ISO/IEC 27001:2022 in Modulos

Modulos has two Frameworks for ISO/IEC 27001:2022, and each has the name ISO 27001:

• OFF-9 at the Organization level, for the information security management system (ISMS) of the organization.
• MFF-9 at the AI System level, for each AI System in the scope of the ISMS.

This page tells you how to use OFF-9 and MFF-9: the AI System structure, the steps, the Requirements, and the items with no Control. On this page, "you" is the organization that operates the ISMS.

Recommended AI System structure

For ISO/IEC 27001, Modulos uses two levels of AI System. ISO/IEC 27001 sets one ISMS for the organization, in the scope that the organization determines (Clauses 4.3 and 4.4). The two levels, Organization and AI System, are the Modulos structure, not a structure of the standard. For the scope, see The scope of the ISMS.

AI System	Framework	Clauses and Annex A themes in the Framework
The organization AI System	OFF-9	Clauses 4.1 to 10.2, without 8.2 and 8.3
Each AI System in the scope of the ISMS	MFF-9	Clauses 8.2 and 8.3, and the four Annex A themes (A.5 to A.8)

The table in The Requirements gives the Requirement and the level of each clause and each Annex A theme.

• Use MFF-9 for the work on each AI System. If you use only OFF-9, Clauses 8.2 and 8.3 and the Annex A themes have no Requirement. Clause 8.2 is the information security risk assessment, and Clause 8.3 is the information security risk treatment.
• Clauses 8.2 and 8.3 apply to the full ISMS. They are requirements for the organization, and an organization that claims conformity cannot exclude them (Clause 1). OFF-9 has no Requirement for them. Do the risk assessment and the risk treatment also for the risks that are not related to one AI System.
• The scope gives the AI Systems. Modulos recommends MFF-9 for each AI System in the scope of the ISMS.
• MFF-9 does not replace the decisions of the organization. The organization determines the necessary controls and makes the Statement of Applicability for its ISMS (Clause 6.1.3). MFF-9 applies these results to one AI System.

Organization AI Systems

Frameworks at the Organization level, for example OFF-9, attach to the organization AI System that your organization has. You cannot make a new organization AI System. If your organization does not have one, contact Modulos support before you add the Framework.

Set up: a sequence that works

Modulos recommends this sequence for an organization that operates its ISMS in Modulos. ISO/IEC 27001 does not set a sequence. The sequence of its requirements does not show which requirement is more important or which to implement first (Introduction 0.1). But some requirements use the results of other requirements. For example, the risk treatment uses the results of the risk assessment (Clause 6.1.3 a). In these steps, "you" is the organization.

1. Add OFF-9 to your organization AI System. If you do not have one, contact Modulos support.
2. Determine the scope of the ISMS (Clauses 4.1 to 4.3, ORF-196 to ORF-198).
   • Determine each external and internal issue that is "relevant" to your purpose (4.1). The issue must have an effect on how your ISMS can get its intended outcome.
   • Determine the "relevant" interested parties and their "relevant" requirements (4.2).
   • Determine the boundaries and applicability of the ISMS (4.3).
   • When you do this, consider the issues, the requirements, and the interfaces and dependencies between your work and the work of other organizations.
   • Keep the scope available as documented information.
   • See The scope of the ISMS.
3. Make the other items at the Organization level in OFF-9, for example:
   • the information security policy, which top management makes (5.2, ORF-201)
   • the roles, responsibilities, and authorities (5.3, ORF-202)
   • the information security objectives (6.2, ORF-206)
     • Consider the applicable information security requirements (6.2 c).
     • Consider the results of the risk assessment and the risk treatment (6.2 c). Check this again after steps 4 and 5.
     • Change the objectives as "appropriate" (6.2 f).
   • the resources, competence, awareness, and communication (7.1 to 7.4, ORF-208 to ORF-211)
   • the documented information (7.5, ORF-212 to ORF-214).
4. Make and apply a process for the information security risk assessment (6.1.2, ORF-204).
   • The process sets the risk criteria, with the risk acceptance criteria.
   • The process identifies the risks and the risk owners. It analyzes and evaluates the risks.
   • See Clause 6 — Planning.
5. Do the information security risk treatment (6.1.3, ORF-205).
   • Select "appropriate" risk treatment options. Use the results of the risk assessment.
   • Determine all the controls that are necessary for these risk treatment options. You can make them, or use controls from Annex A or from other sources.
   • Compare these controls with Annex A, and make sure that no necessary control is missing.
   • Make the Statement of Applicability and the information security risk treatment plan.
   • Get the approval of the risk owners for the risk treatment plan. Also make sure that the risk owners accept the residual risks (6.1.3 f).
   • See The Statement of Applicability and Annex A and risk treatment.
6. Add MFF-9 to each AI System in the scope. If an AI system in the scope has no AI System in Modulos, make one. Apply the risk treatment and the Statement of Applicability of the organization to each of these AI Systems.
7. Do the risk assessments and implement the risk treatment plan (8.2 and 8.3, MRF-221 and MRF-222).
   • Do the risk assessments at planned intervals, and when "significant" changes are "proposed" or occur (8.2).
   • Use the risk criteria of 6.1.2 a).
   • Implement the risk treatment plan (8.3).
   • Retain the results of the risk assessments and of the risk treatment as documented information.
   • Do this step also for the risks that are not related to one AI System. See Recommended AI System structure.
   • See Clause 8 — Operation.
8. Operate, monitor, audit, review, and improve the ISMS (ORF-215 to ORF-223).
   • These Requirements are for operational planning and control (8.1), monitoring and measurement (9.1), internal audit (9.2), management review (9.3), and improvement (10.1 and 10.2).
   • Do the internal audits at planned intervals (9.2.1). Make sure that top management reviews the ISMS at planned intervals (9.3.1). ISO/IEC 27001 does not set a period.
   • See Clause 9 — Performance evaluation and When to do the risk assessments, audits, and reviews again.

For the Reviews of Requirements in Modulos, see Reviews & Statuses.

The Requirements

OFF-9 and MFF-9 give Requirements for Clauses 4 to 10 and for the four Annex A themes of ISO/IEC 27001:2022. Below, each Requirement has its name in Modulos, its level, its provisions, and the page for the standard.

Requirement	Level	Provisions of ISO/IEC 27001	Page for the standard
ORF-196 Understanding the organization and its context	Organization	4.1	Clause 4
ORF-197 Understanding the needs and expectations of interested parties	Organization	4.2	Clause 4
ORF-198 Determining the scope of the information security management system	Organization	4.3	The scope of the ISMS
ORF-199 Information security management system	Organization	4.4	Clause 4
ORF-200 Leadership and commitment	Organization	5.1	Clause 5
ORF-201 Policy	Organization	5.2	Clause 5
ORF-202 Organizational roles, responsibilities and authorities	Organization	5.3	Clause 5
ORF-203 Actions to address risks and opportunities - General	Organization	6.1.1	Clause 6
ORF-204 Information security risk assessment	Organization	6.1.2	Clause 6
ORF-205 Information security risk treatment	Organization	6.1.3, with the Statement of Applicability (6.1.3 d)	Clause 6, The Statement of Applicability
ORF-206 Information security objectives and planning to achieve them	Organization	6.2	Clause 6
ORF-207 Planning of changes	Organization	6.3	Clause 6
ORF-208 Resources	Organization	7.1	Clause 7
ORF-209 Competence	Organization	7.2	Clause 7
ORF-210 Awareness	Organization	7.3	Clause 7
ORF-211 Communication	Organization	7.4	Clause 7
ORF-212 Documented information - General	Organization	7.5.1	Clause 7
ORF-213 Creating and updating	Organization	7.5.2	Clause 7
ORF-214 Control of documented information	Organization	7.5.3	Clause 7
ORF-215 Operational planning and control	Organization	8.1	Clause 8
ORF-216 Monitoring, measurement, analysis and evaluation	Organization	9.1	Clause 9
ORF-217 Internal audit	Organization	9.2.1	Clause 9
ORF-218 Internal audit program	Organization	9.2.2	Clause 9
ORF-219 Management review	Organization	9.3.1	Clause 9
ORF-220 Management review inputs	Organization	9.3.2	Clause 9
ORF-221 Management review results	Organization	9.3.3	Clause 9
ORF-222 Continual improvement	Organization	10.1	Clause 10
ORF-223 Nonconformity and corrective action	Organization	10.2	Clause 10
MRF-221 Information security risk assessment	AI System	8.2	Clause 8
MRF-222 Information security risk treatment	AI System	8.3	Clause 8
MRF-390 Organizational controls	AI System	Annex A, A.5.1 to A.5.37	The four themes
MRF-391 People controls	AI System	Annex A, A.6.1 to A.6.8	The four themes
MRF-392 Physical controls	AI System	Annex A, A.7.1 to A.7.14	The four themes
MRF-393 Technological controls	AI System	Annex A, A.8.1 to A.8.34	The four themes

ORF-205 is the Requirement for Clause 6.1.3, and Clause 6.1.3 d) includes the Statement of Applicability. The organization, not Modulos, makes the Statement of Applicability as part of its information security risk treatment process.

The ISMS must include the documented information that ISO/IEC 27001 requires (7.5.1 a). It must also include the documented information that the organization determines as necessary for the effectiveness of the ISMS (7.5.1 b). For the documented information of each clause, see Documented information in Clauses 4 to 10.

For the Controls that are in OFF-9 or MFF-9 and also in other Frameworks, see Control overlap.

Items with no Control in the Frameworks

For these items, OFF-9 and MFF-9 have no Control and no Requirement that is only for the item.

• Certification. The Frameworks do not contain the selection of a certification body or the certification audits. Certification is optional, and ISO/IEC 27001 sets no certification procedure. See The certification audit cycle.
• Controls from other sources. The Frameworks have no Requirement that is only for controls from sources other than Annex A. The organization can make its controls, or use controls from Annex A or from other sources (NOTE 1 to Clause 6.1.3). The four Annex A theme Requirements of MFF-9 are for the Annex A controls only. In Clause 6.1.3 b) to d), the organization determines all necessary controls and puts them in the Statement of Applicability. ORF-205 is the Requirement for Clause 6.1.3.

Other management system standards in Modulos

Modulos has other Frameworks for ISO/IEC 42001 and ISO/IEC 27701:

• ISO/IEC 42001: OFF-10 and MFF-10, with the name ISO 42001. See Operationalizing ISO/IEC 42001 in Modulos.
• ISO/IEC 27701: OFF-12 and MFF-13, with the name ISO 27701. See Operationalizing ISO/IEC 27701 in Modulos.

An organization can use one management system for ISO/IEC 27001 and for other management system standards (Introduction 0.2). But this management system must follow the requirements of each standard. See Use with ISO/IEC 42001 and ISO/IEC 27701 and ISO/IEC 42001 and ISO/IEC 27001.

Where to go next

ISO/IEC 27001 overview

The standard, its structure, its use with ISO/IEC 42001 and ISO/IEC 27701, certification, and EU law

ISMS scope, Statement of Applicability, and certification

The scope of the ISMS, the contents of the Statement of Applicability, and the certification audit cycle

Clauses 4 to 10

The requirements of Clauses 4 to 10 and their documented information

Annex A

The 93 Annex A controls in four themes, and how they apply through risk treatment

Integration with AI governance

ISO/IEC 27001, ISO/IEC 42001, and the EU AI Act

See it in Modulos

Modulos gives ISO/IEC 27001 as two Frameworks: OFF-9 for the Organization, and MFF-9 for each AI System in the scope of your ISMS.

Request a demo

Sources of this page

• The standard: ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements, edition 3, 2022-10. ISO catalog page. This page refers to these parts:
  • Introduction 0.1 and 0.2, and Clause 1
  • Clauses 4.1 to 10.2, as in the Requirement table, with NOTE 1 to Clause 6.1.3
  • Annex A.

Disclaimer

This page gives general information only. It is not legal advice, and it does not replace the audit of a certification body. Before you make a decision, compare this page with ISO/IEC 27001:2022.