Meryam Sahin (talk | contribs) m 1 revision imported |
Meryam Sahin (talk | contribs) No edit summary |
||
| Line 1: | Line 1: | ||
This chapter ensures that the organization addresses risks and opportunities, sets objectives, and plans changes to the ISMS. It contains three sub-clauses | {{Textbox|boxtype=note|header=About this chapter|text=This chapter ensures that the organization addresses risks and opportunities, sets objectives, and plans changes to the ISMS. It contains three sub-clauses.|icon=no}} | ||
===== 6.1 Actions to address risks and opportunities ===== | ===== 6.1 Actions to address risks and opportunities ===== | ||
Latest revision as of 14:28, 22 June 2026
About this chapterThis chapter ensures that the organization addresses risks and opportunities, sets objectives, and plans changes to the ISMS. It contains three sub-clauses.
6.1 Actions to address risks and opportunities
The organization must:
- Identify and assess information security risks.
- Define and apply treatment plans, including selecting controls (e.g., Annex A).
- Maintain documented information on risk assessment and treatment results.
6.2 Information security objectives and planning to achieve them
The organization must set measurable objectives that:
- Are consistent with the security policy.
- Are monitored and communicated.
- Include what will be done, who is responsible, what resources are required, when they will be completed, and how results will be evaluated.
6.3 Planning of changes
Changes to the ISMS must be carried out in a planned and controlled manner.
