In this ultimate how to implement guide to ISO 27001 Clause 6.3 Planning Of Changes, you will learn directly from an ISO 27001 Lead Auditor:
- The requirement of the control
- The required implementation steps
- The minimum requirement
I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.
Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.
Table of contents
The 2022 update to the ISO 27001 standard introduced a specific new requirement: Clause 6.3, Planning of changes. If this is your first encounter with this clause, there is no cause for alarm. While the clause is a new, explicit addition, the core concept of managing changes in a planned, controlled manner is a fundamental best practice that mature organisations have followed for years. Clause 6.3 simply formalises what good governance looks like.
This guide provides a clear, step-by-step implementation checklist to help you master Clause 6.3. By following these practical steps, you can ensure your Information Security Management System (ISMS) remains robust, responsive, and fully compliant.
What Exactly is ISO 27001 Clause 6.3?
At its core, Clause 6.3 ensures that any evolution of your ISMS is deliberate and controlled, rather than chaotic. An ISMS is a critical business system; unplanned changes can introduce vulnerabilities, cause operational disruptions, and undermine the security you are striving to achieve. Clause 6.3 mandates that any changes to the information security management system must be carried out in a planned manner to maintain system integrity.
The standard defines the requirement as follows:
“When the organisation determines the need for changes to the information security management system, the changes shall be carried out in a planned manner.” – ISO 27001:2022 Clause 6.3
This requirement establishes the need for a structured approach. The following checklist details exactly how to implement this effectively.
Your 10-Point Implementation Checklist for Clause 6.3
This checklist serves as a structured roadmap for compliance. We have identified common challenges for each step and provided practical solutions to navigate them.
1. Establish a Change Management Process
Formalise your approach by documenting a clear process for how ISMS changes will be planned, approved, implemented, and reviewed. From an auditor’s perspective, a documented process is primary evidence. It demonstrates that your approach is repeatable and not reliant on specific individuals.
- Challenge: Resistance to adopting formal procedures or lack of consistency.
- Solution: Develop a concise change management policy. Provide training to relevant personnel and emphasise benefits such as reduced risk and improved system stability.
2. Assess the Impact of Changes
Before implementation, you must understand the potential consequences. Auditors verify that you use a consistent method for evaluating how a change affects confidentiality, integrity, and availability. This involves conducting a risk assessment of the change’s impact on the ISMS.
- Challenge: Overlooking potential negative impacts or complexities.
- Solution: Involve interested parties in the assessment. Use established risk assessment methodologies to identify threats and opportunities associated with the change.
[Image of change management impact assessment matrix]
3. Plan Changes in a Controlled Manner
Effective planning is the heart of this clause. Auditors expect detailed plans for significant changes, including resources, realistic timelines, testing, and communication activities.
- Challenge: Inadequate planning leading to delays.
- Solution: Develop detailed implementation plans. Assign clear responsibilities and conduct thorough pre-production testing.
