Implementing the ISMS (Clauses 7 and 8)
Support (Clause 7)
Implementation depends on support processes. Resources (7.1) must be determined and provided. Competence (7.2) requires determining necessary competence, ensuring people are competent (education, training, experience), evaluating the effectiveness of actions taken, and retaining evidence. Awareness (7.3) requires staff to know the policy, their contribution to the ISMS, and the implications of not conforming. Communication (7.4) requires deciding what, when, with whom and how to communicate. Documented information (7.5) must be created, updated and controlled: availability, protection, distribution, access, retrieval, use, retention and disposition.
Operation (Clause 8)
8.1 requires planning, implementing and controlling processes to meet requirements, including control of outsourced processes. 8.2 requires performing risk assessments at planned intervals or when significant change occurs. 8.3 requires implementing the risk treatment plan and retaining documented information of results.
Controls in practice
The 2022 Annex A introduced new controls such as threat intelligence, cloud service security, ICT readiness for business continuity, configuration management, information deletion, data masking, data leakage prevention and monitoring activities. Implementation means operation, not acquisition: a tool in a rack is not a control until someone runs it, on a defined frequency, producing evidence.
Traps. Examiners blur competence, awareness and training: training is one means to competence, awareness is about understanding consequences. Another trap is assuming every document needs top-management approval - only what the standard or the organization requires. A frequent error is describing policies written but never applied; auditors look for operational evidence such as tickets, logs, minutes and records.
Rule of thumb. For each selected control ask three questions: who performs it, how often, and which record proves it happened? If any answer is missing, the control is planned, not implemented.