ISO/IEC 27001:2022 — Clauses 4 to 10

ISO/IEC 27001:2022 gives the requirements for an information security management system (ISMS) in Clauses 4 to 10. If an organization claims conformity to the standard, it cannot exclude a requirement of these clauses (Clause 1). The clauses are 4 Context of the organization, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, and 10 Improvement (see Structure of the standard).

Each requirement of the standard uses "shall". A NOTE gives information only and adds no requirement. Some requirements contain a limit, for example "where applicable" (7.2 c), "as applicable" (7.5.3, 9.1 b, 10.2 a), "to the extent necessary" (8.1), "if practicable" (6.2 b), and "as appropriate" (5.2 g). The limit is part of the requirement.

The Introduction (0.1) of ISO/IEC 27001 gives this information: the sequence of the requirements does not show which requirement is more important. It also does not set the sequence in which the organization implements them. ISO/IEC 27001 follows the harmonized structure for management system standards (Foreword). Thus it keeps compatibility with other management system standards that use this structure (Introduction 0.2). See Use with ISO/IEC 42001 and ISO/IEC 27701.

The organization, top management, and other persons and groups

ISO/IEC 27001 Clauses 4 to 10 give most requirements to the organization. The clauses also name these persons and groups:

• Top management — has the requirements of 5.1 (leadership and commitment), 5.2 (information security policy), and 5.3 (roles and their responsibilities and authorities). Top management also does the management review (9.3).
• Risk owners — the risk assessment process identifies them (6.1.2 c). The organization must get their approval of the risk treatment plan and their acceptance of the residual information security risks (6.1.3 f).
• Interested parties — the organization must determine which interested parties are "relevant" to the ISMS (4.2). Clause 5.2 g) requires that the information security policy is available to interested parties, "as appropriate". Their feedback is an input to the management review (9.3.2 e).
• Persons who do work that the organization controls — they must know the information security policy (7.3). If their work has an effect on information security performance, the organization must make sure that they are competent (7.2).
• Auditors — the organization selects them and does the internal audits to make sure that the audit process has objectivity and impartiality (9.2.2 b).
• Relevant management — the organization must make sure that relevant management receives the results of the internal audits (9.2.2 c).

Clauses 4 to 10 do not name a certification body. The standard does not give a requirement to a certification body (see The certification audit cycle).

Documented information in Clauses 4 to 10

ISO/IEC 27001 Clause 7.5.1 requires the organization to include 2 types of documented information in its ISMS:

• The documented information that the standard requires.
• The documented information that the organization determines is necessary for the effectiveness of the ISMS.

The quantity of documented information can be different from one organization to a different organization (7.5.1, NOTE).

The clauses name the documented information below. For some items, the clause requires the information to be available. For other items, the clause requires the organization to retain the information. For the Statement of Applicability, the clause requires the organization to make it.

Clause	Documented information	Type
4.3	The scope of the ISMS	Available
5.2 e)	The information security policy	Available
6.1.2	Information about the risk assessment process	Retained
6.1.3	Information about the risk treatment process	Retained
6.1.3 d)	The Statement of Applicability (see The Statement of Applicability)	Made
6.2	The information security objectives	Available and retained
7.2 d)	Evidence of competence	Retained
8.1	Information that shows that the processes occurred as "planned", "to the extent necessary"	Available
8.2	The results of each risk assessment	Retained
8.3	The results of the risk treatment	Retained
9.1	Evidence of the monitoring and measurement results	Available
9.2.2	Evidence that the organization implements the audit program, and evidence of the audit results	Available
9.3.3	Evidence of the results of the management reviews	Available
10.2	Evidence of the type of each nonconformity, the actions after it, and the results of each corrective action	Available

Clauses 4 to 10 name no other documented information. The ISMS must also include each other item of documented information that the organization determines is necessary (7.5.1 b). Some Annex A controls also require documented information if the organization includes them in its necessary controls, for example A.5.31 and A.5.37 (see Annex A). Clause 7.5.3 applies to all documented information that the ISMS and the standard require.

Clause 4 — Context of the organization

ISO/IEC 27001 Clause 4 requires the organization to determine its issues, its interested parties, and the scope of its ISMS. It also requires the organization to establish and operate the ISMS.

4.1 Issues. The organization must determine each external and internal issue that is "relevant" to its purpose and that has an effect on how the ISMS can get its intended outcomes. The NOTE to 4.1 refers to the external and internal context in ISO 31000:2018, Clause 5.4.1.

4.1 Climate change. Clause 4.1 of the 2022-10 edition does not include a requirement about climate change. The ISO catalog page shows one amendment to the 2022 edition: ISO/IEC 27001:2022/Amd 1:2024, Climate action changes (2024-02). The IAF/ISO Joint Communiqué of 22 February 2024 includes ISO/IEC 27001:2022 in the standards that ISO amended for climate change. The Joint Communiqué gives the 2 changes that the amendments make to ISO/IEC 27001 and to the other standards that the Joint Communiqué names:

• In 4.1, the organization must determine if climate change is a "relevant" issue.
• In 4.2, a NOTE tells organizations that "relevant" interested parties can have requirements about climate change. The NOTE gives information only.

The Joint Communiqué tells organizations that the "overall intent" of the requirements of 4.1 and 4.2 does not change.

4.2 Interested parties. The organization must determine these items:

• a) Which interested parties are "relevant" to the ISMS.
• b) Which "relevant" requirements each of these interested parties has.
• c) Which of their requirements the ISMS will apply to.

The NOTE to 4.2 tells organizations that legal requirements, regulatory requirements, and contractual obligations can be part of these requirements. Thus a contract gives requirements and is not an interested party. Clause 4.2 does not require a record of all interested parties.

4.3 Scope. The organization must determine the boundaries and applicability of the ISMS, which set its scope. The scope must be available as documented information (see The scope of the ISMS).

4.4 ISMS. The organization must establish, implement, maintain, and continually improve an ISMS, as the standard requires. The ISMS includes the necessary processes and the relations between these processes. Clause 4.4 does not name documented information.

Clause 5 — Leadership

ISO/IEC 27001 Clause 5 gives its requirements to top management.

5.1 Leadership and commitment. Top management must show leadership and commitment for the ISMS with these tasks:

• a) Make sure that the information security policy and the objectives of 6.2 are established. Make sure that they agree with the "strategic direction" of their organization.
• b) Make sure that the processes of the organization include the ISMS requirements.
• c) Make sure that the ISMS has the necessary resources.
• d) Tell persons that it is important to do information security management with effectiveness. Also tell them that conformity with the ISMS requirements is important.
• e) Make sure that the ISMS gets its intended outcomes.
• f) Give direction and help to persons, to increase the effectiveness of the ISMS.
• g) Help the organization to continually improve.
• h) Help other "relevant" management roles to show leadership in their areas of responsibility.

5.2 Policy. Top management must establish an information security policy. The policy must:

• a) Be "appropriate" for the purpose of the organization.
• b) Include information security objectives (6.2), or give the framework to set them.
• c) Include a commitment to conform to the applicable requirements for information security.
• d) Include a commitment to the continual improvement of the ISMS.

The policy must also be available as documented information (e), and it must be "communicated" in the organization (f). The policy must be available to interested parties, "as appropriate" (g).

5.3 Roles, responsibilities and authorities. Clause 5.3 requires top management to make sure that each role that is "relevant" to information security has its responsibilities and authorities. Top management must also make sure that these responsibilities and authorities are "communicated" in the organization. Top management must give the responsibility and the authority for these 2 tasks:

• a) Make sure that the ISMS conforms to the requirements of ISO/IEC 27001.
• b) Report on the performance of the ISMS to top management.

Clause 5.3 does not identify the risk owners. Clause 6.1.2 c) identifies them.

Clause 6 — Planning

ISO/IEC 27001 Clause 6 gives the requirements for the planning of the ISMS. The planning includes the actions on risks and opportunities (6.1), the information security objectives (6.2), and changes to the ISMS (6.3). Clauses 6.1.2 and 6.1.3 require the organization to make and apply a risk assessment process and a risk treatment process. Clause 8.2 requires risk assessments that consider the criteria of 6.1.2 a). Clause 8.3 requires the organization to implement the risk treatment plan (see Clause 8 below).

6.1.1 Risks and opportunities. For the planning of the ISMS, the organization must consider the issues of 4.1 and the requirements of 4.2. It must determine the risks and opportunities that it must work on, for these 3 results:

• a) The ISMS can get its intended outcomes.
• b) Unwanted effects are prevented or decreased.
• c) The organization gets continual improvement.

The organization must plan the actions on these risks and opportunities (d). It must also plan how to make the actions part of the ISMS processes, how to implement them, and how to evaluate their effectiveness (e).

6.1.2 Information security risk assessment. Clause 6.1.2 requires the organization to make a process for information security risk assessment and to apply it. The process must:

• a) Establish and maintain information security risk criteria. These criteria include the risk acceptance criteria and the criteria to do information security risk assessments.
• b) Make sure that risk assessments that the organization does again give "consistent, valid and comparable" results.
• c) Identify the risks to the confidentiality, integrity, and availability of the information in the ISMS scope. Also identify the risk owners.
• d) Analyze the risks. Assess the possible consequences if a risk occurs, and the "realistic likelihood" of the risk. Then determine the levels of risk.
• e) Evaluate the risks. Compare the results of the analysis with the risk criteria of a). Then put the risks in a sequence for risk treatment, with the most important risks first.

The organization must retain documented information about the risk assessment process. Clause 6.1.2 does not set when the organization does the risk assessment again. Clause 8.2 sets it.

6.1.3 Information security risk treatment. Clause 6.1.3 requires the organization to make a process for information security risk treatment and to apply it. The process must:

• a) Select the "appropriate" risk treatment options. Use the results of the risk assessment.
• b) Determine all the controls that are necessary to implement the selected risk treatment options. NOTE 1 tells organizations that they can make controls as necessary, or identify them in a source that they select.
• c) Compare these controls with the controls in Annex A. Make sure that no necessary control is missing.
• d) Make a Statement of Applicability.
• e) Write an information security risk treatment plan.
• f) Get the approval of the risk owners for the risk treatment plan. Also get from the risk owners their acceptance of the residual risks.

The organization must retain documented information about the risk treatment process. NOTE 4 tells organizations that this risk assessment and risk treatment process agrees with ISO 31000.

Clause 6.1.3 d) requires the Statement of Applicability. It has four contents (see The Statement of Applicability). The organization compares its necessary controls with Annex A (see How Annex A applies through risk treatment). It must give a justification for each Annex A control that it excludes (see Justification for each exclusion).

6.2 Information security objectives. The organization must establish information security objectives for the "relevant" functions and levels. The objectives must:

• a) Agree with the information security policy.
• b) "If practicable", be measurable.
• c) Consider the applicable information security requirements, and the results of the risk assessment and the risk treatment.
• d) to f) Be monitored, "communicated", and "updated as appropriate".

The objectives must also be available as documented information (g). Also, the organization must retain documented information on the objectives. For the planning of how to get its objectives, the organization must determine these items (h to l):

• The work that it will do.
• The resources that are necessary.
• The person who has the responsibility.
• The date when it will complete the work.
• How it will evaluate the results.

6.3 Planning of changes. Clause 6.3 applies when the organization determines that changes to the ISMS are necessary. The organization must then make the changes in a planned manner. Clause 6.3 does not give the conditions that start a change. Clause 8.2 gives the conditions that start a new risk assessment.

Clause 7 — Support

ISO/IEC 27001 Clause 7 requires the organization to give the ISMS the necessary resources, competent persons, awareness, communication, and documented information.

7.1 Resources. The organization must determine and supply the resources that are necessary to establish, implement, maintain, and continually improve the ISMS.

7.2 Competence. The organization must do these tasks:

• a) Determine the necessary competence of the persons who do work that it controls, if their work has an effect on its information security performance.
• b) Make sure that these persons are competent. Their competence must come from "appropriate" education, training, or experience.
• c) Do actions to get the necessary competence, "where applicable". Then evaluate the effectiveness of these actions.
• d) Retain documented information that is "appropriate", as evidence of competence.

7.3 Awareness. Persons who do work that the organization controls must know these items:

• a) The information security policy.
• b) How their work helps the effectiveness of the ISMS. This includes the good effects of an increase in information security performance.
• c) The possible results if they do not conform to the ISMS requirements.

7.4 Communication. The organization must determine the internal and external communication that is "relevant" to the ISMS. It must determine which information it will give, when, to which persons, and how.

7.5.2 New and changed documented information. When the organization makes or changes documented information, it must make sure that the "identification and description" of the information are "appropriate". It must also make sure that the information has "appropriate" review and approval of its suitability and its adequacy, and "appropriate" format and media.

7.5.3 Control of documented information. Clause 7.5.3 requires the organization to control the documented information that the ISMS and the standard require. The control must make sure that the information is available and "suitable for use", at the necessary location and time. The control must also make sure that the information has sufficient protection. "As applicable", the control includes these items:

• The distribution, access, retrieval, and use of the information.
• Storage and preservation, which includes legibility.
• Control of changes.
• Retention and disposition.

The organization must also identify, "as appropriate", and control the documented information of external origin that it determines is necessary for the planning and the operation of the ISMS. Clause 7.5 sets no period for the review of documented information. The section Documented information in Clauses 4 to 10 gives 7.5.1 and the documented information that each clause names.

Clause 8 — Operation

ISO/IEC 27001 Clause 8 requires the organization to plan, implement, and control the ISMS processes. It also requires the organization to do risk assessments and to implement the risk treatment plan.

8.1 Operational planning and control. Clause 8.1 requires the organization to plan, implement, and control the necessary processes. These processes are necessary to conform to the requirements and to do the actions of Clause 6. To do this, the organization must set criteria for the processes and control the processes against these criteria. The organization must also:

• Make documented information available "to the extent necessary" to be sure that the processes occurred as "planned".
• Control the planned changes. For unintended changes, examine the effects and decrease bad effects, "as necessary".
• Make sure that the externally provided processes, products or services are controlled, if they are "relevant" to the ISMS.

Clause 8.1 does not name Annex A controls. The organization determines the necessary controls in 6.1.3 b). It can make them or identify them from a source that it selects (NOTE 1 to 6.1.3). Annex A controls 5.19 to 5.23 are about supplier relationships and apply through 6.1.3 (see The four themes).

8.2 Information security risk assessment. Clause 8.2 requires the organization to do information security risk assessments at planned intervals. It must also do a risk assessment when a significant change is "proposed" or occurs. Each risk assessment uses the risk criteria of 6.1.2 a). The organization must retain the results of the risk assessments as documented information.

8.3 Information security risk treatment. Clause 8.3 requires the organization to implement the information security risk treatment plan. It must retain the results of the risk treatment as documented information. The risk owners accept the residual risks in 6.1.3 f), not in 8.3.

Clauses 8.2 and 8.3 are requirements for the ISMS of the organization. In Modulos, their Requirements are on the AI System Framework MFF-9 (see The Requirements).

Clause 9 — Performance evaluation

ISO/IEC 27001 Clause 9 requires the organization to monitor, measure, audit, and review the ISMS.

9.1 Monitoring, measurement, analysis and evaluation. Clause 9.1 requires the organization to determine these items:

• a) The items that it must monitor and measure. These items include the information security processes and the controls.
• b) The methods to monitor, measure, analyze, and evaluate, "as applicable", to get "valid" results.
• c) When it monitors and measures.
• d) Who monitors and measures.
• e) When it analyzes and evaluates the results.
• f) Who analyzes and evaluates the results.

Item b) also recommends methods that give "comparable and reproducible" results. Such results are "valid". Documented information must be available as evidence of these results. The organization must also evaluate its information security performance and the effectiveness of its ISMS.

9.2.1 Internal audit. The organization must do internal audits at planned intervals. The organization sets the criteria and the scope of each audit (9.2.2 a). The audits give information on these 3 items:

• If the ISMS conforms to the requirements of the organization for its ISMS.
• If the ISMS conforms to the requirements of ISO/IEC 27001.
• If the organization implements and maintains the ISMS with effectiveness.

9.2.2 Audit program. The organization must plan, establish, implement, and maintain 1 or more audit programs. An audit program includes how frequently audits occur, the methods, the responsibilities, the planning requirements, and the reports. When it establishes an audit program, the organization must consider how important the processes are and the results of previous audits. It must also do these tasks:

• a) For each audit, set its criteria and its scope.
• b) Select auditors and do audits to make sure that the audit process has objectivity and impartiality.
• c) Make sure that relevant management receives the results of the audits.

Documented information must be available as evidence that the organization implements the audit program, and as evidence of the audit results. Clause 9.2 sets the internal audit of the organization. It does not set the audit of a certification body (see The certification audit cycle).

9.3 Management review. Top management must review the ISMS at planned intervals, to make sure that the ISMS continues to have suitability, adequacy, and effectiveness (9.3.1). The management review must include these inputs (9.3.2):

• a) The "status" of the actions of previous management reviews.
• b) Changes in the external and internal issues, if these issues are "relevant" to the ISMS.
• c) Changes in the needs and expectations of interested parties, if these are "relevant" to the ISMS.
• d) Feedback on the information security performance. This feedback includes trends in nonconformities and corrective actions, in monitoring and measurement results, and in audit results. It also includes trends in the "fulfilment" of the information security objectives.
• e) The feedback that interested parties give.
• f) The results of the risk assessment and the "status" of the risk treatment plan.
• g) The opportunities for continual improvement.

The results of the management review must include decisions on opportunities for continual improvement, and on necessary changes to the ISMS (9.3.3). Documented information must be available as evidence of the management review results. Clause 9.3.3 does not set the type of this documented information.

Items of ISO/IEC 27001 only. ISO/IEC 42001:2023 and ISO/IEC 27701:2025 use the same harmonized structure for Clause 9. But their Clause 9.1 has no item for who monitors and measures (d), or for who analyzes and evaluates (f). Their Clause 9.3.2 has no input for the "fulfilment" of objectives (d), or for feedback from interested parties (e). It also has no input for the risk assessment results and the "status" of the risk treatment plan (f).

Clause 10 — Improvement

ISO/IEC 27001 Clause 10 requires the organization to improve the ISMS and to correct nonconformities.

10.1 Continual improvement. The organization must continually improve the ISMS, to increase its suitability, adequacy, and effectiveness.

10.2 Nonconformity and corrective action. Clause 10.2 applies when a nonconformity occurs. Then the organization must do these tasks:

• a) Do an action on the nonconformity. "As applicable", control and correct it, and do work on its consequences.
• b) Evaluate if it must do actions to remove the causes of the nonconformity. The purpose of these actions is that the nonconformity does not occur again, here or at a different location. For this evaluation, do these 3 tasks:
  • Examine the nonconformity.
  • Find its causes.
  • Find if nonconformities of the same type occur or can occur.
• c) Implement each necessary action.
• d) Examine the effectiveness of each corrective action.
• e) If necessary, change the ISMS.

Each corrective action must be "appropriate" to the effects of the nonconformity. Documented information must be available as evidence of the type of each nonconformity, the actions after it, and the results of each corrective action.

When to do the risk assessments, audits, and reviews again

ISO/IEC 27001 sets no period for these risk assessments, audits, and reviews. Where it uses "planned intervals", the organization sets the intervals. The standard gives these times for each task:

Task	Clause	When
Information security risk assessment	8.2	At planned intervals. Also when a significant change is "proposed" or occurs.
Monitoring and measurement	9.1 c)	At the times that the organization determines.
Analysis and evaluation of the results	9.1 e)	At the times that the organization determines.
Internal audit	9.2.1	At planned intervals.
Management review	9.3.1	At planned intervals.
Changes to the ISMS	6.3	When the organization determines that changes to the ISMS are necessary. The organization makes them in a planned manner.

The standard sets no period for the review of the ISMS scope. Changes in the external and internal issues and in the needs and expectations of interested parties are inputs to the management review (9.3.2 b and c). The results of the management review include decisions on necessary changes to the ISMS (9.3.3).

The Requirements in Modulos

Modulos gives ISO/IEC 27001 as two Frameworks with the name ISO 27001: OFF-9 at the Organization level and MFF-9 at the AI System level. The page Operationalizing ISO/IEC 27001 in Modulos gives the Requirement for each clause and the steps that Modulos recommends.

Where to go next

ISO/IEC 27001 overview

The standard, its edition, its structure, and its use with ISO/IEC 42001 and ISO/IEC 27701

ISMS scope, Statement of Applicability, and certification

The ISMS scope (4.3), the Statement of Applicability (6.1.3 d), and the certification cycle

Annex A

The 93 controls in four themes, and how they apply through risk treatment

Integration with AI governance

ISO/IEC 27001 with ISO/IEC 42001 and the EU AI Act

Operationalizing in Modulos

OFF-9 and MFF-9, the Requirement for each clause, and the steps

Sources of this page

• ISO/IEC 27001:2022 — Information security, cybersecurity and privacy protection — Information security management systems — Requirements, Edition 3 (2022-10): Introduction (0.1, 0.2), Clause 1, Clauses 4.1 to 10.2, and Annex A controls 5.19 to 5.23, 5.31, and 5.37. ISO catalog page.
• ISO/IEC 27001:2022/Amd 1:2024 — "Amendment 1: Climate action changes" (2024-02). ISO catalog page.
• IAF/ISO Joint Communiqué (2024-02-22), "on the addition of Climate Change considerations to Management Systems Standards": sections 2.1 and 2.2, and the amended standards that it names. PDF.
• ISO/IEC 42001:2023 — Edition 1 (2023-12): Clauses 9.1 and 9.3.2.
• ISO/IEC 27701:2025 — Edition 2 (2025-10): Clauses 9.1 and 9.3.2.

Disclaimer

This page gives only general information. It does not replace legal or certification help. Always compare this page with ISO/IEC 27001:2022 and its amendment.