Control 7.4Communication
Determine the internal and external communications relevant to the ISMS, including what to communicate, when, with whom, and how.
A short planning clause that is easy to satisfy on paper and valuable when done seriously. Its worth shows up in an incident: the organisations that communicate well under pressure are the ones that decided in advance who says what to whom, and the ones that improvise are usually the ones whose communication plan was a placeholder.
The external half reaches further than most organisations plan for — regulators and supervisory authorities, customers with contractual notification rights, suppliers, and in some sectors the public. Where the organisation is also subject to a statutory reporting regime, the timetable set there is the binding one, and this clause is where the ISMS ought to reconcile the two rather than discover the conflict during the event.
How to put this in place
Information security depends on messages reaching the right people at the right time. Without a plan, communication is ad hoc and gaps appear with suppliers and customers.
- Decide what is communicated, when, to whom, by whom and how, internally and externally.
- Write it in a communication plan with owners.
- Include incident notices, policy changes, customer assurance and supplier requests.
- Carry it out and keep the messages.
- Review it with the management review.
Evidence an auditor usually looks for: a communication plan and examples of messages sent, such as notices, briefings and customer or supplier communications.
What is in the packs for this
ISO 27001 Implementation Methodology & Project PlanWord
Helps with this requirementin ISO 27001 Implementation & Certification Readiness
Covered in Phase 4 (Implement and operate) of the implementation plan, which sets out the work and the gate that closes the phase.