A Practical Guide to Implementing ISO 27001:2022 Clause 6.3 – Planning of Changes

The 2022 update to the ISO 27001 standard introduced a pivotal new requirement: Clause 6.3, Planning of Changes. While new to the text, this clause formalises what has long been considered a best practice in information security. It ensures that modifications to your Information Security Management System (ISMS) are deliberate, controlled, and safe.

This guide provides a step-by-step process for implementing Clause 6.3 effectively. Below, you will find a breakdown of the requirements and a practical 10-point checklist to ensure compliance and strengthen your ISMS.

What is ISO 27001 Clause 6.3?

Before implementing changes, it is vital to understand the core requirement. Clause 6.3 mandates that any changes to your ISMS must be carried out in a planned manner to prevent chaotic or ad-hoc modifications.

The ISO 27001:2022 standard defines the clause as follows:

“When the organisation determines the need for changes to the information security management system, the changes shall be carried out in a planned manner.”

In plain English: You must demonstrate foresight. Whether you are updating a policy, introducing a new security control, or adjusting a procedure, you must evidence that the change was planned, approved, and managed. This creates a clear audit trail and allows you to revert changes if they introduce unexpected risks.

10-Step Implementation Checklist for Clause 6.3

To comply with Clause 6.3 and mature your organisation’s change management capabilities, follow this 10-step implementation checklist.

1. Establish a Change Management Process

The Goal: Define a documented process for managing all changes to the ISMS, covering planning, approval, implementation, and review.

• Challenge: Lack of consistency or personnel resisting formal procedures.
• Solution: Develop a concise change management policy. Train personnel on the benefits of formal processes, such as improved operational stability and reduced risk.

2. Assess the Impact of Changes

The Goal: Evaluate the potential risks and opportunities of a change before implementation.

• Challenge: Overlooking downstream impacts on complex systems.
• Solution: Involve interested parties (IT, legal, department heads) in the assessment. Use established risk assessment methodologies to evaluate both positive and negative consequences.

3. Plan Changes in a Controlled Manner

The Goal: Detail resources, timelines, testing procedures, and communication strategies.

• Challenge: Poor planning leading to delays or service disruptions.
• Solution: Create a detailed implementation plan for every change. Assign clear responsibilities and deadlines, and plan for testing in non-production environments.

4. Authorise Changes

The Goal: Obtain formal sign-off from designated personnel before acting.

• Challenge: Unauthorised changes causing security vulnerabilities.
• Solution: Define approval levels based on the scale of the change. Use a ticketing platform or change management system to track approvals and maintain an audit trail.

5. Implement Changes as Planned

The Goal: Execute the change strictly according to the approved plan.

• Challenge: Deviations from the plan introducing unexpected issues.
• Solution: Monitor implementation closely using project management tools. Always have a documented rollback plan ready for unforeseen failures.

6. Test Changes

The Goal: Validate that the change functions as intended without negative side effects.

• Challenge: Rushed testing leading to post-implementation incidents.
• Solution: Develop detailed test plans covering unit, integration, and user acceptance testing (UAT). Validate the change from multiple perspectives before going live.

7. Communicate Changes

The Goal: Inform all interested parties about the change in a timely manner.

• Challenge: User confusion and operational disruption due to lack of information.
• Solution: Use multiple channels (email, intranet, meetings) to explain what is changing, why, and how it impacts stakeholders.

8. Review Changes

The Goal: Conduct a post-implementation review to assess effectiveness and capture lessons learned.

• Challenge: Teams moving on too quickly without verifying success.
• Solution: Schedule mandatory reviews for significant changes. Document lessons learned to drive continual improvement in your ISMS.

9. Document Changes

The Goal: Maintain accurate records of all modifications to the ISMS.

• Challenge: Disconnected documentation making audits difficult.
• Solution: Use a centralised log to record changes. Link these records to relevant ISMS documentation, such as the risk register or asset inventory.

10. Manage Emergency Changes

The Goal: Handle urgent security fixes quickly without losing control.

• Challenge: Balancing speed with necessary oversight.
• Solution: Define strict criteria for “emergency” changes. Create an expedited approval process that still requires retrospective documentation and review.

---

---

How to Audit Clause 6.3: What Auditors Look For

To pass your ISO 27001 certification audit, you must provide tangible evidence of compliance. An auditor will specifically look for the following proof points regarding Clause 6.3:

• Documented Process: Evidence of a formal change management policy that aligns with best practices (e.g., ITIL).
• Impact Assessments: Completed templates or records showing that risks were evaluated prior to changes.
• Authorisation Records: Workflows or signatures demonstrating that changes were approved by the correct authority levels.
• Testing Evidence: Test plans and results proving that changes were validated before deployment.
• Communication Logs: Emails or announcements verifying that interested parties were informed.
• Audit Trails: A centralised change log or system that tracks the lifecycle of changes from request to completion.
• Emergency Procedures: Records of past emergency changes to ensure they followed an expedited but controlled process.

Conclusion: Embedding Planned Change into Your ISMS

ISO 27001 Clause 6.3 is not just a compliance checkbox; it is a framework for operational stability. By moving from reactive adjustments to proactive, planned changes, you reduce the risk of security incidents and service disruptions. Embedding this discipline into your operations reinforces the culture of continual improvement essential for a robust ISMS.

About the author

Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.

Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.

As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.

His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.