Control 7.1Resources
Determine and provide the resources needed to establish, implement, maintain and continually improve the information security management system.
The shortest clause in the standard and one of the more consequential, because it converts top management’s commitment under 5.1 into something with a number attached. Resources are not only budget: they are people, time, skills, tooling and the access those people need to do the work.
An auditor tests this clause indirectly, and the evidence is usually elsewhere. A risk treatment plan with actions long overdue, an internal audit programme that did not complete, a management review that records the same resourcing constraint for three cycles — each is evidence that the resources determined were not the resources provided. The clause is also where an organisation that has outsourced its ISMS operation to a consultancy discovers the gap between having a system and having the capacity to run one.
How to put this in place
Controls without people, tools and time are just paper. Top management must decide what the ISMS needs and then provide it.
- Estimate the people, effort, tools and budget for the project and for running the ISMS.
- Take the request to top management before the project starts, and again at each later decision point.
- Record the decision and assign the resources.
- Check each month whether the resources are enough.
- Revisit them when the scope or risks change.
Evidence an auditor usually looks for: approved budget and staffing decisions, with time allowed for control owners and the ISMS manager.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 1 (Decide and scope) of the implementation plan, which sets out the work and the gate that closes the phase.
Management Review Meeting PackWord
The decisions to record include the people, money and time agreed or refused.