Information Security Management System - ISO/IEC 27001 Requirements
Clauses 4–10
ISO/IEC 27001:2022 states its requirements in Clauses 4–10: 4 Context (internal and external issues, interested parties, ISMS scope), 5 Leadership (policy, roles, responsibilities and authorities), 6 Planning (risk assessment, risk treatment, Statement of Applicability, information security objectives, planning of changes), 7 Support (resources, competence, awareness, communication, documented information), 8 Operation, 9 Performance evaluation (monitoring and measurement, internal audit, management review), 10 Improvement (nonconformity and corrective action, continual improvement).
Annex A contains 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34).
Required documented information
Scope; policy; risk assessment and risk treatment results; Statement of Applicability; objectives; evidence of competence; operational records needed to demonstrate processes were carried out as planned; monitoring results; internal audit programme and results; management review results; evidence of nonconformities and corrective actions.
Traps
- The SoA must address all Annex A controls, marking each applicable or not, with justification - not just those selected.
- Objectives must be measurable where practicable, monitored, communicated, updated and supported by plans.
- Risk assessment is required at planned intervals or on significant change, not once.
- Internal audits must be planned, taking account of process importance and previous results.
- A frequent wrong answer: 'every Annex A control must be implemented'.
Rule of thumb
'Say what you do, do what you say, prove it.' Every requirement should trace to a policy, an implemented process and a record.