The organization shall carry out ISMS changes in a planned manner.
In operational terms: No “silent” ISMS changes—material adjustments must be planned, assessed for side effects, and implemented without weakening security.
Auditors will typically look for evidence that the organization:
a. Considers the purpose and potential consequences of changes.
b. Maintains ISMS integrity (processes, responsibilities, evidence, controls) during/after changes.
c. Provides required resources and assigns responsibilities for implementation.
