A Clause Map for the ISO 27001 Lead Auditor Exam
This is a revision map, not an explanation. Each sub-clause of ISO/IEC 27001 appears once, with what it requires and the kind of failure that belongs to it, so that a scenario can be turned into a citation quickly. The clause pairs most often confused are set out separately after the map.
This is a revision map, not an explanation. Each sub-clause of ISO/IEC 27001 appears once, with what it requires and the kind of failure that belongs to it, so that a scenario can be turned into a citation quickly. The clause pairs most often confused are set out separately after the map.
Requirements are summarised rather than reproduced, because the standard is a copyright document you should be working from directly. Use this to find the clause, then read the clause.
ISO 27001 Plan — Clauses 4, 5 and 6
| Sub-clause | What it requires | The failure that belongs here |
|---|---|---|
| 4.1 | Determine external and internal issues affecting the ISMS’s intended outcomes. ISO/IEC 27001:2022/Amd 1:2024 adds climate change as a question to be determined | No issues determined; issues never revisited after material change |
| 4.2 | Determine interested parties, their relevant requirements, and which of those the ISMS will address. The same amendment adds a note that relevant interested parties can have requirements related to climate change | A list of parties with no statement of which requirements the ISMS addresses |
| 4.3 | Determine the scope considering a) the 4.1 issues, b) the 4.2 requirements and c) interfaces and dependencies with other organisations. Available as documented information | A boundary drawn without considering one of the three — usually c) |
| 4.4 | Establish, implement, maintain and continually improve the ISMS including the processes needed and their interactions | Nobody can show how the system fits together |
| 5.1 | Top management to demonstrate leadership and commitment, including ensuring resources, integrating the ISMS into business processes and promoting improvement | Resources the organisation itself determined were needed, not provided |
| 5.2 | A policy appropriate to purpose, with objectives or a framework for them, commitments to satisfy requirements and to improve, documented, communicated internally and available to interested parties as appropriate | A policy missing one of the seven elements — most often availability to interested parties |
| 5.3 | Roles, responsibilities and authorities assigned and communicated, for ISMS conformity and for reporting performance to top management | Nobody assigned to report ISMS performance upward |
| 6.1.1 | Considering 4.1 and 4.2, determine risks and opportunities for the ISMS, plan actions and how to evaluate them | Treated as the same thing as the information security risk assessment |
| 6.1.2 | Define and apply a risk assessment process: a) criteria including acceptance criteria; b) consistent, valid, comparable results; c) identify risks and risk owners; d) analyse consequences, likelihood and levels; e) evaluate against criteria and prioritise | Criteria not applied; no risk owner identified; levels set without criteria |
| 6.1.3 | Define and apply a treatment process: a) select options; b) determine necessary controls; c) compare against Annex A; d) produce the Statement of Applicability; e) formulate a treatment plan; f) obtain risk owners’ approval and residual risk acceptance | An exclusion the Statement of Applicability does not justify is d); a comparison against the annex that was never performed is c); a treatment option chosen with no link to the assessment output is a) |
| 6.2 | Objectives consistent with policy, measurable if practicable, monitored, communicated, documented — and planned: what, resources, who, when, how evaluated | Objectives with no planning behind them |
| 6.3 | Changes to the ISMS carried out in a planned manner | A change to the ISMS made in isolation, leaving dependent processes behind |
Looking for an approved provider?3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP 6039853.
ISO 27001 Do — Clauses 7 and 8
| Sub-clause | What it requires | The failure that belongs here |
|---|---|---|
| 7.1 | Determine and provide the resources the ISMS needs | Resources determined and not provided — consider 5.1 as well |
| 7.2 | Determine necessary competence; ensure competence on education, training or experience; act where there is a gap and evaluate the action; retain documented evidence | Records with no statement of required competence; evidence missing for a group |
| 7.3 | People aware of the policy, their contribution, and the implications of not conforming | An attendance record offered as evidence of awareness |
| 7.4 | Determine internal and external communications: on what, when, with whom, how | No determined route for communicating externally about an incident |
| 7.5.1 | The documented information the standard requires, plus what the organisation determines is necessary | Required documented information absent |
| 7.5.2 | Creating and updating: identification, format, review and approval | Documents in use that were never approved |
| 7.5.3 | Control: available and suitable where needed; protected; distribution, access, retrieval, storage, version control, retention and disposition; external-origin documents identified and controlled | The wrong version in use at the point of work; external documents uncontrolled |
| 8.1 | Plan, implement and control the processes needed to meet requirements and to implement the actions determined in Clause 6; establish criteria and control the processes in accordance with them; documented information available to the extent necessary; control planned changes and review unintended ones; control externally provided processes, products and services relevant to the ISMS | No criteria for a process; an externally provided service relevant to the ISMS with nothing controlling it |
| 8.2 | Perform risk assessments at planned intervals or when significant changes are proposed or occur; retain results | A good method never repeated — not 6.1.2 |
| 8.3 | Implement the risk treatment plan; retain results | A plan that has not moved — not 6.1.3 e) |
ISO 27001 Check and Act — Clauses 9 and 10
| Sub-clause | What it requires | The failure that belongs here |
|---|---|---|
| 9.1 | Determine what to monitor and measure — including information security processes and controls — the methods, when and by whom it is done, and when and by whom results are analysed and evaluated; documented information available as evidence of the results | Numbers collected and never evaluated |
| 9.2.1 | Internal audits at planned intervals on conformity to the organisation’s own requirements and to the standard, and on effective implementation and maintenance | No internal audits performed |
| 9.2.2 | A programme covering frequency, methods, responsibilities, planning requirements and reporting; considering process importance and previous results; criteria and scope per audit; auditors and conduct ensuring objectivity and impartiality; reporting to management; documented information available as evidence of the programme and the results | An auditor auditing their own work; a programme with no defined method or reporting |
| 9.3.1 | Top management review at planned intervals | No review, or one top management did not attend |
| 9.3.2 | Consider the listed inputs: previous actions, changes in issues, changes in interested-party needs, performance feedback, feedback from interested parties, risk assessment results and treatment plan status, improvement opportunities | A required input missing from the record |
| 9.3.3 | Results to include decisions on continual improvement and any need for change; documented information available as evidence of the results | A record of attendance and papers noted, with no decisions |
| 10.1 | Continually improve suitability, adequacy and effectiveness | Nothing in the ISMS has changed across a full cycle — same scope, same method, same objectives |
| 10.2 | a) react and correct; b) evaluate the need to eliminate causes; c) implement any action needed; d) review effectiveness; e) change the ISMS if necessary. Documented information available as evidence of f) the nature of the nonconformities and any subsequent actions, and g) the results of any corrective action | Correction only, with no recorded evaluation of cause — b). Closure with no effectiveness review — d) |
Preparing for the PR373 exam?Full-length mock exams and exam application support are included.
The ISO 27001 clause pairs that decide exam answers
Two of these are genuine miscitations — a clause cited where the evidence belongs to another. The rest are distinctions: two requirements that sit close together, each capable of its own finding, and the skill is knowing which one your evidence is actually about.
Two that are simply wrong
| Not this… | …but this |
|---|---|
| 6.1.2 — the risk assessment process is defined | 8.2 — it is performed at planned intervals or on significant change |
| 6.1.3 e) — a treatment plan is formulated | 8.3 — the plan is implemented |
Eight to keep apart
| This requirement… | …is not this one |
|---|---|
| 6.1.2 c) — risk owners are identified | 6.1.3 f) — the plan is approved and the residual risks accepted |
| 6.3 — changes to the ISMS are planned | A.8.32 — changes to systems and services are controlled |
| 7.3 — awareness of policy, contribution and implications | A.6.3 — awareness, education and training as a control |
| 5.2 — the overarching information security policy | A.5.1 — policies for information security, including topic-specific ones |
| 7.5.3 — documented information is controlled | A.5.37 — documented operating procedures exist |
| 9.2.2 — objectivity and impartiality of the audit process | 7.2 — the internal auditor’s competence |
| 10.2 b) — the need to eliminate causes is evaluated | 10.2 d) — the effectiveness of any action is reviewed |
| 8.1 — externally provided services relevant to the ISMS are controlled | A.5.19 to A.5.23 — the supplier and cloud controls themselves |
Two rules that resolve most ISO 27001 clause-citation questions
Clauses are requirements on the management system; Annex A controls are measures selected to treat risk. If the failure is about how the organisation runs its ISMS, look in 4 to 10. If it is about a specific safeguard not working, look in the annex. Many findings touch both, and the right citation is the one that describes what actually went wrong.
Design lives in Clause 6; operation lives in Clause 8; evidence of either working lives in Clause 9. Ask when the thing last happened. If the answer is “it is defined”, you are in Clause 6. If it is “it happened last quarter”, you are in Clause 8. If it is “we checked whether it worked”, you are in Clause 9.
ISO 27001 clause map: which clause do you cite?
Pick a finding and see which clause it belongs under.
How to use it: Choose the option that fits you from the list. The answer appears below.
From the clause map in this article. Always read the clause text in ISO/IEC 27001 before writing a finding.
Frequently asked questions about the ISO 27001 clause map
Which ISO 27001 clause do I cite for a risk assessment that was never repeated?
Clause 8.2. The process design is 6.1.2; performing the assessment is 8.2. Note the clause’s or: the two triggers stand independently, so an organisation that kept to its stated interval has still failed 8.2 if a significant change was proposed or occurred and no assessment followed.
Which ISO 27001 clause covers the Statement of Applicability?
6.1.3 d). Learn the letter, because 6.1.3 has six of them and they describe different failures.
Are ISO 27001 Clauses 1 to 3 audited?
Not as requirements. Clause 1 does carry the sentence that excluding any requirement of Clauses 4 to 10 is not acceptable in a claim of conformity, but what you cite is the requirement in 4 to 10.
Can one ISO 27001 finding cite two clauses?
Cite one requirement from the standard, and add the organisation’s own documented requirement where it reinforces the same failure. Bundling two clauses that describe different failures lets the auditee accept half.
What if a failure touches both an ISO 27001 clause and an Annex A control?
Decide which describes what went wrong. A control not operating is an annex matter; a Statement of Applicability that misstates its status is 6.1.3 d). They can be separate findings on the same evidence.
Where to go next: more ISO 27001 Lead Auditor exam preparation
The companion page maps clauses to the records that evidence them — what to ask for, and who holds it.
- Auditing Clause 8: operational planning and control
- Auditing Clause 9: monitoring, internal audit and management review
- Auditing Clause 10: nonconformity and continual improvement
The clause-by-clause deep dives: Clause 4, Clause 5, Clause 6, Clause 6.3, Clause 7.
3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is PR373. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.
Booking a PR373 course? See the schedule, trainers and what’s included.
Leave a reply