ISO 27001 Requirements: Clauses 4 to 10 Explained (2022)

ISO 27001 requirements are set out in clauses 4 to 10 of ISO/IEC 27001:2022: the rules for establishing, running and improving an information security management system (ISMS). Every one of them is mandatory. Clause 1 of the standard says that excluding any requirement in clauses 4 to 10 is not acceptable if you claim conformity. Annex A then lists 93 controls that you compare with your own risk treatment, recording the result in a Statement of Applicability (SoA).

Below you will find what each clause asks for, every mandatory document and record, and the difference between compliant and certified. To rate yourself line by line, use our ISO 27001 checklist, or score every requirement from 0 to 3 with the free ISO 27001 gap analysis template.

What are the mandatory clauses of ISO 27001?

Clauses 0 to 3 (introduction, scope, normative references, terms) set the ground rules. Clauses 4 to 10 follow the harmonised structure shared by ISO management system standards, which is why ISO 27001 and ISO 9001 look alike from clause 4 onwards. The ISO 27001 clauses at a glance:

Each clause in detail:

Clause 4: Context of the organisation

• 4.1 Identify the internal and external issues that affect what your ISMS can achieve. Since Amendment 1 (2024), you must also decide whether climate change is a relevant issue.
• 4.2 List the interested parties (customers, regulators, staff, suppliers), their relevant requirements and, new in 2022, which of those requirements the ISMS will address.
• 4.3 Set the ISMS scope, taking account of 4.1, 4.2 and the interfaces and dependencies with activities others perform. The scope must be documented.
• 4.4 Establish, implement, maintain and continually improve the ISMS, including the processes it needs and how they interact.

Clause 5: Leadership

• 5.1 Top management must lead: set a policy and objectives compatible with the organisation’s strategy, build the ISMS into business processes, provide resources and promote continual improvement.
• 5.2 Top management establishes an information security policy that includes objectives (or a framework for setting them) and commitments to meet applicable requirements and to improve continually. It must be documented, communicated and available to interested parties as appropriate. Our free ISO 27001 toolkit includes a policy template you can adapt.
• 5.3 Assign and communicate security roles, including who makes sure the ISMS conforms to the standard and who reports its performance to top management.

Clause 6: Planning

• 6.1.1 Plan actions for the risks and opportunities that affect the ISMS itself.
• 6.1.2 Define and apply an information security risk assessment process with risk acceptance criteria, results that are consistent, valid and comparable, and a named owner for each risk. Our guide to ISO 27001 risk assessment covers the method.
• 6.1.3 Choose treatment options, determine the controls needed, compare them with Annex A so nothing necessary is missed, produce the SoA, write a risk treatment plan and get risk owners to approve it and accept the residual risk.
• 6.2 Set information security objectives that are measurable where practicable, monitored and documented, with a plan saying what will be done, by whom, by when and how results will be evaluated.
• 6.3 Make changes to the ISMS in a planned way (new in 2022).

Clause 7: Support

• 7.1 to 7.3 Provide resources, define and evidence competence for people whose work affects security, and make sure everyone knows the policy, their part in it and what happens if they do not follow it.
• 7.4 Decide what to communicate, when, with whom and how.
• 7.5 Control documented information: identify, review and approve it, then manage access, storage, versions, retention and disposal, including documents of external origin.

Clause 8: Operation

• 8.1 Plan and control the processes that meet the requirements, set criteria for them, control planned changes and control externally provided processes, products or services that are relevant to the ISMS, such as cloud platforms and outsourced IT.
• 8.2 Carry out risk assessments at planned intervals and when significant changes are proposed or occur, and keep the results.
• 8.3 Implement the risk treatment plan and keep the results.

Clause 9: Performance evaluation

• 9.1 Decide what to monitor and measure, how, when and by whom, then evaluate security performance and the effectiveness of the ISMS.
• 9.2 Run internal audits at planned intervals under an audit programme, using auditors who are objective and impartial. An outsourced ISO 27001 internal audit covers this if nobody in-house is independent of the work.
• 9.3 Hold management reviews at planned intervals, covering the inputs the standard lists, including changes in interested parties’ needs (new in 2022), audit results, risk assessment results and the status of the treatment plan.

Clause 10: Improvement

• 10.1 Continually improve the suitability, adequacy and effectiveness of the ISMS.
• 10.2 When a nonconformity occurs, correct it, find the root cause, check whether similar ones exist, take corrective action and confirm it worked.

What documents does ISO 27001 require?

ISO 27001 calls documents and records “documented information”. In practice they fall into two kinds: documents that describe how the ISMS works, such as the policy, and records that prove something happened, such as audit results. This is the full list of ISO 27001 mandatory documents and records in clauses 4 to 10:

The risk treatment plan (6.1.3 e) is not labelled documented information, but risk owners must approve it, so auditors expect it in writing. Auditors usually start with the SoA; our Statement of Applicability guide explains what it must contain.

Annex A controls in your SoA can add more. Control 5.1 expects topic-specific policies, 5.9 an inventory of information and other associated assets, 5.10 documented acceptable use rules, 5.31 a documented list of legal, statutory, regulatory and contractual requirements, 5.37 documented operating procedures and 6.6 documented confidentiality agreements. Our guide to ISO 27001 Annex A controls explains all 93.

No ISMS manual is required, and a note to 7.5.1 says the extent of documentation can differ with an organisation’s size and complexity. Write what you need to run the ISMS and prove it works.

What are the ISO 27001 certification requirements?

To be certified, you need every clause from 4 to 10 operating, an SoA covering all 93 Annex A controls and enough records to show the ISMS works in practice. That includes an internal audit covering the whole ISMS and a management review, which certification bodies expect to see completed before Stage 2. Our guide to ISO 27001 implementation sets out the 11 steps that get you there.

Certification is a two-stage audit by an independent certification body: Stage 1 reviews the design and documentation, Stage 2 tests whether the ISMS operates as described. Certificates run for three years with surveillance audits in between, as our guide to the ISO 27001 audit explains. Once certified, describe the certificate accurately and follow the ISO 27001 logo rules: there is no ISO logo for certified organisations to use.

ISO 27001 compliance vs certification: can you be compliant without certifying?

Yes. ISO 27001 compliance means you meet the requirements; certification means an independent certification body has audited you and confirmed it.

If you are compliant but not certified, say “aligned with ISO 27001” rather than “certified”. Customers often ask for the certificate and check that its scope covers the service they buy.

What changed in the ISO 27001 requirements in 2022?

The clause changes were modest:

• 4.2 and 4.4: decide which interested-party requirements the ISMS addresses; define its processes and how they interact.
• 6.2 and 6.3: objectives must be monitored; planning of changes is new.
• 7.4: communication simplified.
• 8.1: process criteria added; outsourced processes became externally provided processes, products or services.
• 9.2 and 9.3: split into sub-clauses, with a new management review input on interested parties’ needs.
• 10.1 and 10.2: swapped, so continual improvement comes first.

Amendment 1 (2024) then added the climate change check in 4.1. The bigger change was to Annex A, restructured from 114 controls into 93 in four themes.

What are the most common ISO 27001 nonconformities?

Clause-level findings that certification auditors commonly raise:

• A risk method with no acceptance criteria, or scores nobody could reproduce (6.1.2).
• An SoA that does not match the risk treatment plan, or exclusions with no justification (6.1.3).
• Objectives that cannot be measured or are never monitored (6.2).
• No evidence of competence for people with security roles (7.2).
• Out-of-date or uncontrolled documents in use (7.5).
• Cloud and outsourced services that nobody controls or reviews (8.1).
• An internal audit that skips parts of the ISMS, or an auditor checking their own work (9.2).
• Management review minutes missing required inputs (9.3).
• Corrective actions closed without a root cause or an effectiveness check (10.2).

Why Sovereign Secure

• ISO 27001 certified ourselves, so we work to these requirements in our own business.
• Preparation and certification kept separate. Our ISO 27001 consultancy builds the ISMS with you. Certification audits are carried out by our partner, the independent certification body MQA International, which makes its own certification decision.
• One evidence set for several schemes. We are a PCI SSC Qualified Security Assessor (QSA) company and an IASME-licensed Cyber Essentials certification body, so we map ISO 27001 to PCI DSS and Cyber Essentials, and we also advise on ISO 9001, 22301 and other management system standards.
• UK company since 2012, headquartered at 16 Whalley Road, Accrington, Lancashire.

What is the next step?

Not sure how far you are from meeting these requirements? Tell us your scope through the form on this page, which is already set to ISO 27001, and we will recommend where to start, or call +44 161 523 5276.