ISO 27001:2022

ISO 27001 Organisation Controls

ISO 27001 Annex A 5.1: Policies for information security

ISO 27001 Annex A 5.2: Information Security Roles and Responsibilities

ISO 27001 Annex A 5.3: Segregation of duties

ISO 27001 Annex A 5.4: Management responsibilities

ISO 27001 Annex A 5.5: Contact with authorities

ISO 27001 Annex A 5.6: Contact with special interest groups

ISO 27001 Annex A 5.7: Threat intelligence

ISO 27001 Annex A 5.8: Information security in project management

ISO 27001 Annex A 5.9: Inventory of information and other associated assets

ISO 27001 Annex A 5.10: Acceptable use of information and other associated assets

ISO 27001 Annex A 5.11: Return of assets

ISO 27001 Annex A 5.12: Classification of information

ISO 27001 Annex A 5.13: Labelling of information

ISO 27001 Annex A 5.14: Information transfer

ISO 27001 Annex A 5.15: Access control

ISO 27001 Annex A 5.16: Identity management

ISO 27001 Annex A 5.17: Authentication information

ISO 27001 Annex A 5.18: Access rights

ISO 27001 Annex A 5.19: Information security in supplier relationships

ISO 27001 Annex A 5.20: Addressing information security within supplier agreements

ISO 27001 Annex A 5.21: Managing information security in the ICT supply chain

ISO 27001 Annex A 5.22: Monitoring, review and change management of supplier services

ISO 27001 Annex A 5.23: Information security for use of cloud services

ISO 27001 Annex A 5.24: Information security incident management planning and preparation

ISO 27001 Annex A 5.25: Assessment and decision on information security events

ISO 27001 Annex A 5.26: Response to information security incidents

ISO 27001 Annex A 5.27: Learning from information security incidents

ISO 27001 Annex A 5.28: Collection of evidence

ISO 27001 Annex A 5.29: Information security during disruption

ISO 27001 Annex A 5.30: ICT readiness for business continuity

ISO 27001 Annex A 5.31: Identification of legal, statutory, regulatory and contractual requirements

ISO 27001 Annex A 5.32: Intellectual property rights

ISO 27001 Annex A 5.33: Protection of records

ISO 27001 Annex A 5.34: Privacy and protection of PII

ISO 27001 Annex A 5.35: Independent review of information security

ISO 27001 Annex A 5.36: Compliance with policies and standards for information security

ISO 27001 Annex A 5.37: Documented operating procedures

ISO 27001 Technical Controls

ISO 27001 Annex A 8.1: User Endpoint Devices

ISO 27001 Annex A 8.2: Privileged Access Rights

ISO 27001 Annex A 8.3: Information Access Restriction

ISO 27001 Annex A 8.4: Access To Source Code

ISO 27001 Annex A 8.5: Secure Authentication

ISO 27001 Annex A 8.6: Capacity Management

ISO 27001 Annex A 8.7: Protection Against Malware

ISO 27001 Annex A 8.8: Management of Technical Vulnerabilities

ISO 27001 Annex A 8.9: Configuration Management 

ISO 27001 Annex A 8.10: Information Deletion

ISO 27001 Annex A 8.11: Data Masking

ISO 27001 Annex A 8.12: Data Leakage Prevention

ISO 27001 Annex A 8.13: Information Backup

ISO 27001 Annex A 8.14: Redundancy of Information Processing Facilities

ISO 27001 Annex A 8.15: Logging

ISO 27001 Annex A 8.16: Monitoring Activities

ISO 27001 Annex A 8.17: Clock Synchronisation

ISO 27001 Annex A 8.18: Use of Privileged Utility Programs

ISO 27001 Annex A 8.19: Installation of Software on Operational Systems

ISO 27001 Annex A 8.20: Network Security

ISO 27001 Annex A 8.21: Security of Network Services

ISO 27001 Annex A 8.22: Segregation of Networks

ISO 27001 Annex A 8.23: Web Filtering

ISO 27001 Annex A 8.24: Use of Cryptography

ISO 27001 Annex A 8.25: Secure Development Life Cycle

ISO 27001 Annex A 8.26: Application Security Requirements

ISO 27001 Annex A 8.27: Secure Systems Architecture and Engineering Principles

ISO 27001 Annex A 8.28: Secure Coding

ISO 27001 Annex A 8.29: Security Testing in Development and Acceptance

ISO 27001 Annex A 8.30: Outsourced Development

ISO 27001 Annex A 8.31: Separation of Development, Test and Production Environments

ISO 27001 Annex A 8.32: Change Management

ISO 27001 Annex A 8.33: Test Information

ISO 27001 Annex A 8.34: Protection of information systems during audit testing

Home / ISO 27001 Clauses / ISO 27001 Clause 6 Planning – Ultimate Certification Guide

ISO 27001 Clause 6 Planning – Ultimate Certification Guide

Last updated Mar 30, 2025

Author: Stuart Barker | ISO 27001 Expert and Thought Leader

ISO 27001 Planning

The focus for this ISO 27001 Clause is planning. As one of the ISO 27001 controls this is about having a plan for the information security management system that

  • addresses actions to address risks and opportunities
  • the information security objectives and planning to achieve them
  • and the brand new clause to plan for changes

You will learn what ISO clause 6 is, how to simply and easily implement it for ISO 27001 certification and I will show you some common gotchas so you can avoid them.

What is it?

ISO 27001 Clause 6 requires you to plan and implement the plans relevant to your information security management system and is further broken down in sub clauses.

An information security management system is made up of the ISO 27001 documentsISO 27001 policies and processes that deliver your information security controls and keeps you safe.

The ISO 27001 standard requires you to establish and maintain information security risk assessment processes that include the risk acceptance and assessment criteria.

It requires that you implement and manages risk treatment.

As part of planning it also requires you to set out the information security objectives and have a plan in place to meet those objectives.

It introduce a new clause on that requires you to plan for changes.

Sub Clauses

The sub clauses of ISO 27001 Clause 6 are:

ISO 27001 6.1 Actions to address Risks and Opportunities

This is the planning phase of the risk management process. Details on how to plan for risk management.

ISO 27001 6.1.1 General

General planning to address risks and opportunities that have been identified.

Read the ISO 27001 Clause 6.1.1 Planning General – Ultimate Certification Guide

Watch How to implement ISO27001 Clause 6.1.1 Planning and pass the audit.

ISO 27001 6.1.2 Information Security Risk Assessment Requirement

Defining and applying a risk assessment process.

Read the ISO 27001 Clause 6.1.2 Information Security Risk Assessment – Ultimate Certification Guide

ISO 27001 6.1.3 Information Security Risk Treatment

Defining and applying a risk treatment process.

Read the ISO 27001 Clause 6.1.3 Information Security Risk Treatment – Ultimate Certification Guide

ISO 27001 6.2 Information Security Objectives and Planning To Achieve Them Requirement

This is setting the objectives for the information security management system at relevant levels and in relevant functions.

Defining objectives and planning how to achieve them.

Read the ISO 27001 Clause 6.2 Information Security Objectives and Planning to Achieve Them – Ultimate Certification Guide

ISO 27001 6.3 Planning for Changes

This is a new control that is about planning for the changes to the information security management system.

Planning for changes to the information security management system rather than reacting.

Read the ISO 27001 Clause 6.3 Planning Of Changes – Ultimate Certification Guide

ISO 27001 Clause 6 FAQ

Where can I download ISO 27001 Clause 6 Planning templates?

You can download ISO 27001 Clause 6 Planning templates in the ISO 27001 Toolkit.

ISO 27001 Clause 6 Planning templates example?

An example of ISO 27001 Clause 6 Planning can be found in the ISO 27001 Toolkit.

What is ISO 27001 Clause 6 Planning?

The ISO 27001 standard requires an organisation to establish and maintain information security risk management processes and that it defines information security objectives in line with the risks identified.

About the author

Stuart Barker is an information security practitioner of over 30 years. He holds an MSc in Software and Systems Security and an undergraduate degree in Software Engineering. He is an ISO 27001 expert and thought leader holding both ISO 27001 Lead Implementer and ISO 27001 Lead Auditor qualifications. In 2010 he started his first cyber security consulting business that he sold in 2018. He worked for over a decade for GE, leading a data governance team across Europe and since then has gone on to deliver hundreds of client engagements and audits.

He regularly mentors and trains professionals on information security and runs a successful ISO 27001 YouTube channel where he shows people how they can implement ISO 27001 themselves. He is passionate that knowledge should not be hoarded and brought to market the first of its kind online ISO 27001 store for all the tools and templates people need when they want to do it themselves.

In his personal life he is an active and a hobbyist kickboxer.

His specialisms are ISO 27001 and SOC 2 and his niche is start up and early stage business.