In this ultimate how to implement guide to ISO 27001 Clause 7.1 Resources, you will learn directly from an ISO 27001 Lead Auditor:
Table of contents
Assembling Your Resources: A Comprehensive Checklist
Under the ISO 27001 standard, “resources” extend far beyond a budget line item. You must consider people, technology, and financial investment.
Human Resources
Having the right expertise is your most critical asset. You have two primary paths:
- Internal Resources: Training in-house staff via Lead Implementer courses. While excellent for theory, supplement this with real-world DIY ISO 27001 guides and video walkthroughs.
- External Resources: Engaging ISO 27001 consultants. These specialists bring efficiency and help you achieve certification faster.
Consultant’s Take: For most organisations, a hybrid approach is best. Use external specialists for the initial setup and transition to an internal model for ongoing maintenance.
Financial Resources
A signed-off budget is the tangible proof of management commitment that an auditor will look for. You must cover:
- Specialist ISMS software and tools.
- Staff training and professional certifications.
- External consultancy and UKAS certification audit fees.
Infrastructure and Tools
An effective ISMS requires supporting infrastructure. A pre-built ISO 27001 Toolkit is highly recommended, providing templates and step-by-step guides that accelerate implementation and reduce the risk of human error.
Step-by-Step Implementation Plan for Clause 7.1
Implementing this clause can be managed effectively by following a structured, phased roadmap:
- Allocate Your Budget: Secure financial resources for the entire project lifecycle, from tools to audit fees.
- Acquire Your ISMS Toolkit: Don’t start from scratch. Use foundational documentation templates to build your framework efficiently.
- Identify People Resources: Map standard requirements against available staff. For SMEs, using a pre-defined Roles and Responsibilities template is often faster than complex gap analysis.
- Allocate Mandatory Roles: Ensure you have assigned owners for the CEO, Leadership Team, Information Security Manager, and Management Review Team.
- Resource the ISMS Lifecycle: Plan your resource mix. Use specialists for Establishment and Implementation, then transition to internal staff for Maintenance.
Documenting and Demonstrating Compliance
In an audit, if it isn’t documented, it didn’t happen. You must provide evidence of resource allocation.
The Accountability Matrix
This document records who is Accountable (where the buck stops) and Responsible (who does the work) for each clause and Annex A control. This is primary evidence for your auditor.
The Competency Matrix
The Competency Matrix records the skills of everyone involved in the ISMS. It identifies gaps and proves to the auditor that your team is capable of managing the system.
Note for Small Organisations
It is acceptable for one person to hold multiple roles. However, you must maintain the Segregation of Duties. For example, the person requesting system access should not be the same person who approves it.
About the author
