Planning (Clause 6)
Planning (Clause 6)
Clause 6 is the risk engine of the ISMS. The exam tests the difference between risk assessment and risk treatment, the role of the Statement of Applicability (SoA), how objectives are made measurable, and the newer 6.3 requirement for planned changes.
Core rules
- 6.1.2 risk assessment: establish and apply a process that produces consistent, valid, comparable results; define risk criteria and acceptance criteria; identify risks to confidentiality, integrity, and availability; identify risk owners; analyze consequences, likelihood, and level; evaluate; retain documented information.
- 6.1.3 risk treatment: select appropriate options, determine necessary controls, compare them with Annex A, and produce an SoA that justifies inclusion and exclusion of each Annex A control. Retain the treatment plan and SoA as documented information.
- 6.2 objectives: set measurable objectives where practicable, consistent with policy, monitored, communicated, and updated; retain documented information.
- 6.3 planning of changes: carry out ISMS changes in a planned manner, considering purpose, consequences, integrity, resources, and responsibilities.
Worked example
A team excludes Annex A 8.11 data masking because 'we do not mask data'. The exam-style reasoning: first check whether masking is relevant to identified risks, such as personal data copied into test or analytics environments. If it is relevant, exclusion needs a justified rationale and a treatment decision, not a capability statement. The SoA should say why the control is excluded and what compensating control, if any, addresses the risk. Otherwise the exclusion is an audit finding.
Traps that cost marks
- Producing a risk register without risk owners or acceptance criteria.
- Treating the SoA as a copy of Annex A rather than a justification document.
- Setting objectives such as 'improve security' with no measure, owner, or review.
- Ignoring 6.3 and managing ISMS changes as ordinary IT changes.