Control 6.3Planning of changes
When the organisation determines the need for changes to the information security management system, the changes are to be carried out in a planned manner.
One sentence, new in the 2022 edition, and it closes a gap the earlier version left. The standard already required planning for the system’s establishment and required corrective action after a nonconformity; what it did not say was that deliberate change to the system itself — a new scope, a restructured risk methodology, a merged set of policies, a change of certification body — has to be planned rather than absorbed.
In practice this is the clause that catches the ISMS altered informally: a scope quietly widened without revisiting 4.3, a risk methodology replaced between assessments so results are no longer comparable as 6.1.2 requires, controls dropped from the Statement of Applicability without the risk owners in 6.1.3 accepting the change. It is short, and it is tested by asking how the last significant change to the system was decided.
How to put this in place
The ISMS will change, through new services, tools or reorganisations. The project needs a planned way to change it so that gaps are not opened by accident; the standard asks only that such changes be planned, so keep the method light.
- Decide what counts as a change to the ISMS, such as scope, policy, controls or roles.
- Define who proposes, assesses and approves changes.
- Consider purpose, consequences, resources and responsibilities for each change.
- Record the change, update affected documents and tell the people involved.
- Review changes in the management review.
Evidence an auditor usually looks for: a record showing a change was planned, such as the reason, the assessment of effects, the approval and updated documents.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 4 (Implement and operate) of the implementation plan, which sets out the work and the gate that closes the phase.
Management Review Meeting PackWord
The decisions to record include the changes needed to the ISMS, who makes each and by when.