Curriculum
- 2 Sections
- 35 Lessons
- 26 Weeks
- ISO/IEC 2700110
- 1.1Introduction to ISO/IEC 27001
- 1.2Overview of Information Security Management System (ISMS)
- 1.3Structure of ISO/IEC 27001
- 1.4Context of the Organization (Clause 4)
- 1.5Leadership (Clause 5)
- 1.6Planning (Clause 6)
- 1.7Support (Clause 7)
- 1.8Operation (Clause 8)
- 1.9Performance Evaluation (Clause 9)
- 1.10Improvement (Clause 10)
- ISO 19011: Guidelines for auditing management systems26
- 2.1Introduction to ISO19011
- 2.2Principles of Auditing
- 2.3Managing an Audit Program
- 2.4Establishing Audit Program Objectives
- 2.5Determining Audit Program Risks and Opportunities
- 2.6Establishing the Audit Program
- 2.7Implementing the Audit Program
- 2.8Monitoring the Audit Program
- 2.9Reviewing and Improving the Audit Program
- 2.10Initiating the Audit
- 2.11Determining Audit Feasibility
- 2.12Preparing Audit Activities
- 2.13Reviewing Documented Information
- 2.14Preparing the Audit Plan
- 2.15Assigning Work to the Audit Team
- 2.16Preparing Working Documents
- 2.17Opening Meeting
- 2.18Communication During the Audit
- 2.19Collecting and Verifying Information
- 2.20Generating Audit Findings
- 2.21Preparing Audit Conclusions
- 2.22Closing Meeting
- 2.23Preparing the Audit Report
- 2.24Completing the Audit
- 2.25Follow-Up Activities
- 2.26ISO/IEC 27001120 Minutes40 Questions
Support (Clause 7)
Support (Clause 7)
For an Information Security Management System (ISMS) to function effectively, it must be properly supported by adequate resources, competent personnel, clear communication, and well-managed documented information. Clause 7 of ISO/IEC 27001 focuses on these essential enablers, ensuring that the organization has everything it needs to establish, implement, maintain, and continually improve its ISMS.
While earlier clauses define what needs to be achieved, Clause 7 ensures that the organization has the capability to actually deliver those outcomes.
The first requirement of Clause 7 is that organizations must determine and provide the resources necessary for the ISMS. Resources can include:
- Human resources (qualified personnel)
- Technology and infrastructure
- Financial support
- Tools and systems
Without adequate resources, even the best-designed ISMS will fail to operate effectively. For example, implementing security controls without sufficient staff to manage them can lead to gaps and vulnerabilities.
Resource allocation should be aligned with the organization’s risk profile and priorities. Higher-risk areas may require more investment, while lower-risk areas may need fewer resources.
Competence is a critical factor in ensuring that individuals performing tasks within the ISMS are capable of doing so effectively. Organizations must:
- Determine the necessary competence for each role
- Ensure that individuals are appropriately trained or qualified
- Take actions to acquire the required competence (e.g., training, mentoring)
- Retain evidence of competence
Competence applies not only to technical roles but also to anyone involved in information security processes. For example, employees handling sensitive data must understand how to protect it, even if they are not IT specialists.
Awareness
In addition to competence, organizations must ensure that employees are aware of:
- The information security policy
- Their role in supporting the ISMS
- The importance of complying with security requirements
- The consequences of non-compliance
Awareness is essential because human behavior is often one of the weakest links in information security. Even with strong technical controls in place, a lack of awareness can lead to incidents such as phishing attacks, data leaks, or accidental misuse of information.
Organizations typically address this requirement through training programs, awareness campaigns, and regular communication.
Communication
Effective communication is another key element of Clause 7. Organizations must determine:
- What information needs to be communicated
- When it should be communicated
- Who should communicate it
- To whom it should be communicated
- How the communication should take place
Communication can be both internal and external. For example:
- Internally, employees may need updates on policies or security practices
- Externally, organizations may need to communicate with customers, regulators, or partners
Clear and consistent communication helps ensure that everyone understands their responsibilities and that important information is shared in a timely manner.
Clause 7 also addresses the management of documented information, which is a key component of any management system.
Documented information includes:
- Policies and procedures
- Records of activities and decisions
- Evidence of compliance with requirements
Organizations must ensure that documented information is:
- Properly created and updated
- Controlled to ensure availability and suitability
- Protected from unauthorized access, loss, or alteration
This includes managing document versions, controlling access, and ensuring that only the latest versions are in use.
A structured approach to document control is essential for maintaining consistency and reliability within the ISMS.
Organizations must:
- Identify and describe documented information
- Define formats and media (e.g., digital or physical)
- Review and approve documents before use
- Ensure documents are accessible where needed
At the same time, records must be retained as evidence that processes have been followed and requirements have been met. These records are particularly important for demonstrating compliance and supporting performance evaluation activities.
Supporting the ISMS as a Whole
Clause 7 acts as a bridge between planning and operation. It ensures that all necessary support mechanisms are in place so that the ISMS can function smoothly.
For example:
- Competent staff are needed to carry out risk assessments (Clause 6)
- Clear communication is required for effective operations (Clause 8)
- Documented information supports monitoring and evaluation (Clause 9)
Without these supporting elements, the ISMS would lack the structure and consistency needed for success.
Common Challenges
Organizations often face challenges when implementing Clause 7, such as:
- Insufficient training or lack of awareness among employees
- Poorly managed or outdated documentation
- Ineffective communication channels
- Inadequate allocation of resources
Addressing these challenges requires ongoing effort, regular reviews, and a commitment to continuous improvement.
Clause 7 ensures that the ISMS is supported by the right resources, skilled personnel, effective communication, and controlled documentation. These elements provide the foundation that enables all other aspects of the ISMS to function effectively and consistently.