changes, retention and disposal as applicable, including outside documents you rely on

You must plan, run and control whatever processes you need to meet your ISMS requirements and carry out the actions from clause 6. That means:

• setting criteria for those processes, such as how quickly a leaver's access is removed, and running them to those criteria
• keeping enough documented information to show they ran as planned
• controlling planned changes, and reviewing unintended ones and acting on any harm as needed
• making sure relevant outside processes, products and services are controlled

You must carry out risk assessments on a planned schedule, or when a significant change is proposed or happens, using the criteria you set under 6.1.2. You must keep documented information of the results. Clause 6.1.2 requires you to define and use the process, and this clause says when to run it. The standard sets no fixed frequency, so set one you can justify and follow it. Many organisations reassess at least once a year.

You must carry out the risk treatment plan you created under 6.1.3 and keep documented information of the results. The plan cannot stay on paper: its actions need to happen as planned, and you need a record of what was done. The standard sets no format for these results, so an updated plan or register showing the status of each action is a common way to hold them.

You must evaluate your security performance and how effective the ISMS is. To do that, decide:

• what to monitor and measure, including processes and controls, such as patch times or phishing reports
• which methods to use, so results are valid, comparable and reproducible
• when to measure, and when to analyse and evaluate the results
• who does the measuring, and who does the analysis

You must keep documented information as evidence of the results.

You must run internal audits at planned intervals, which show whether the ISMS meets your own requirements and this standard, and is effectively implemented and maintained. You must also:

• keep an audit program covering frequency, methods, responsibilities, planning and reporting, shaped by each process's importance and past results
• set criteria and scope for every audit, and use objective, impartial auditors
• report results to relevant management
• keep evidence of the program and results

Top management must review the ISMS at planned intervals to confirm it remains suitable, adequate and effective. The review must consider:

• actions from earlier reviews, and changes in issues and in interested parties' needs
• trends in nonconformities and corrective actions, monitoring results, audits and objectives
• feedback from interested parties, risk assessment results, treatment plan status and improvement opportunities

Results must include decisions on improvement and ISMS changes, and you must keep evidence of them.

You must keep improving how suitable, adequate and effective the ISMS is. Suitable means it fits your organisation, adequate means it is enough for your risks and requirements, and effective means it achieves what you planned. The standard sets no target or method, so you show this through the results of audits, reviews, corrective actions and your measures over time.

When something fails to meet a requirement (a nonconformity), you must:

• react, and where applicable control and correct it and deal with the consequences
• decide whether to remove its causes, by reviewing it, finding the causes and checking whether similar problems exist or could occur
• carry out any action needed, check it worked and change the ISMS if necessary

Actions must suit the effects of the problem. Keep evidence of each nonconformity, what you did and the results.