The organization shall determine and provide resources needed for the ISMS.
Put simply: Resource the ISMS like a real system—ensure people, time, tools, and budget are available so security work is sustainable.
More specifically, this requires that the organization:
a. Provides sufficient resources to operate and improve the ISMS.
b. Ensures resources for key activities (risk work, monitoring, audits, incident handling).
c. Reviews resource needs when scope, risk, or context changes.
