A Practical 10-Point Checklist for Implementing ISO 27001 Clause 6.3: Planning of Changes

The 2022 update to the ISO 27001 standard introduced a specific new requirement: Clause 6.3, Planning of changes. If this is your first encounter with this clause, there is no cause for alarm. While the clause is a new, explicit addition, the core concept of managing changes in a planned, controlled manner is a fundamental best practice that mature organisations have followed for years. Clause 6.3 simply formalises what good governance looks like.

This guide provides a clear, step-by-step implementation checklist to help you master Clause 6.3. By following these practical steps, you can ensure your Information Security Management System (ISMS) remains robust, responsive, and fully compliant.

What Exactly is ISO 27001 Clause 6.3?

At its core, Clause 6.3 ensures that any evolution of your ISMS is deliberate and controlled, rather than chaotic. An ISMS is a critical business system; unplanned changes can introduce vulnerabilities, cause operational disruptions, and undermine the security you are striving to achieve. Clause 6.3 mandates that any changes to the information security management system must be carried out in a planned manner to maintain system integrity.

The standard defines the requirement as follows:

“When the organisation determines the need for changes to the information security management system, the changes shall be carried out in a planned manner.” – ISO 27001:2022 Clause 6.3

This requirement establishes the need for a structured approach. The following checklist details exactly how to implement this effectively.

Your 10-Point Implementation Checklist for Clause 6.3

This checklist serves as a structured roadmap for compliance. We have identified common challenges for each step and provided practical solutions to navigate them.

1. Establish a Change Management Process

Formalise your approach by documenting a clear process for how ISMS changes will be planned, approved, implemented, and reviewed. From an auditor’s perspective, a documented process is primary evidence. It demonstrates that your approach is repeatable and not reliant on specific individuals.

• Challenge: Resistance to adopting formal procedures or lack of consistency.
• Solution: Develop a concise change management policy. Provide training to relevant personnel and emphasise benefits such as reduced risk and improved system stability.

2. Assess the Impact of Changes

Before implementation, you must understand the potential consequences. Auditors verify that you use a consistent method for evaluating how a change affects confidentiality, integrity, and availability. This involves conducting a risk assessment of the change’s impact on the ISMS.

• Challenge: Overlooking potential negative impacts or complexities.
• Solution: Involve interested parties in the assessment. Use established risk assessment methodologies to identify threats and opportunities associated with the change.

[Image of change management impact assessment matrix]

3. Plan Changes in a Controlled Manner

Effective planning is the heart of this clause. Auditors expect detailed plans for significant changes, including resources, realistic timelines, testing, and communication activities.

• Challenge: Inadequate planning leading to delays.
• Solution: Develop detailed implementation plans. Assign clear responsibilities and conduct thorough pre-production testing.

4. Authorise Changes

No change should proceed without proper sign-off. This ensures accountability. Use your existing management review team or a specific Change Advisory Board (CAB) to formally sign off on significant ISMS changes.

• Challenge: Implementing changes without proper authorisation (“Shadow IT”).
• Solution: Define clear approval levels. Use a change management system (ticket system) to track and record approvals.

5. Implement Changes as Planned

Execution must follow the authorised plan. Auditors look for records, such as system logs or project minutes, proving the implementation adhered to the plan. Deviations without re-authorisation are a common source of non-conformity.

• Challenge: Scope creep or deviation during implementation.
• Solution: Monitor the implementation process closely. Use project management tools and have rollback plans ready for unforeseen issues.

6. Test Changes

Never assume a change will function as expected. Testing must be commensurate with the risk. This validates that the change does not introduce new vulnerabilities.

• Challenge: Inadequate testing leading to production errors.
• Solution: Develop robust test plans. Use User Acceptance Testing (UAT) for process changes and vulnerability scanning for technical updates.

7. Communicate Changes

Affected stakeholders must be informed to prevent confusion. Update your formal communication plan and retain evidence of these communications (emails, intranet posts).

• Challenge: Stakeholders being unaware of changes, causing disruption.
• Solution: Develop a specific communication plan for each significant change using appropriate channels (e.g., team meetings, email alerts).

8. Review Changes

A post-implementation review (PIR) confirms the change achieved its goals. This is evidence of your commitment to continual improvement.

• Challenge: Moving to the next task without reviewing the previous change.
• Solution: Schedule PIRs for all significant changes. Document lessons learned and feed them back into the planning process.

9. Document Changes

A complete record is non-negotiable. Ensure document control includes versioning and retention of previous revisions.

• Challenge: Keeping records up-to-date.
• Solution: Use a centralised change management system. Integrate these records with other ISMS documentation, such as the risk register.

10. Manage Emergency Changes

Auditors understand the need for speed during emergencies but expect a defined procedure. You must balance rapid action with control.

• Challenge: Balancing speed with compliance during a crisis.
• Solution: Define clear criteria for “emergency” status. Establish an expedited approval process but ensure retrospective documentation and review.

---

---

Passing the Test: How an Auditor Will Verify Your Compliance

Auditors look for objective evidence that your change management process is functioning effectively. Here is how they will verify compliance with Clause 6.3.

Reviewing Process and documentation

• Policy Review: They will scrutinise your change management policies for completeness.
• Interviews: They will interview IT and security personnel to confirm adherence to the process.
• Comparison: Your process may be compared against frameworks like ITIL.

Assessing Impact and Planning

• Templates: They will review impact assessment templates to ensure they are fit for purpose.
• Sample Testing: A sample of past changes will be examined for consistency in risk assessment.
• Resource Allocation: Evidence of resource planning will be checked to ensure timelines were realistic.

Verifying Authorisation and Execution

• Workflows: Auditors will review approval workflows to ensure they are logical.
• Sign-offs: They will look for digital signatures or email approvals.
• Logs: System logs and configuration settings (before and after) may be examined to verify execution matched the plan.

Evaluating Testing and Review

• Test Cases: They will review test plans to ensure they were comprehensive.
• Post-Implementation Reviews: Auditors will request reports for significant changes to see if lessons learned are being captured.
• Emergency Changes: They will specifically look at how you handled urgent updates to ensure control was maintained.

Conclusion: Planned Change is Good Practice

ISO 27001 Clause 6.3 should be viewed as an opportunity to embed a culture of controlled evolution within your ISMS. By moving away from reactive, ad-hoc adjustments and toward a proactive approach, you reduce risk and enhance the stability of your security posture. By following the checklists provided above, your organisation can confidently meet the requirements of the standard and build a resilient Information Security Management System.

About the author

Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.

Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.

As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.

His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.