Clause 6 turns what you learned in clause 4 into decisions an auditor can check.

1. Start from the issues, parties and scope of clause 4.
2. Decide the risks and opportunities that could help or harm the ISMS itself (6.1.1).
3. Assess information security risks with criteria set in advance (6.1.2).
4. Choose a treatment for each risk and the controls it needs (6.1.3).
5. Compare those controls with Annex A and record the result in the Statement of Applicability.
6. Set security objectives and plan who achieves them, with what, by when (6.2).
7. Plan any change to the ISMS before making it (6.3).

1. 6.1
   Actions to address risks and opportunitiesSplit into a general part, the risk assessment and the risk treatment.
2. 6.2
   Information security objectives and planning to achieve themTargets that follow from the policy and the risk results.
3. 6.3
   Planning of changesAdded in the 2022 edition: changes to the ISMS are made deliberately.

Information security risks threaten your data and services. The general part of 6.1 asks a second question: what could stop the ISMS delivering what it promised, and what could make it better? It is easy to skip, and auditors notice.

6.1.2 asks for a defined way to find, analyse and evaluate risks. 6.1.3 asks you to choose treatments, pick the controls they need, check them against Annex A so nothing necessary is missed, and record everything in the Statement of Applicability. Risk owners then approve the treatment plan and accept what risk remains. The method, scales and records are covered in our risk guide; building the SoA has its own page too.

• Risk assessment and treatmentA method that is repeatable, with the records an auditor reads.
• The Statement of ApplicabilityHow to build the document auditors open first.

Objectives should follow from the policy and the risk results, be measurable where that is practical, and be tracked, communicated and updated. For each one, the plan names the work, the resources, the owner, the deadline and how the result will be judged.

Operational changes to systems are handled by the change management control in Annex A. Clause 6.3 is about the ISMS: a wider scope, a new risk method, a reorganised security team, a new compliance tool. Each should have a reason, a plan and a check that nothing falls through the gap.

• Record the change and its purpose.
• Name what it affects: scope, risk register, SoA, roles, documents.
• Assign resources and an owner.
• Confirm afterwards that the ISMS still works as intended.

• Objectives with no measure. “Improve security” cannot be shown as met or missed.
• An SoA written before the risk work. Controls ticked first and risks reverse-engineered later read as backwards to an auditor.
• No ISMS-level risks. Only asset risks in the register, nothing about the system itself.

Sources: ISO/IEC 27001:2022 clause numbers and titles (6.1, 6.1.1 to 6.1.3, 6.2, 6.3) and the public list of Annex A themes. Descriptions, objectives and examples are Auditify's own and illustrative.