Clause 7: Support

Requirement
The organisation must determine and provide the resources needed for establishing, implementing, maintaining, and continually improving the ISMS.

How to Implement
First, identify what your ISMS actually needs to function, including budget, staff time, tools such as a GRC platform or vulnerability scanner, and training. Then build this into your annual budgeting process rather than treating it as a one-off certification cost, since an ISMS needs ongoing resourcing to stay effective.

Mandatory Documents
There is no “shall be available as documented information” requirement in 7.1, so no mandatory document is required. Even so, a documented ISMS budget or resource plan is a useful, though optional, supporting record.

Requirement
The organisation must determine the necessary competence of persons whose work affects information security performance, ensure they are competent based on appropriate education, training, or experience, take action to acquire necessary competence where gaps exist, evaluate the effectiveness of that action, and retain documented evidence of competence.

How to Implement
For each role that touches information security, such as IT admins, HR handling sensitive data, or the ISMS manager, define the competence required, whether that is qualifications, experience, or specific training. Close any gaps through training, mentoring, or hiring, and keep records such as certificates, training attendance logs, or CVs. Afterwards, periodically check whether the competence actually translated into capability, not just attendance.

Mandatory Documents
Yes, this is explicitly mandatory. ISO/IEC 27001:2022 states the organisation “shall retain appropriate documented information as evidence of competence.” You must keep records such as:

• Training certificates
• CVs
• Competence assessment records for relevant personnel

Requirement
Persons doing work under the organisation’s control must be aware of the information security policy, their contribution to the ISMS’s effectiveness (including the benefits of improved performance), and the implications of not conforming to ISMS requirements.

How to Implement
Run regular security awareness sessions, ideally at induction and at least annually thereafter, covering the policy, common threats such as phishing, and what happens if staff do not follow procedures. Reinforce messages through posters, intranet articles, or simulated phishing tests. Above all, keep it practical and tied to employees’ actual day-to-day tasks rather than abstract policy language.

Mandatory Documents
There is no “shall be available as documented information” statement for 7.3 in ISO/IEC 27001:2022, so no mandatory document is required. However, it is useful to keep:

• Attendance records for awareness sessions, since this is commonly requested as supporting evidence during audits even though it is not formally mandated

Requirement
The organisation must determine the need for internal and external communications relevant to the ISMS, including what to communicate, when, with whom, and how.

How to Implement
Build a simple communication plan covering who needs to know about security incidents, policy changes, or audit results, and through what channel, such as email, intranet, or all-hands meetings. In particular, decide who is authorised to communicate externally about security matters during an incident, so messaging stays consistent and controlled.

Mandatory Documents
There is no explicit documentation requirement in ISO/IEC 27001:2022 for 7.4, so no mandatory document is required. Still, a documented communication plan or matrix is a useful optional tool, especially for incident communication.

Requirement
Under 7.5.1 (General), the ISMS must include documented information required by the standard itself, plus any additional documented information the organisation determines necessary for the ISMS’s effectiveness.

Under 7.5.2 (Creating and Updating), when creating or updating documented information, the organisation must ensure appropriate identification and description (title, date, author, reference number), appropriate format and media, and appropriate review and approval for suitability and adequacy.

Under 7.5.3 (Control of Documented Information), documented information must be controlled to ensure it is available and suitable for use where needed, and adequately protected. This includes distribution, access, retrieval, use, storage, preservation, version control, and retention and disposal, as well as control of documents of external origin.

How to Implement
Build a simple document control system, with a template that includes title, version number, author, approval date, and review date on every ISMS document. Store documents somewhere access-controlled, such as a document management system or a permissioned shared drive, and set a review cycle, typically annual, for each policy and procedure. In addition, keep a document register listing every controlled document, its owner, and its last review date, and identify which externally sourced documents, such as supplier contracts or legal texts, also need to be tracked and controlled.

Mandatory Documents
7.5.1 and 7.5.2 do not contain explicit “shall be available” language themselves, since they describe how to handle documentation generally rather than creating a new document requirement. Therefore, there is no single stand-alone mandatory document tied to 7.5 itself. Instead, this sub-clause sets the rules that govern every other mandatory document already identified throughout Clauses 4 to 10, such as the scope, policy, risk assessment, SoA, objectives, and competence records. A Document Control Procedure, while not explicitly named as mandatory by the standard’s wording, is strongly recommended as the practical mechanism for meeting 7.5.3’s control requirements.