Curriculum
- 2 Sections
- 35 Lessons
- 26 Weeks
- ISO/IEC 2700110
- 1.1Introduction to ISO/IEC 27001
- 1.2Overview of Information Security Management System (ISMS)
- 1.3Structure of ISO/IEC 27001
- 1.4Context of the Organization (Clause 4)
- 1.5Leadership (Clause 5)
- 1.6Planning (Clause 6)
- 1.7Support (Clause 7)
- 1.8Operation (Clause 8)
- 1.9Performance Evaluation (Clause 9)
- 1.10Improvement (Clause 10)
- ISO 19011: Guidelines for auditing management systems26
- 2.1Introduction to ISO19011
- 2.2Principles of Auditing
- 2.3Managing an Audit Program
- 2.4Establishing Audit Program Objectives
- 2.5Determining Audit Program Risks and Opportunities
- 2.6Establishing the Audit Program
- 2.7Implementing the Audit Program
- 2.8Monitoring the Audit Program
- 2.9Reviewing and Improving the Audit Program
- 2.10Initiating the Audit
- 2.11Determining Audit Feasibility
- 2.12Preparing Audit Activities
- 2.13Reviewing Documented Information
- 2.14Preparing the Audit Plan
- 2.15Assigning Work to the Audit Team
- 2.16Preparing Working Documents
- 2.17Opening Meeting
- 2.18Communication During the Audit
- 2.19Collecting and Verifying Information
- 2.20Generating Audit Findings
- 2.21Preparing Audit Conclusions
- 2.22Closing Meeting
- 2.23Preparing the Audit Report
- 2.24Completing the Audit
- 2.25Follow-Up Activities
- 2.26ISO/IEC 27001120 Minutes40 Questions
Planning (Clause 6)
Planning (Clause 6)
Planning is a central component of ISO/IEC 27001 and plays a crucial role in shaping how an organization manages its information security risks. Clause 6 introduces the concept of risk-based thinking, requiring organizations to proactively identify, assess, and address risks that could impact the confidentiality, integrity, and availability of information.
Rather than reacting to incidents after they occur, this clause ensures that organizations take a structured and forward-looking approach to information security. Effective planning enables organizations to anticipate potential threats, prioritize actions, and allocate resources efficiently.
The first requirement of Clause 6 is for organizations to determine the risks and opportunities that need to be addressed to:
- Ensure the ISMS can achieve its intended outcomes
- Prevent or reduce undesired effects
- Achieve continual improvement
This involves considering the context established in Clause 4 and the expectations of interested parties. Risks are not limited to technical vulnerabilities—they can arise from processes, people, external threats, or changes in the business environment.
At the same time, organizations should also identify opportunities. For example, adopting new technologies or improving processes may enhance information security and overall efficiency.
A key element of planning is conducting an information security risk assessment. This is a systematic process used to identify and evaluate risks related to information assets.
The risk assessment process typically involves:
- Identifying information assets (e.g., data, systems, processes)
- Identifying threats and vulnerabilities
- Assessing the potential impact of a security breach
- Evaluating the likelihood of occurrence
- Determining the level of risk
Organizations must define and apply consistent criteria for evaluating risks. This ensures that risk assessments are objective, repeatable, and aligned with the organization’s priorities.
The outcome of the risk assessment is a clear understanding of which risks require treatment and which can be accepted.
Information Security Risk Treatment
Once risks have been identified and assessed, organizations must determine how to address them. This is known as risk treatment.
Common risk treatment options include:
- Avoiding the risk (e.g., discontinuing a risky activity)
- Reducing the risk (e.g., implementing controls)
- Sharing the risk (e.g., outsourcing or insurance)
- Accepting the risk (if it falls within acceptable limits)
When reducing risks, organizations select appropriate controls to mitigate them. These controls are often drawn from Annex A, but organizations are not limited to those listed—they may implement any controls that are suitable for their specific situation.
The selected controls and their justification are typically documented in a Statement of Applicability (SoA), which serves as a key reference within the ISMS.
Risk Assessment and Treatment Methodology
ISO/IEC 27001 does not prescribe a specific risk assessment methodology. Instead, organizations are required to define their own approach, ensuring that it is:
- Systematic and consistent
- Based on defined criteria
- Appropriate to the organization’s context
This flexibility allows organizations to tailor their risk management approach to their size, complexity, and industry.
Clause 6 also requires organizations to establish information security objectives. These objectives provide direction and help measure the effectiveness of the ISMS.
Objectives should be:
- Consistent with the information security policy
- Measurable (where practical)
- Communicated within the organization
- Monitored and updated as needed
Examples of objectives might include reducing the number of security incidents, improving incident response times, or increasing employee awareness of security practices.
Once objectives are defined, organizations must plan how to achieve them. This includes determining:
- What actions will be taken
- What resources are required
- Who is responsible
- When the actions will be completed
- How results will be evaluated
This structured approach ensures that objectives are not just aspirational but are supported by clear and actionable plans.
Integration with the ISMS
Planning is not a one-time activity—it is an ongoing process that must be integrated into the ISMS. As risks evolve and business conditions change, organizations must revisit their risk assessments, treatment plans, and objectives.
For example:
- New technologies may introduce new vulnerabilities
- Changes in regulations may create new compliance requirements
- Business expansion may increase the scope of risks
Regular updates ensure that the ISMS remains relevant and effective.
Common Challenges
Organizations often encounter challenges in Clause 6, such as:
- Inconsistent or subjective risk assessments
- Overcomplicating the risk management process
- Failing to link risks to appropriate controls
- Setting objectives that are vague or difficult to measure
Addressing these challenges requires clear methodologies, proper training, and strong alignment with business priorities.
Clause 6 ensures that information security is managed proactively through structured planning. By identifying risks, determining appropriate treatments, and setting clear objectives, organizations can build a resilient ISMS that adapts to changing conditions and effectively protects information assets.