ISO 27001/Chapter/6 Planning

This chapter ensures that the organization addresses risks and opportunities, sets objectives, and plans changes to the ISMS. It contains three sub-clauses:

6.1 Actions to address risks and opportunities

The organization must:

• Identify and assess information security risks.
• Define and apply treatment plans, including selecting controls (e.g., Annex A).
• Maintain documented information on risk assessment and treatment results.

6.2 Information security objectives and planning to achieve them

The organization must set measurable objectives that:

• Are consistent with the security policy.
• Are monitored and communicated.
• Include what will be done, who is responsible, what resources are required, when they will be completed, and how results will be evaluated.

6.3 Planning of changes

Changes to the ISMS must be carried out in a planned and controlled manner.