ISO 27001 Clause 6.3: Planning of Changes Explained

Clause 6.3 requires that changes to the information security management system are carried out in a planned manner. It was added in the 2022 revision, it is one sentence long, and it is about changes to the management system itself — not about technical change management, which is Annex A control A.8.32.

The worked findings on this page are invented, and so are the organisations in them. They are written to show how a finding is built and graded, not to catalogue the findings you should expect.

What ISO 27001 Clause 6.3 says, and how little of it there is

One sentence. When the organisation determines the need for changes to the ISMS, the changes shall be carried out in a planned manner.

That brevity is why it gets missed. There is no list of what planning must include, no documented information required by name, and nothing to tick. An auditor working from a checklist built before the 2022 revision will not have a line for it at all.

It is still a shall, and it is auditable.

The Clause 6.3 distinction that decides exam answers

Clause 6.3 is about changes to the management system. A.8.32 is about changes to information processing facilities and systems. Different objects, different requirement, different citation.

The confusion is understandable, because the words “planned” and “change” appear in both. Ask what is being changed. If the answer is a system, a service or a configuration, it is Annex A — often more than one control, since a single change can engage change management, configuration management and cloud controls together. If the answer is the ISMS itself — its scope, its processes, its roles, its risk method — it is 6.3.

There is a third relative worth keeping separate. Clause 8.1 requires planned changes to be controlled and the consequences of unintended changes to be reviewed, in the context of operational planning. And Clause 8.2 requires risk assessments to be performed when significant changes are proposed or occur. A single event can engage several of these, and naming the right one is the whole of the answer.

How you audit one sentence: ISO 27001 Clause 6.3

You cannot ask to see the Clause 6.3 procedure, because none is required. What you can do is find a change that happened and look at how it was made.

Find the changes first. They are easiest to spot in the management review records, in the risk register’s revision history, in the internal audit programme, and in the scope statement’s version history. Ask directly: what has changed about the ISMS since the last audit?

Then take one and ask four questions. Was the need for it determined, or did it simply happen? Was anything planned — who, when, what would be affected? Were the consequences considered, particularly for the risk assessment and the Statement of Applicability? And was the change actually carried through, or is it half-made?

The half-made change is the finding to look for. An organisation that restructured six months ago, whose risk register still names owners who have left, has made a change to the ISMS that was not carried out in a planned manner — and the evidence is sitting in a document you were reading anyway.

A worked ISO 27001 finding on Clause 6.3

Kestrel Freight merged two operating divisions and brought the smaller one into the ISMS scope. The scope statement was updated. Nothing else was.

And the same discipline as always: the finding states the gap. Why it happened is the organisation’s to establish under Clause 10.2, and an auditor who supplies the cause has handed over something to argue about.

Note also what this finding is not cited as. It could have been written at 4.3, at 6.1.2, or at 8.2, and an auditor might raise those as separate findings on the same evidence. Citing 6.3 says something the others do not: that the organisation changed its management system without planning the change, which is the accurate description of what went wrong.

Major or minor on ISO 27001 Clause 6.3

Grade from the evidence and its reach, never from how serious it feels. A major is a significant or systemic failure — a requirement absent, a process that is not operating, a breakdown that raises doubt the ISMS can achieve its intended results. A minor is an isolated or occasional lapse that does not by itself break the system. Several related minors can together show a systemic problem and become a major.

Major territory: a substantial change to the ISMS — scope, structure, methodology — made with no planning and with the dependent processes left behind.

Minor territory: a change that was planned but whose consequences for one document were not followed through.

Opportunity: changes handled sensibly but informally, where nothing has been missed and the organisation is growing to a size where informality will stop working.

Why Clause 6.3 was added to ISO 27001:2022

Worth a sentence, because it explains what the clause is aimed at. Management systems tend to be built carefully and then changed casually. The scope moves, a methodology is replaced, a team is reorganised — and each change is made in isolation, leaving the parts that depended on it out of step.

The clause makes that pattern citeable. Before it, an auditor finding an ISMS out of step with its own organisation had to reach for whichever dependent clause had visibly failed. Now there is a requirement that describes the actual problem.

Frequently asked questions about ISO 27001 Clause 6.3

Where to go next: more ISO 27001 Lead Auditor exam preparation

Auditing Clause 4: context, interested parties and scope

Auditing Clause 5: leadership, policy and roles

Auditing Clause 6: risk assessment, treatment and objectives

Auditing Clause 7: competence, awareness and documented information

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.