Clause 6: Planning

Requirement
Under 6.1.1 (General), when planning the ISMS, the organisation must consider the issues from 4.1 and requirements from 4.2, and determine the risks and opportunities that need addressing to ensure the ISMS achieves its intended outcomes, prevent or reduce undesired effects, and achieve continual improvement. It must then plan actions to address these risks and opportunities.

Under 6.1.2 (Information Security Risk Assessment), the organisation must define and apply a risk assessment process that establishes risk acceptance criteria and assessment criteria, ensures consistent and comparable results, identifies risks to confidentiality, integrity, and availability (and their risk owners), analyses the consequences and likelihood of each risk, and evaluates risks against the acceptance criteria to prioritise them for treatment.

Under 6.1.3 (Information Security Risk Treatment), the organisation must define and apply a risk treatment process that selects appropriate treatment options, determines necessary controls, compares those controls against Annex A to verify nothing necessary has been missed, produces a Statement of Applicability (SoA), formulates a risk treatment plan, and obtains risk owner approval of both the plan and the residual risk.

How to Implement
Begin by setting your risk acceptance criteria, that is, what level of risk is tolerable for your organisation, expressed either qualitatively (for example, high, medium, low) or quantitatively. Next, choose a risk identification method: either an asset-threat-vulnerability approach, which identifies your assets, then what threatens them, then how exposed they are, or an event-based approach, which considers plausible security events and their causes. For each identified risk, assess the likelihood and consequence, calculate a risk level, and compare it against your acceptance criteria.

For risks above your tolerance, choose a treatment option, such as avoiding, modifying through controls, sharing through insurance or outsourcing, or retaining the risk. After that, map your chosen controls against Annex A’s 93 controls to make sure nothing relevant has been missed, and document your justification for including or excluding each one; this produces your Statement of Applicability. Finally, compile everything above the acceptance threshold into a Risk Treatment Plan, and have the risk owner formally sign off on residual risk.

Mandatory Documents
Yes, this is explicitly mandatory for 6.1.2 and 6.1.3. ISO/IEC 27001:2022 states the organisation “shall retain documented information about the information security risk assessment process” and “shall retain documented information about the information security risk treatment process.” In practice, this means you must produce and maintain:

• A Risk Assessment Methodology and its results
• A Statement of Applicability (SoA)
• A Risk Treatment Plan

For 6.1.1 (General), there is no explicit documentation requirement beyond what 6.1.2 and 6.1.3 already cover.

Requirement
The organisation must establish information security objectives at relevant functions and levels. These objectives must be consistent with the policy, measurable where practicable, and based on risk assessment and treatment results. They must also be monitored, communicated, updated as appropriate, and documented. In addition, the organisation must plan how to achieve them, determining what will be done, what resources are needed, who is responsible, the timeline, and how results will be evaluated.

How to Implement
Set a handful of specific, measurable objectives tied to your risk treatment plan, for example, reducing critical vulnerabilities on internet-facing systems to zero within 90 days, or achieving 95% staff completion of security awareness training by Q4. For each objective, assign an owner, a deadline, and a method for measuring success. Since priorities shift, review progress at management reviews (Clause 9.3) and update objectives as risks or business needs change.

Mandatory Documents
Yes, this is explicitly mandatory. ISO/IEC 27001:2022 states that objectives “shall be available as documented information” and that the organisation “shall retain documented information on the information security objectives.” You must therefore produce and maintain:

• A documented set of Information Security Objectives
• Their associated action plans

Requirement
When the organisation determines the need for changes to the ISMS, those changes must be carried out in a planned manner.

How to Implement
This sub-clause is new to the 2022 edition and formalises what was previously only implied. Before making a significant change to the ISMS, such as adding a new system to scope, changing a major control, or restructuring responsibilities, plan the change deliberately. Define what will change, who is responsible, what resources are needed, and how the change will be communicated and verified, rather than letting changes happen ad hoc.

Mandatory Documents
ISO/IEC 27001:2022 does not include a “shall be available as documented information” statement for 6.3, so there is no mandatory document. It is good practice, though not required, to keep:

• A simple change log or change request form for significant ISMS changes, since this also supports the 8.1 requirement to control planned changes