What are the clauses in ISO 27001?

Understanding the clauses in ISO 27001 makes the certification process much easier because they provide the structure for your entire Information Security Management System, commonly called an ISMS.

ISO/IEC 27001:2022 remains the current published edition of the international standard, supported by Amendment 1:2024 covering climate action changes. ISO describes ISO/IEC 27001 as the requirements standard for establishing, implementing, maintaining and continually improving an Information Security Management System.

The standard contains ten numbered clauses. Clauses 1 to 3 provide the foundation and terminology, while Clauses 4 to 10 contain the management system requirements that an organisation needs to address when working towards certification. BSI confirms that organisations pursuing ISO 27001 certification need to meet the requirements contained in Clauses 4 through 10.

Those clauses are:

1. Scope
2. Normative references
3. Terms and definitions
4. Context of the organisation
5. Leadership
6. Planning
7. Support
8. Operation
9. Performance evaluation
10. Improvement

Annex A then provides a reference set of 93 information security controls that supports the risk treatment process. Annex A does not replace Clauses 4 to 10. The clauses tell you how to establish and manage the ISMS, while Annex A helps you consider appropriate information security controls. UKAS confirms that ISO/IEC 27001:2022 contains 93 Annex A controls organised across four broad areas.

UK Cyber Compliance helps organisations work through these requirements using an automated and AI-driven ISO 27001 platform that brings risk assessment, controls, policies, evidence and audit readiness into one structured environment.

UK Cyber Compliance (a part of UK Cyber Security Group) provides these services and has a platform to make certification much easier and cheaper.

what is iso 27001

ISO 27001 is the commonly used name for ISO/IEC 27001, the international requirements standard for information security management systems.

The standard gives organisations a structured way to manage information security risk.

Rather than concentrating only on cyber security technology, ISO 27001 looks at the wider way an organisation protects information.

That can include:

• Employees
• Customers
• Suppliers
• Cloud services
• Physical locations
• Business processes
• Laptops and servers
• Applications
• Access rights
• Contracts
• Security incidents
• Business continuity
• Legal obligations
• Management decisions

The ISMS should protect the confidentiality, integrity and availability of information.

Confidentiality concerns preventing unauthorised disclosure.

Integrity concerns keeping information accurate and protected from unauthorised change.

Availability concerns ensuring authorised people can access information and services when needed.

ISO confirms that businesses can implement ISO/IEC 27001 whether or not they decide to seek independent certification.

Clause 1: Scope of the standard

Clause 1 explains the purpose and applicability of ISO/IEC 27001 itself.

This is different from your organisation’s ISMS scope.

Clause 1 establishes that ISO 27001 contains requirements for establishing, implementing, maintaining and continually improving an ISMS within the context of an organisation.

It also makes information security risk assessment and treatment central to the standard.

The requirements are designed so organisations across many sectors can apply them.

You do not need to create a special document to satisfy Clause 1.

Instead, this clause helps you understand what the standard covers before you move into the operational requirements.

Do not confuse Clause 1 with your ISMS scope

Your own ISMS scope appears under Clause 4.

That document defines what part of your organisation the certification will cover.

Clause 1 of the standard simply explains what ISO 27001 itself covers.

This distinction prevents confusion when preparing audit documentation.

Clause 2: Normative references

Clause 2 deals with normative references.

This section identifies other standards that provide information required for correctly applying ISO 27001.

For ISO/IEC 27001:2022, ISO/IEC 27000 provides relevant terminology and vocabulary.

You normally do not need to create separate compliance evidence specifically for Clause 2.

However, understanding the recognised terminology helps keep your ISMS documents accurate and consistent.

Terms such as risk, control, information security and management system should mean the same thing across your risk assessments, policies and audit discussions.

Clause 3: Terms and definitions

Clause 3 establishes that relevant terms and definitions come from ISO/IEC 27000.

Again, this section does not normally create a large audit workload.

Its value comes from consistency.

Imagine one manager using “incident” to mean any suspicious email while another uses the same term only for a confirmed major breach.

Different interpretations can create confusion across incident management, reporting and audit evidence.

Your organisation can maintain its own glossary where useful, but it should avoid creating definitions that conflict with the recognised ISO terminology.

Clauses 4 to 10 are where the main certification work happens

Clauses 4 to 10 contain the main management system requirements.

NQA summarises them as:

• Clause 4: Context
• Clause 5: Leadership
• Clause 6: Planning
• Clause 7: Support
• Clause 8: Operation
• Clause 9: Performance evaluation
• Clause 10: Improvement

These clauses form a connected cycle.

You understand the organisation.

Management sets direction.

You plan how to manage risk.

You provide resources and information.

You operate the ISMS.

You measure whether it works.

Then you improve it.

That cycle keeps ISO 27001 from becoming a one-off certification exercise.

Clause 4: Context of the organisation

Clause 4 asks you to understand the organisation before building the ISMS.

This makes practical sense.

A cloud software provider, manufacturing business, counselling practice and financial organisation face very different information security issues.

Your organisation should therefore consider its own circumstances before selecting controls.

Understand internal and external issues

Clause 4 asks you to identify internal and external issues that can affect the ISMS.

Internal issues might include:

• Business structure
• Employee arrangements
• Technology dependence
• Remote working
• Security knowledge
• Business processes
• Existing governance
• Organisational change

External issues might include:

• Cyber threats
• Regulation
• Customer requirements
• Contracts
• Supplier dependency
• Economic conditions
• Technology change
• Industry requirements

Amendment 1:2024 also added climate action considerations to ISO management system requirements. Organisations now need to determine whether climate change represents a relevant issue within their management system context.

The requirement does not mean every organisation needs a major climate programme inside its ISMS.

It means management should consider whether climate-related issues could affect the management system and record a sensible decision.

Identify interested parties

Clause 4 also asks organisations to understand relevant interested parties.

These can include:

• Customers
• Employees
• Regulators
• Suppliers
• Business partners
• Insurers
• Shareholders
• Public-sector customers

The organisation should identify relevant information security requirements associated with those parties.

For example, a customer contract might require incident notification within a defined period.

A regulator may impose security obligations.

A supplier may create an important operational dependency.

These requirements can influence risk assessment, controls and objectives.

Define your ISMS scope

Clause 4 also requires the organisation to define the ISMS scope.

Your scope should explain the boundaries and applicability of the management system.

It may identify:

• Business services
• Locations
• Organisational functions
• Technology environments
• Relevant interfaces
• Dependencies

The scope should be clear enough for customers and auditors to understand what certification covers.

Avoid making it artificially narrow simply to reduce work.

If an excluded service can materially affect information security inside the certified environment, an auditor may question the boundary.

Establish the ISMS

The final part of Clause 4 requires you to establish, implement, maintain and continually improve the ISMS.

This connects the entire standard.

Your ISMS is not one policy or one piece of software.

It is the collection of governance, risk, controls, processes, evidence and improvement activities used to manage information security.

Clause 5: Leadership

Clause 5 places responsibility firmly with senior management.

ISO 27001 should not operate as an isolated IT project.

Top management needs to demonstrate leadership and commitment.

That means senior leaders should understand the purpose of the ISMS and support its operation.

What leadership should demonstrate

Management should make sure information security aligns with the organisation’s wider direction.

Leaders should:

• Support the ISMS
• Provide appropriate resources
• Promote information security
• Assign responsibilities
• Support continual improvement
• Make sure the ISMS achieves its intended outcomes

An auditor may speak directly with senior management.

Senior leaders should therefore be able to discuss significant information security risks, objectives and their role in the ISMS.

Establish the Information Security Policy

Clause 5 requires top management to establish an Information Security Policy.

The policy should provide direction and include commitments relevant to information security and continual improvement.

Management should approve it.

The organisation should also communicate it appropriately.

A policy hidden inside a folder provides little value.

Employees should understand the security expectations relevant to their work.

Define roles and responsibilities

Someone needs responsibility for each important part of the ISMS.

That includes responsibility for:

• Risk
• Policies
• Security controls
• Audit activity
• Evidence
• Corrective actions
• Objectives

In a smaller business, one person may hold several responsibilities.

That can work perfectly well when responsibilities remain clear.

Clause 6: Planning

Clause 6 is one of the most important parts of ISO 27001 because it deals with risk and objectives.

This is where the organisation decides what could affect information security and what it intends to do about it.

Address risks and opportunities

The organisation needs to consider risks and opportunities that could affect the ISMS.

This includes information security risk, but Clause 6 also looks at the wider ability of the management system to achieve its intended outcomes.

The organisation should prevent or reduce unwanted effects and support continual improvement.

Complete the information security risk assessment

Clause 6.1.2 requires a defined information security risk assessment process.

Your process should establish:

• Risk criteria
• Risk acceptance criteria
• How risks are identified
• How risk owners are assigned
• How likelihood is assessed
• How impact is assessed
• How risk is evaluated

The method needs to produce consistent, valid and comparable results.

UK Cyber Compliance’s current guidance describes risk assessment as a central part of ISO 27001 and links risk identification, likelihood, impact, ownership, treatment and residual risk.

Treat information security risk

Clause 6.1.3 covers risk treatment.

Once you know which risks require action, you need to decide how to manage them.

The organisation determines the controls needed to implement its chosen treatment.

It then compares those controls with Annex A to make sure it has not overlooked anything relevant.

The resulting control decisions feed into the Statement of Applicability.

UK Cyber Compliance describes the SoA as the record connecting risk assessment, treatment decisions and necessary controls.

Create the Statement of Applicability

The Statement of Applicability needs to record the organisation’s necessary controls.

It should explain why those controls are necessary, whether they have been implemented and why any Annex A controls have been excluded.

This makes the SoA one of the most important records in the ISMS.

The document should reflect your actual control environment rather than becoming a generic Annex A checklist.

Set information security objectives

Clause 6 also requires information security objectives.

Objectives should be measurable where practicable.

For example, an organisation might aim to:

• Reduce overdue security actions
• Improve security training completion
• Complete supplier reviews
• Improve access review performance
• Reduce vulnerability remediation delays

Assign ownership and track performance.

The objective should help management understand whether information security is improving.

Plan significant ISMS changes

ISO/IEC 27001:2022 also includes clearer requirements around planning changes to the ISMS.

When the organisation makes an important change, management should consider how that change affects the ISMS.

This could include major technology changes, new offices, acquisitions, new services or restructuring.

Clause 7: Support

Clause 7 focuses on what the organisation needs to operate the ISMS effectively.

This covers resources, competence, awareness, communication and documented information.

Provide appropriate resources

Management needs to provide enough resources to establish, operate and improve the ISMS.

Resources can include:

• People
• Time
• Technology
• Training
• External expertise
• Security services
• Management attention

A risk treatment plan cannot succeed when nobody has the authority or resources to complete the actions.

Resource decisions should therefore connect with risk and business priority.

Make sure people are competent

Employees performing work that affects information security need appropriate competence.

That competence may come from:

• Experience
• Training
• Qualifications
• Internal guidance
• Professional development

You should retain suitable evidence.

An employee does not need a formal security qualification simply because they handle business information.

Competence should match their role and responsibilities.

Build information security awareness

Employees should understand the Information Security Policy, their contribution to the ISMS and the consequences of failing to follow relevant security requirements.

Awareness activities can include:

• Induction
• Training
• Security briefings
• Phishing exercises
• Staff communications
• Policy acknowledgement

Awareness should become part of normal business activity.

Manage communications

The organisation should determine relevant ISMS communications.

Ask:

What needs communicating?

When should it be communicated?

Who needs the information?

Who has responsibility for communicating it?

This becomes particularly important during incidents, major system changes and regulatory events.

Control documented information

ISO 27001 requires controlled documented information.

Documents and records should remain identifiable, current and appropriately protected.

Control may include:

• Ownership
• Review
• Approval
• Version control
• Access
• Retention
• Protection
• Disposal

A central compliance platform can help reduce the difficulty of managing policies, evidence and revisions across separate folders and spreadsheets.

Clause 8: Operation

Clause 8 moves planning into action.

The organisation needs to operate the processes required by the ISMS and implement the actions identified under Clause 6.

This is where ISO 27001 becomes visible in day-to-day business operations.

Operational planning and control

Your organisation should make sure information security processes happen as planned.

That may involve:

• Access reviews
• Supplier reviews
• Backup testing
• Vulnerability management
• Security monitoring
• Incident response
• Risk reviews
• Employee security processes

Keep enough evidence to demonstrate that required activities happened.

Policies explain expectations.

Operational records show that employees followed them.

Perform information security risk assessments

Clause 8.2 requires risk assessments at planned intervals and when significant changes happen or are proposed.

Risk assessment should therefore remain active after initial certification.

Triggers may include:

• New technology
• Significant incidents
• New suppliers
• Business acquisitions
• Major customer requirements
• New services
• Important vulnerabilities

UK Cyber Compliance highlights the requirement to repeat assessments at planned intervals and following significant change.

Implement risk treatment

Clause 8.3 requires the organisation to implement the information security risk treatment plan.

This sounds obvious, but it matters.

Writing an action into a treatment plan does not mean you have reduced the risk.

The control or action needs to operate before the organisation can claim the benefit.

Keep evidence showing completion and effectiveness.

Clause 9: Performance evaluation

Clause 9 asks a straightforward question:

Is the ISMS actually working?

This clause covers monitoring, measurement, internal audit and management review.

Monitor and measure performance

Decide what you need to monitor.

Useful measures might include:

• Security incidents
• Overdue risk actions
• Access review completion
• Training completion
• Vulnerability remediation
• Supplier reviews
• Audit findings
• Security objective progress

The organisation should decide how and when it will measure performance.

Management then needs to evaluate the results.

Collecting figures that nobody reviews does not improve security.

Complete internal audits

Internal audit is a core ISO 27001 requirement.

An internal audit should evaluate whether the ISMS conforms to the organisation’s own requirements and ISO 27001.

Create an audit programme.

Define scope and criteria.

Use suitably objective auditors.

Review real evidence.

Record findings.

Then address identified weaknesses.

Internal audit gives the organisation an opportunity to identify problems before the external certification auditor does.

Conduct management review

Top management needs to review the ISMS at planned intervals.

Management review should consider relevant information such as:

• Previous actions
• Changes affecting the ISMS
• Audit findings
• Information security objectives
• Risk status
• Monitoring results
• Interested party feedback
• Improvement opportunities
• Resource needs

The review should result in decisions and actions.

A meeting record that simply says “everything is fine” offers little evidence of meaningful oversight.

Clause 10: Improvement

Clause 10 makes continual improvement part of the ISMS.

Certification does not mean the organisation has reached a final security state.

Technology changes.

Threats change.

Businesses change.

Customers change.

The ISMS needs to adapt.

Manage nonconformities

A nonconformity occurs when a requirement has not been met.

The organisation needs a process for responding.

That normally means:

• Understanding what happened
• Correcting the immediate issue
• Considering the cause
• Deciding whether corrective action is needed
• Implementing action
• Checking whether it worked

Record the activity.

An auditor will often examine how previous findings were addressed.

Improve continually

Continual improvement can come from many sources:

• Internal audit
• External audit
• Security incidents
• Risk review
• Employee feedback
• Customer feedback
• Management review
• Performance monitoring
• Corrective action

The organisation should use those inputs to improve the suitability, adequacy and effectiveness of the ISMS.

Finding a weakness does not mean the ISMS has failed.

Ignoring a known weakness creates the bigger problem.

How Annex A fits with the clauses

Annex A often receives more attention than Clauses 4 to 10, but the two serve different purposes.

Clauses 4 to 10 establish the mandatory management system framework.

Annex A provides the information security control reference.

ISO/IEC 27001:2022 contains 93 Annex A controls. UKAS states that these controls sit across four broad themes and that the 2022 revision introduced 11 new controls, merged 24 and updated 58.

Those four areas cover:

• Organisational controls
• People controls
• Physical controls
• Technological controls

Risk treatment determines which controls your organisation needs.

You then compare your chosen controls with Annex A.

The Statement of Applicability records the resulting decisions.

Do not treat Annex A as 93 automatic requirements that every business must implement identically.

Who needs iso 27001 certification

ISO 27001 can support businesses, charities, public-sector suppliers and other organisations that need structured information security governance.

Certification can become particularly useful when an organisation:

• Handles sensitive information
• Provides cloud or IT services
• Processes customer data
• Supplies larger organisations
• Participates in tenders
• Works in regulated sectors
• Needs stronger information security governance
• Faces contractual security requirements
• Wants independent security assurance

ISO notes that organisations can implement ISO/IEC 27001 without seeking certification, while others choose certification to provide additional reassurance to customers and other interested parties.

The standard has significant international adoption. ISO reports that more than 70,000 ISO/IEC 27001 certificates were recorded across 150 countries in its 2022 survey data.

What is ISO 27001 Certification?

ISO 27001 certification provides independent assessment of an organisation’s ISMS against ISO/IEC 27001.

ISO publishes the standard but does not issue organisational certification itself.

An independent certification body performs the assessment.

For UK businesses seeking accredited certification, UKAS accreditation provides additional assurance regarding the competence of certification bodies.

UKAS has also updated its arrangements around ISO/IEC 27006-1:2024, the specialist standard covering bodies that audit and certify information security management systems. The 2024 revision includes updated remote audit requirements and alignment with the Annex A controls in ISO/IEC 27001:2022.

ISO 27001 Certification Levels

ISO 27001 does not use official bronze, silver, gold or similar certification levels.

An organisation defines an ISMS scope and demonstrates conformity with the applicable requirements.

The certification journey normally involves:

• Stage 1
• Stage 2
• Ongoing surveillance
• Recertification later in the certification cycle

Stage 1 normally focuses heavily on readiness and whether the ISMS has been established properly.

Stage 2 examines implementation and effectiveness in greater detail.

The auditor may interview employees, examine evidence and trace risks through treatment and controls.

How the Certification Works

The clauses give you a useful order for implementation.

Start with Clause 4.

Understand the organisation, interested parties and scope.

Move to Clause 5.

Gain senior management commitment, establish policy and assign responsibilities.

Use Clause 6 to define risk criteria, assess risk, plan treatment, select controls and set objectives.

Clause 7 makes sure you have resources, competent people, awareness, communication and controlled documentation.

Clause 8 turns plans into operational activity.

Clause 9 checks whether everything works through monitoring, internal audit and management review.

Clause 10 addresses weaknesses and drives continual improvement.

Once the ISMS operates properly, the external certification process can begin.

BSI confirms that certification assessments normally use a two-stage audit process.

A well-built ISMS makes this process much easier because the auditor can follow a clear route from requirement to process, from process to evidence and from evidence to management decision.

Why the clauses matter beyond certification

The clauses create a management system rather than a technical checklist.

This becomes important when you consider current cyber risk.

The UK Government’s Cyber Security Breaches Survey 2025/2026 found that 43 per cent of UK businesses identified a cyber breach or attack during the previous 12 months. That represents approximately 612,000 businesses.

The figure increased to 65 per cent among medium businesses and 69 per cent among large businesses.

Phishing remained the most common attack, affecting 38 per cent of businesses.

The same government research estimated that 19 per cent of businesses experienced at least one cyber crime during the previous 12 months, equivalent to approximately 267,000 businesses.

ISO 27001 gives management a structured framework for addressing these risks.

Clause 4 helps the organisation understand its exposure.

Clause 5 establishes responsibility.

Clause 6 ensures risk receives structured assessment.

Clause 7 provides resources and capability.

Clause 8 puts controls into operation.

Clause 9 checks effectiveness.

Clause 10 drives improvement.

The structure makes information security an ongoing business responsibility rather than a collection of disconnected security products.

Which UK-based firms offer ISO 27001 consultancy services?

UK organisations can obtain ISO 27001 support from information security consultancies, managed security businesses, compliance specialists and technology-led compliance providers.

A useful provider should help you understand the clauses rather than simply give you documents.

Support may include:

• Organisational context
• Interested party requirements
• ISMS scope
• Leadership responsibilities
• Information Security Policy
• Risk assessment
• Risk treatment
• Statement of Applicability
• Security objectives
• Resource allocation
• Training and awareness
• Operational controls
• Evidence preparation
• Internal audit readiness
• Management review
• Corrective action
• Audit preparation

UK Cyber Compliance provides ISO 27001 support through an automated and AI-driven platform.

Its current platform guidance connects risk assessment, risk treatment, Annex A controls, the Statement of Applicability, documentation, evidence and audit readiness.

This structured approach can reduce the difficulty of managing information across separate spreadsheets, folders and manual trackers.

Use the clauses as your ISO 27001 roadmap

The clauses can provide a straightforward route through certification.

Clause 4 asks what your organisation is, who matters and what the ISMS covers.

Clause 5 asks who leads the ISMS and what direction management has set.

Clause 6 asks what could go wrong, what you plan to do about it and what objectives you want to achieve.

Clause 7 asks whether you have the resources, skills, awareness, communication and information needed to make the ISMS work.

Clause 8 asks whether you actually perform the activities you planned.

Clause 9 asks whether those activities achieve the intended results.

Clause 10 asks what you will do when weaknesses appear and how you will keep improving.

This sequence makes ISO 27001 much easier to understand.

You do not need to begin by memorising 93 Annex A controls.

Start with the business.

Define your scope.

Understand interested parties.

Get management involved.

Assess risk.

Choose appropriate controls.

Operate them.

Collect evidence.

Audit the system.

Review it.

Improve it.

That is the logic behind ISO 27001.

A practical clause readiness check

Before your certification assessment, work through each area.

For Clause 4, ask:

Do we understand the internal and external issues affecting the ISMS?

Have we identified relevant interested parties?

Do we understand their relevant security requirements?

Is the ISMS scope clear?

For Clause 5, ask:

Does senior management actively support the ISMS?

Is the Information Security Policy approved?

Are responsibilities clearly assigned?

For Clause 6, ask:

Do we have defined risk criteria?

Have we completed the risk assessment?

Are risk owners assigned?

Have we completed risk treatment?

Is the Statement of Applicability current?

Have we established information security objectives?

For Clause 7, ask:

Have we provided appropriate resources?

Are relevant employees competent?

Do employees understand their security responsibilities?

Are communication arrangements clear?

Do we control ISMS documents and records?

For Clause 8, ask:

Are our processes operating?

Are risk assessments reviewed when required?

Have risk treatment actions been implemented?

Can we demonstrate this with evidence?

For Clause 9, ask:

Do we monitor ISMS performance?

Have we completed internal audit?

Has senior management completed management review?

For Clause 10, ask:

Do we record and address nonconformities?

Do corrective actions address underlying causes?

Can we demonstrate continual improvement?

If the answers are clear and supported by evidence, your organisation is building a strong foundation for external certification.

Bring the clauses together in one working ISMS

The most important thing to understand about ISO 27001 clauses is that they are connected.

Context influences scope.

Scope determines which information and services the ISMS manages.

Leadership gives the ISMS authority.

Risk assessment identifies exposure.

Risk treatment determines necessary controls.

Support gives people the resources to operate those controls.

Operational processes put them into practice.

Monitoring and audits test whether they work.

Management review gives senior leaders oversight.

Corrective action and continual improvement strengthen the ISMS over time.

Annex A then supports this process by providing a recognised set of information security controls for consideration during risk treatment.

UK Cyber Compliance helps bring these activities together using an automated and AI-driven platform that connects the ISO 27001 clauses with risk, controls, documentation, evidence and certification preparation.

For businesses approaching ISO 27001 for the first time, Clauses 4 to 10 provide one of the clearest ways to organise the work.

Follow them in sequence, keep the requirements connected to your actual business and retain evidence as activities take place.

When those clauses operate as one management system rather than separate compliance tasks, ISO 27001 becomes easier to manage, easier to audit and far more valuable to the organisation after certification.

UK Cyber Compliance is here to help

For more information, please do get in touch.

Please check out our Free Cyber Insurance

Other blog posts, Your ISO 27001 Questions Answered, Get ISO 27001 Certified ,

If you would like to know more, do get in touch as we are happy to answer any questions. Looking to improve your cybersecurity but not sure where to start? Begin by getting certified in Cyber Essentials, the UK government’s scheme that covers all the technical controls that will provide the protection that you need to help guard against criminal attacks.