ISO 27001 Clause 6 — Planning
Risks and opportunities, the risk assessment and treatment processes, the objectives — and, since 2022, planning for change
Clause 6 carries more of the standard’s weight than any other. It is where the ISMS stops being a structure and starts being a set of decisions about your organisation’s actual exposure.
It is also the clause most often approached backwards. Organisations reach for Annex A and work through 93 controls deciding which apply. The standard asks for the opposite: determine the controls you need from your treatment decisions, then use Annex A as a cross-check that nothing necessary was overlooked.
The sub-clauses
6.1 — Actions to address risks and opportunities
Risks and opportunities for the management system (6.1.1), the risk assessment process (6.1.2), and the treatment process and Statement of Applicability (6.1.3).
6.2 — Information security objectives and planning to achieve them
Seven properties every information security objective must have, and five questions the plan to achieve it must answer.
6.3 — Planning of changes
New in the 2022 edition: when the organisation determines the need for changes to the ISMS, those changes must be carried out in a planned manner.
Clause 6.3 — the sub-clause that is new
The 2022 edition added a third sub-clause, and it is two lines long: when the organisation determines the need for changes to the ISMS, those changes shall be carried out in a planned manner. It closes a gap that used to be argued about — an ISMS that drifts through unplanned change was always a problem, and now it is an explicit nonconformity.
In practice 6.3 sits alongside clause 8.1, which requires planned changes to be controlled and the consequences of unintended changes to be reviewed. 6.3 plans the change; 8.1 controls its execution and catches what was not planned.
The order the standard actually asks for
Establish the risk criteria — acceptance criteria, and criteria for performing assessments — before assessing anything. Identify risks to confidentiality, integrity and availability within scope, and name the risk owners. Analyse consequence and likelihood, determine risk levels, compare against the criteria, prioritise.
Then treat: select the options, determine all controls necessary, compare them with Annex A to verify nothing was omitted, produce the Statement of Applicability, formulate the treatment plan, and obtain risk owner approval of the plan and acceptance of residual risk.
Criteria written after the assessment is the single most common structural weakness in this clause. It makes the results unrepeatable and turns risk acceptance into a negotiation held under deadline pressure.
What changed in the 2022 edition
Clause 6.1 itself is stable; what it points at was rebuilt. Annex A went from 114 controls in 14 clauses to 93 controls in four themes — organisational (37), people (8), physical (14) and technological (34) — with 11 new controls including threat intelligence, information security for use of cloud services, ICT readiness for business continuity, configuration management, information deletion, data masking, data leakage prevention and secure coding.
Clause 6.2 gained the property be monitored, and clause 6.3 is new. A Statement of Applicability built against the 2013 Annex A has to be remapped, and that remapping is the moment to check whether the new controls are genuinely covered rather than assumed.
Frequently asked questions
Do we have to start from Annex A?
No — and the standard is explicit about it. Controls are determined from your treatment decisions; Annex A is the cross-check afterwards. A note confirms organisations can design controls themselves or take them from any source, and that the Annex A list is not exhaustive.
Do we still need an asset register?
Not as a requirement of clause 6. The 2013 edition already removed the obligation to use an asset-threat-vulnerability method. Many organisations keep one because several Annex A controls depend on knowing what you have.
What must the Statement of Applicability contain?
Four things: the necessary controls, justification for including each, whether each is implemented, and justification for excluding any Annex A control. Blank exclusion justifications are found immediately.
Does clause 6.3 need a separate change procedure?
Not necessarily. If your existing change process covers changes to the ISMS and produces evidence that they were planned, that satisfies it. What fails is ISMS change handled informally while everything else goes through a process.
Risk assessment and the Statement of Applicability are where a second pair of eyes pays for itself. The Practitioner course works through the process in depth. Contact us to discuss yours.
Where this sits
This page explains the requirement in our own words, for study and orientation. It is not a substitute for the standard: the authoritative text is ISO/IEC 27001:2022, available from ISO and from national standards bodies.
