ISO 27001 Planning
The focus for this ISO 27001 Clause is planning. As one of the ISO 27001 controls this is about having a plan for the information security management system that
- addresses actions to address risks and opportunities
- the information security objectives and planning to achieve them
- and the brand new clause to plan for changes
You will learn what ISO clause 6 is, how to simply and easily implement it for ISO 27001 certification and I will show you some common gotchas so you can avoid them.
What is it?
ISO 27001 Clause 6 requires you to plan and implement the plans relevant to your information security management system and is further broken down in sub clauses.
An information security management system is made up of the ISO 27001 documents, ISO 27001 policies and processes that deliver your information security controls and keeps you safe.
The ISO 27001 standard requires you to establish and maintain information security risk assessment processes that include the risk acceptance and assessment criteria.
It requires that you implement and manages risk treatment.
As part of planning it also requires you to set out the information security objectives and have a plan in place to meet those objectives.
It introduce a new clause on that requires you to plan for changes.
Sub Clauses
The sub clauses of ISO 27001 Clause 6 are:
- ISO 27001 6.1 Actions to Address Risks and Opportunities
- ISO 27001 6.1.1 General
- ISO 27001 6.1.2 Information Security Risk Assessment
- ISO 27001 6.1.3 Information Security Risk Treatment
- ISO 27001 6.2 Information Security Objectives and Planning to Achieve Them
- ISO 27001 6.3 Planning of Changes
ISO 27001 6.1 Actions to address Risks and Opportunities
This is the planning phase of the risk management process. Details on how to plan for risk management.
ISO 27001 6.1.1 General
General planning to address risks and opportunities that have been identified.
ISO 27001 6.1.2 Information Security Risk Assessment Requirement
Defining and applying a risk assessment process.
Read the ISO 27001 Clause 6.1.2 Information Security Risk Assessment – Ultimate Certification Guide
ISO 27001 6.1.3 Information Security Risk Treatment
Defining and applying a risk treatment process.
Read the ISO 27001 Clause 6.1.3 Information Security Risk Treatment – Ultimate Certification Guide
ISO 27001 6.2 Information Security Objectives and Planning To Achieve Them Requirement
This is setting the objectives for the information security management system at relevant levels and in relevant functions.
Defining objectives and planning how to achieve them.
ISO 27001 6.3 Planning for Changes
This is a new control that is about planning for the changes to the information security management system.
Planning for changes to the information security management system rather than reacting.
Read the ISO 27001 Clause 6.3 Planning Of Changes – Ultimate Certification Guide
ISO 27001 Clause 6 FAQ
You can download ISO 27001 Clause 6 Planning templates in the ISO 27001 Toolkit.
An example of ISO 27001 Clause 6 Planning can be found in the ISO 27001 Toolkit.
The ISO 27001 standard requires an organisation to establish and maintain information security risk management processes and that it defines information security objectives in line with the risks identified.