Planning the Implementation of an ISMS (ISO/IEC 27001, Clause 6)
Risk planning (6.1)
Clause 6 requires planning to address risks and opportunities. The information security risk assessment process (6.1.2) must define and apply risk acceptance criteria and criteria for performing assessments, ensure repeatable results, identify risk owners, and be applied consistently. Risk treatment (6.1.3) selects appropriate options, determines necessary controls, compares them with Annex A, and produces:
- a Statement of Applicability (SoA) - for every Annex A control: whether it is included, the justification for inclusion, or the justification for exclusion, plus implementation status;
- an information security risk treatment plan;
- risk owner approval of the plan and acceptance of residual risk.
Annex A in the 2022 revision contains 93 controls in four themes: organizational, people, physical and technological. All must be considered; none is automatically excluded.
Objectives planning (6.2, 6.3)
Information security objectives must be consistent with the policy, measurable (where practicable), monitored, communicated and updated. The plan for each objective answers: what, which resources, who is responsible, when it will be completed, and how results are evaluated. Clause 6.3 requires changes to the ISMS to be planned.
Traps. Watch for questions that treat the SoA as a control catalogue to copy, or that say excluded Annex A controls need no explanation. Exclusions always need a documented justification and evidence the resulting risk is acceptable. Another common trap is confusing the risk treatment plan (an action plan) with the SoA (a declaration of control status). Also beware answers that rank risks only by impact or only by likelihood, ignoring the defined criteria.
Rule of thumb. For every Annex A exclusion, demand two things: a reason the control is not necessary, and evidence that the risk it would address is within the acceptance criteria. If either is missing, the SoA will not survive an audit.