Control 6.1.1General
When planning the ISMS, consider the context from 4.1 and the requirements from 4.2, and determine the risks and opportunities that need to be addressed in order to give assurance that the system can achieve its intended outcomes, prevent or reduce undesired effects, and achieve continual improvement. The organisation must plan actions to address them, and how to integrate those actions into its ISMS processes and evaluate their effectiveness.
This is the general planning clause that sits above the specific risk assessment in 6.1.2 and treatment in 6.1.3, and the distinction is regularly collapsed. The risks here are risks to the management system achieving its outcomes — a reorganisation, a loss of key skills, a change of business model — not only risks to information.
Opportunities appear here too, and are almost universally ignored. An organisation that records none has either not looked or has decided there are none, and an auditor is entitled to ask which.
How to put this in place
Planning begins with the risks and opportunities the ISMS must deal with, drawn from context and interested parties. Skipping it leaves the risk work disconnected from the business.
- Take the issues from 4.1 and the requirements from 4.2.
- Decide what could prevent the ISMS achieving its intended results and what could improve it.
- Plan how to address them, and how the actions will join the ISMS processes.
- Decide how you will judge whether the actions worked.
- Record the plan and approve it.
Evidence an auditor usually looks for: a documented link from context and interested-party requirements to the risk process and planned actions.
What is in the packs for this
ISO 27001 Implementation Methodology & Project PlanWord
Helps with this requirementin ISO 27001 Implementation & Certification Readiness
Covered in Phase 2 (Assess risk) of the implementation plan, which sets out the work and the gate that closes the phase.