ISO 27001:2022 Clause 7.1 Resources Explained

In this guide you will learn how to implement ISO 27001 Clause 7.1 Resources and pass your audit from ISO 27001 Lead Auditor Stuart Barker – author of the ultimate ISO 27001 Toolkit.

Purpose and Definition

The purpose of ISO 27001 clause 7.1 Resources is to make sure you have the resources you need for an effective information security management system (ISMS).

The ISO 27001 standard defines ISO 27001 Clause 7.1 Resources as:

The organisation shall determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the information security management system.

ISO 27001:2022 Clause 7.1 Resources

Requirement

Building on ISO 27001 Clause 5.3 Organisational Roles, Responsibilities and Authorities this clause requires you to have the resources in place for an effective information security management system. This is about having the resources for the entire lifecycle of the information security management system (ISMS) not just the project to get the first ISO 27001 certification.

FREE ISO 27001 Clause 7.1 Training Video

What is ISO 27001 Clause 7.1?

ISO 27001 Clause 7.1 Resources is a security control that mandates organisations to identify and provide the necessary assets for establishing, maintaining, and improving the ISMS. It ensures the Availability of Human, Financial, and Technical Resources to meet security objectives, delivering the Business Benefit of sustainable compliance and operational resilience.

ISO 27001 Clause 7.1 is resources and it requires an organisation to provide the resources needed to establish, implement, maintain and continually improve the information security management system.

The ISO 27001 standard for ISO 27001 certification wants you to have the right people available for running ISO 27001.

Implementation Guide

Implementing ISO 27001 Clause 7.1 requires a strategic approach to allocating budget, tools, and personnel across the different phases of your compliance journey. Follow this step-by-step guide to ensure you have the right resources in place at the right time.

How to Allocate Internal Resources for Your ISMS

If you are looking at gaining the skills and experience in house you have the option to consider ISO 27001 training.

There are many reputable ISO 27001 lead auditor training, ISO 27001 lead implementor training and associated courses to choose from.

It is our experience that these can provide excellent book knowledge to the standard but are very light on how to implement it in the real world, don’t come with templates and don’t provide specific, tailored advice and templates.

If you want training then of course, consider the book training but also companies like High Table provide low cost, structured, 1 to 1 real world implementation training that runs alongside your actual implementation and trains your team.

There is a wealth of training and guidance provided as part of the ISO 27001 Toolkit for free.

There are also free resources on the Internet such as this excellent YouTube Channel dedicated to ISO 27001 and showing you how to do it yourself.

If we were going to start anywhere we would start with this Essential Step By Step Guide to Implementing ISO 27001.

How to Use External Resources for Your ISMS

Whether you look to engage a professional such as a High Table ISO 27001 Consultant, hire someone full-time or train up internal staff on ISO 27001 lead auditor or ISO 27001 lead implementor courses you need to engage with trained and experienced resource for your ISO 27001 certification.

If you are using external resources then be sure to conduct your due diligence and research. There is a guide – The Top 10 ISO 27001 Companies and Top 10 ISO 27001 Certification Bodies

How to implement ISO 27001 Clause 7.1

Step 1: Allocate and Secure Your Budget

Secure the financial resources required for the entire ISO 27001 implementation lifecycle. This is the foundation of Clause 7.1. Ensure you understand the full scope of costs before starting:

• Budget Approval: specific funding must be signed off by Top Management to demonstrate leadership commitment.
• Cost Analysis: Review the guide on How much does ISO 27001 Certification Cost? to ensure your estimates are accurate.
• Resource Provision: Ensure funds are available for the toolkit, external auditing fees, and potential specialist consultancy.

Step 2: Get Your Information Security Management System (ISMS)

Do not attempt to build the documentation from scratch. Accelerate the process by deploying a pre-configured system that includes all necessary resources, guides, and templates:

• Toolkit Deployment: Download the ISO 27001 Toolkit to immediately access the required policies and controls.
• Video Walkthroughs: Utilise the included step-by-step video guides to train your team without hiring expensive external trainers.
• Template Adoption: Rapidly customise the templates to fit your organisation, saving months of drafting time.

Step 3: Identify the ISO 27001 People Resources You Need

Determining the exact roles required can be difficult. You can approach this in two ways:

• Formal Approach: Treat this as a formal project. Allocate a Project Manager, conduct a gap analysis against the standard’s requirements, and map these to available staff. Identify gaps and hire to fill them.
• Informal Approach: Use the ISO 27001 resources template. This document sets out common roles and responsibilities. Simply map your existing staff to these pre-defined roles to ensure coverage without over-engineering the process.

Step 4: Allocate the Mandatory People Resources

Regardless of your approach, ISO 27001 mandates specific roles that must be filled. You must assign names to the following positions:

• 1. The CEO: Ultimate accountability lies here.
• 2. The Leadership Team: To drive the ISMS from the top down.
• 3. Information Security Management Leadership: To oversee strategy.
• 4. The Information Security Manager: For operational management.
• 5. The Management Review Team: To conduct regular governance reviews.

Refer to ISO 27001 Clause 5.3 for detailed guidance on structuring these authorities.

Step 5: Optimise Resource Allocation by Project Phase

Your resource needs will change as you move from establishment to maintenance. Adapt your strategy for each phase:

• Establishment & Implementation Phase: Use specialist resources. It is appropriate to engage experts (consultants or specialized toolkits) here to provide knowledge, speed up the process, and ensure a lean implementation.
• Certification Phase: Use a partnership model. Combine specialist resources with your own staff to ensure knowledge transfer while navigating the audit.
• Maintenance & Improvement Phase: Transition to internal staff. Use your own team for daily operations, utilizing specialist resources only for “sense checking” and internal audits to prepare for recertification.

ISO 27001 Clause 7.1 Templates

For ISO 27001 Clause 7.1 Resources the entire ISO 27001 toolkit is relevant but in particular the following templates directly support this ISO 27001 clause:

ISO 27001 Accountability Matrix Template

For each of the ISO 27001 clauses and the ISO 27001 Annex A controls you need to allocate and record who is responsible for that clause and control. You do this by completing an ISO 27001 Accountability Matrix.

ISO 27001 Competency Matrix Template

For each person involved in the operation of the Information Security Management System be sure to record them in them in the competency matrix. The competency matrix allows you to identify and demonstrate that you have the required competencies to run the information security management system. It also identifies gaps that you can plan to address.

A Pro Tip for Small Organisations

When it comes to resources there are a couple of things that come up and people ask. One of those is – we’re a very small team, can one person have more than one role? Can one resource be allocated more than one role? and the answer to that is yes.

We often find in smaller organisations that one or two people are responsible and are assigned to multiple controls. Absolutely no problem at all.

What you do have to bear in mind is the requirement that we saw earlier and that you will come to in Annex A in more detail on the Segregation of Duty. You have to segregate out duties. What that normally means is authorisation isn’t provided by the person requesting the authority. We do a lot more deep dive into that in the annex A controls.

How to pass the ISO 27001 Clause 7.1 audit

To pass an audit of ISO 27001 Clause 7.1 Resources you are going to

• Understand the requirements of ISO 27001 Clause 7.1 Resources
• Identify the resources that you need
• Aquire People Resources
• Get an Information Security Management System (ISMS)
• Assess the competency of people
• Address competency gaps through training or bringing in specialist help

ISO 27001 Clause 7.1 FAQ

What are the ISO 27001:2022 Changes to Clause 7.1 Resources?

There are no changes to ISO 27001 Clause 7.1 Resources in the 2022 update. Great news for organisations transitioning from the 2013 version; the requirements for resource provision remain consistent.

What is the purpose of ISO 27001 Clause 7.1?

The purpose of ISO 27001 Clause 7.1 is to ensure an organisation has the adequate resources needed to effectively manage its information security. It formalises a commitment from top management to provide the necessary support for the Information Security Management System (ISMS), which is vital for long-term success.

What types of resources are required by Clause 7.1?

Clause 7.1 requires an organisation to consider and provide a range of resources, primarily focusing on three key areas:

• Human Resources: The right people with the necessary skills, knowledge, and time.
• Financial Resources: Sufficient budget for tools, training, and external expertise.
• Infrastructure: Necessary IT systems, software, and physical facilities.

How do I demonstrate compliance with Clause 7.1 during an audit?

To demonstrate compliance, you should have documented evidence that you have identified and provided the required resources. Auditors will expect to see:

• Budget Documents: Financial records and resource plans.
• Organisational Charts: Visual maps of roles and job descriptions.
• Training Records: Competency matrices proving staff qualifications.
• Meeting Minutes: Records from management review meetings where resource allocation was discussed.

What is the difference between Clause 7.1 and Clause 7.2?

Clause 7.1 focuses on the availability of resources in general, such as budget, technology, and people. Clause 7.2, in contrast, specifically addresses competence. It requires that the people working on the ISMS have the necessary skills and knowledge to perform their roles effectively.

Can one person handle all the ISO 27001 roles in a small company?

Yes, in a small organisation, it is common and acceptable for one person to have multiple roles and responsibilities related to the ISMS. The key is to ensure that the individual has the competence and time to fulfil all these roles effectively, and that this arrangement is clearly documented.

How do I determine the right amount of resources needed?

Determining resource needs should be a risk-based process. Start by conducting a thorough risk assessment to identify potential threats and vulnerabilities to your information assets. The resources you allocate should be proportionate to the risks you face and the security objectives you have set.

What are some common mistakes when implementing Clause 7.1?

Common mistakes organizations make with Clause 7.1 include:

• Insufficient Budget: Failing to allocate a dedicated budget for security initiatives.
• Time Constraints: Not providing enough staff time for ISMS-related activities.
• Lack of Buy-in: Neglecting to get top management formal approval for resource commitments.
• Poor Documentation: Not documenting how resources are identified and provided.

Does Clause 7.1 require specific documented information?

While the clause itself doesn’t mandate a specific document called a “resource plan,” it is highly recommended to have documented information that shows how you have met the requirements. This evidence could be in the form of meeting minutes, a budget spreadsheet, or a resource plan.

How do you link Clause 7.1 to continual improvement?

Clause 7.1 is critical for continual improvement because it ensures that you have the resources to not just implement but also maintain and improve the ISMS over time. This includes allocating resources for audits, corrective actions, and new security initiatives as risks evolve.

Who is responsible for ISO 27001 Clause 7.1?

Senior management are responsible for ensuring that ISO 27001 Clause 7.1 Resources is implemented and maintained. This aligns with the leadership requirements found in Clause 5.

Why is ISO 27001 Clause 7.1 Resources important?

In any organisation there are competing priorities for resources, and without dedicated allocation, the ISMS project will fail. An information security management system requires considerable resources from implementation to operation; without them, the management system will not be effective and will not meet its stated security objectives.

Can external consultants or services count as a resource?

Yes, external resources such as consultants, outsourced IT services, and managed security providers can be used to meet the requirements of Clause 7.1. However, the organisation is still responsible for managing these external resources and ensuring they meet the ISMS objectives.