ISO 27001 Clauses 4 to 10: An Auditor’s Reference

ISO/IEC 27001’s requirements sit in Clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement. Clauses 1 to 3 are not audited as requirements. This page takes each sub-clause in turn, with the requirement, the documented information it expects, and the finding it usually produces.

The reason to work at sub-clause level rather than clause level is simple: a finding is cited at the sub-clause, and often at the letter. “A Clause 6 nonconformity” is not a finding anyone can act on. “6.1.3 d) — the Statement of Applicability gives no justification for excluding A.8.24” is.

A companion page covers technique — what to ask at each clause, and what a broken answer looks like. This one is the reference you check the numbering against.

Clause references are to ISO/IEC 27001. Requirements are summarised rather than reproduced, because the standard is a copyright document you buy, and an auditor should be reading the clause text itself.

The shape of ISO 27001 Clauses 4 to 10

Two things to notice. 6.3 Planning of changes is new in the 2022 revision and is routinely missed by auditors working from an older mental model. And Clause 10 puts continual improvement first and nonconformity second, which reverses the previous order — a small trap in a question about clause numbering.

The plan-do-check-act column is a teaching convention rather than part of the standard, and where a clause sits in it is arguable at the edges.

ISO 27001 Clause 4 — Context of the organization

4.1 Understanding the organization and its context. Determine the external and internal issues relevant to the ISMS’s purpose that affect its ability to achieve its intended outcomes. No documented information is required by name, which surprises people — but an organisation that cannot describe its issues has not done 4.1, and most keep a record anyway.

One addition that post-dates the main revision and is easy to miss. An amendment added climate action changes to this and to many other management system standards. It puts a requirement into 4.1 — the organisation shall determine whether climate change is a relevant issue — and a note into 4.2 recording that interested parties can have climate-related requirements. It is a short amendment and an auditable one, and an ISMS whose context analysis has never considered the question has a gap at 4.1.

4.2 Understanding the needs and expectations of interested parties. Determine the interested parties relevant to the ISMS, their relevant requirements, and which of those requirements will be addressed through the ISMS. That last element was sharpened in the 2022 revision and is worth testing: a list of interested parties with no statement of which requirements the ISMS will address is a half-done 4.2. The climate amendment adds a note here too.

4.3 Determining the scope. Three considerations, and the third is the one usually forgotten: the issues from 4.1, the requirements from 4.2, and the interfaces and dependencies between the organisation’s activities and those performed by other organisations. The scope must be available as documented information.

Typical finding: a scope drawn without reference to a major outsourced dependency, or narrowed so the riskiest service falls outside it.

4.4 Information security management system. Establish, implement, maintain and continually improve the ISMS including the processes needed and their interactions. That phrase is the hook for asking an organisation to show how its system actually fits together, and a surprising number cannot.

ISO 27001 Clause 5 — Leadership

5.1 Leadership and commitment. Top management must demonstrate leadership and commitment — ensuring the policy and objectives are established and compatible with strategic direction, integrating ISMS requirements into business processes, ensuring resources, communicating the importance of the ISMS, and supporting other management roles.

How to audit it: not by asking. Commitment leaves traces in other clauses — were the resources in 7.1 provided, did the management review in 9.3 happen with top management present, were decisions taken and recorded?

5.2 Policy. More is asked of a policy than most summaries suggest. It must be appropriate to the organisation’s purpose, include information security objectives or a framework for setting them, include a commitment to satisfy applicable requirements and to continual improvement, be available as documented information, be communicated within the organisation, and be available to interested parties as appropriate.

Typical finding: that last element. A policy the organisation has never made available to a customer that contractually expects it.

5.3 Organizational roles, responsibilities and authorities. Assigned and communicated, specifically for ensuring the ISMS conforms to the standard and for reporting on its performance to top management. Those last three words are what make the requirement testable.

ISO 27001 Clause 6 — Planning

The most heavily audited clause, and the one where sub-clause letters matter most.

6.1.1 General. Considering the issues from 4.1 and the requirements from 4.2, determine the risks and opportunities that need addressing so the ISMS can achieve its intended outcomes, prevent or reduce undesired effects and achieve continual improvement — then plan actions to address them, and how to integrate and evaluate those actions. That link back to Clause 4 is what makes 6.1.1 auditable rather than decorative. It is separate from the information security risk assessment, and routinely skipped by auditors who go straight to the risk register.

6.1.2 Information security risk assessment. Define and apply a process that establishes and maintains risk criteria (including acceptance criteria), produces consistent, valid and comparable results, identifies risks to confidentiality, integrity and availability within the scope, identifies risk owners, analyses consequences and likelihood and determines levels of risk, and evaluates and prioritises risks against the criteria. Documented information on the process is required.

Typical findings: no risk owner identified; criteria that exist but are not applied consistently; a scoring scheme nobody can explain.

6.1.3 Risk treatment. Define and apply a process that a) selects appropriate risk treatment options taking account of the assessment results; b) determines all controls necessary to implement them; c) compares those controls against Annex A to verify that no necessary control has been omitted; d) produces a Statement of Applicability containing the necessary controls, the justification for each inclusion, whether each is implemented, and the justification for excluding any Annex A control; e) formulates a risk treatment plan; and f) obtains risk owners’ approval of the plan and acceptance of the residual risks. Documented information on the process is required.

Typical findings, by letter: an exclusion without justification is 6.1.3 d); residual risks never accepted is 6.1.3 f); controls determined without any comparison against the annex is 6.1.3 c). The Statement of Applicability has a page of its own: what it must contain and how to read one.

6.2 Information security objectives and planning to achieve them. Objectives at relevant functions and levels, consistent with the policy, measurable if practicable, taking account of applicable requirements and of risk assessment and treatment results, monitored, communicated and updated as appropriate, and available as documented information. The clause also requires planning of what will be done, what resources, who is responsible, when it will be completed and how results will be evaluated. The requirement to monitor objectives is the addition in the 2022 revision; the planning list was already there in the previous edition.

Typical finding: objectives with no plan behind them — five aspirations and no owner, resource or date.

6.3 Planning of changes. Changes to the ISMS must be carried out in a planned manner. Short, new in the 2022 revision, and easy to forget.

ISO 27001 Clause 7 — Support

7.1 Resources. Determine and provide what the ISMS needs.

7.2 Competence. Determine the necessary competence of people whose work affects information security performance, ensure they are competent on education, training or experience, take action where needed and evaluate its effectiveness, and retain documented information as evidence of competence.

7.3 Awareness. People doing work under the organisation’s control must be aware of the policy, their contribution to the ISMS’s effectiveness, and the implications of not conforming. Awareness is not training — a training record is not by itself evidence that anyone is aware, and asking someone at a desk is the faster test.

7.4 Communication. Determine internal and external communications relevant to the ISMS: on what, when, with whom, and how.

7.5 Documented information. 7.5.1 requires what the standard demands plus whatever the organisation determines is necessary for the ISMS’s effectiveness. 7.5.2 covers creating and updating — identification, format, review and approval. 7.5.3 covers control: available and suitable where needed, adequately protected, with distribution, access, retrieval, storage, version control and retention addressed, and externally originated documented information identified and controlled.

Typical finding: the classic. An obsolete uncontrolled version of a procedure in use while an approved newer version exists — 7.5.3. Found by asking the person doing the work which version they use, not by asking the document owner.

ISO 27001 Clause 8 — Operation

8.1 Operational planning and control. Plan, implement and control the processes needed to meet requirements and to implement the actions determined in Clause 6 — broadened in the 2022 revision from 6.1 alone, so it now takes in the objectives at 6.2 and the change planning at 6.3. The clause also requires establishing criteria for those processes, also added in the 2022 revision;ensuring documented information is available to the extent necessary for confidence that processes were carried out as planned ; controlling planned changes and reviewing the consequences of unintended ones; and ensuring that externally provided processes, products or services relevant to the ISMS are controlled.

That last requirement is broader than the “outsourced processes” wording it replaced, and reaches a bought service as readily as an outsourced function.

8.2 Information security risk assessment. Perform assessments at planned intervals or when significant changes are proposed or occur, and retain documented information of the results.

8.3 Information security risk treatment. Implement the risk treatment plan and retain documented information of the results.

Typical finding: a risk assessment done once at certification and never repeated — 8.2, not 6.1.2. Clause 6 is the design; Clause 8 is whether it runs.

ISO 27001 Clause 9 — Performance evaluation

9.1 Monitoring, measurement, analysis and evaluation. Determine what needs monitoring and measuring, the methods to be used to ensure valid results, when it is done and by whom, and when results are analysed and evaluated by whom. Documented information on the results is required.

A note in the clause explains that methods should produce comparable and reproducible results to be considered valid. It is a note, not a requirement — useful for framing a question, not for writing a finding.

9.2 Internal audit. 9.2.1 requires internal audits at planned intervals to provide information on whether the ISMS conforms to the organisation’s own requirements and to the standard, and is effectively implemented and maintained. That first limb is what makes an organisation’s own documented procedures auditable.

9.2.2 requires an audit programme covering frequency, methods, responsibilities, planning requirements and reporting, which considers the importance of the processes concerned and the results of previous audits; defines criteria and scope for each audit; selects auditors and conducts audits ensuring objectivity and the impartiality of the audit process; reports results to relevant management; and is evidenced by documented information. Most audit-programme findings are written against that first list.

A distinction worth keeping straight: neither “coverage of the whole ISMS and all applicable controls” nor “auditors must not audit their own work” is a phrase in Clause 9.2, but each stands for something that is. What the audits have to deliver is 9.2.1, set out above, and both its limbs are requirements. How the programme is planned to deliver it — frequency, methods, responsibilities, planning requirements, reporting, and the importance of the processes concerned — is 9.2.2, as is objectivity. Cite the sub-clause that matches what your evidence is about, rather than reaching for objectivity by default.

9.3 Management review. 9.3.1 requires review at planned intervals. 9.3.2 lists the required inputs: the status of actions from previous reviews; changes in external and internal issues; changes in the needs and expectations of interested parties; feedback on information security performance, including trends in nonconformities and corrective actions, monitoring and measurement results, audit results and the fulfilment of objectives; feedback from interested parties; the results of risk assessment and the status of the risk treatment plan; and opportunities for continual improvement. 9.3.3 requires the results to include decisions on continual improvement and any need for change to the ISMS, with documented information available as evidence of those results — the verb used at 9.1, 9.2.2, 9.3.3 and 10.2 in the current edition is available, where retain belongs to 6.1.2, 6.1.3, 7.2, 8.2 and 8.3.

Typical finding: a review that considered some of the required inputs and recorded attendance rather than decisions.

ISO 27001 Clause 10 — Improvement

10.1 Continual improvement. Continually improve the suitability, adequacy and effectiveness of the ISMS. Note the order: in the 2022 revision this comes before nonconformity.

10.2 Nonconformity and corrective action. Clause 10.2 is more precise than most summaries of it. When a nonconformity occurs the organisation must react to it — controlling and correcting it, and dealing with the consequences — and then evaluate the need for action to eliminate the causes so that it does not recur or occur elsewhere, by reviewing the nonconformity, determining its causes, and determining whether similar nonconformities exist or could occur. It must then implement any action needed, review the effectiveness of any corrective action taken, and make changes to the ISMS if necessary. Documented information is required on the nature of the nonconformity, the actions taken, and the results of any corrective action.

The exam point: what is mandatory is evaluating the need to eliminate causes, not taking corrective action in every case. The finding against a correction-only response is that the evaluation was not done or not recorded.

ISO 27001 documented information, by clause

Frequently asked questions about ISO 27001 clauses 4 to 10

Where to go next: more ISO 27001 Lead Auditor exam preparation

• All 93 Annex A controls, by theme
• The ISO/IEC 27000 family: which standard does what

The technique page covers what to ask at each clause and what a broken answer looks like.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is PR373. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.