ISO 27001:2022 · Mandatory Requirements
Clauses 4–10: The Requirements You Cannot Exclude
Annex A controls can be excluded with justification — clauses 4 through 10 cannot. They define the management system itself: scope, leadership, risk assessment, the Statement of Applicability, internal audits, and management review. Every clause below links to a full guide covering what it requires, the documents it demands, and what auditors check.
Clause 4: Context of the Organization
Understand what shapes your ISMS and where its boundaries lie.
Understanding the organization and its context
Identifying the internal and external issues that shape your ISMS — the context analysis every later decision traces back to.
Understanding the needs and expectations of interested parties
Determining your stakeholders, their security-relevant requirements, and which of those the ISMS will address.
Determining the scope of the ISMS
Drawing the ISMS boundary — locations, services, assets, and interfaces — and writing the scope statement auditors check first.
Information security management system
Establishing, implementing, maintaining, and continually improving the ISMS and the processes that interact within it.
Clause 5: Leadership
Top management owns the ISMS — policy, roles, and visible commitment.
Leadership and commitment
What top management must visibly do for the ISMS — set direction, provide resources, and integrate security into business process.
Information security policy
Writing and maintaining the information security policy: commitments, objectives framework, approval, communication, and review.
Organizational roles, responsibilities and authorities
Assigning and communicating ISMS roles — who operates it, who reports on its performance, and how authority is delegated.
Clause 6: Planning
Risk assessment, risk treatment, the SoA, and measurable objectives.
Actions to address risks and opportunities
The risk engine of ISO 27001: risk assessment methodology, risk treatment, and the Statement of Applicability (SoA).
Information security objectives and planning to achieve them
Setting measurable information security objectives and planning who will do what, with what resources, by when.
Planning of changes
Carrying out changes to the ISMS in a planned manner — the discipline the 2022 revision made explicit.
Clause 7: Support
Resources, competence, awareness, communication, and document control.
Resources
Determining and providing the resources the ISMS needs to be established, implemented, maintained, and improved.
Competence
Ensuring the people doing ISMS work are competent — defined needs, training or hiring to close gaps, and retained evidence.
Awareness
Making everyone working under the ISMS aware of the policy, their contribution, and the consequences of nonconformity.
Communication
Determining what to communicate about information security, when, to whom, and through which channels — internal and external.
Documented information
Creating, updating, and controlling ISMS documentation — versioning, approval, availability, and protection of every required document.
Clause 8: Operation
Run the plans: operational control and the live risk cycle.
Operational planning and control
Executing the plans: controlling security processes, managing planned changes, and governing externally provided processes.
Information security risk assessment
Performing information security risk assessments at planned intervals and on significant change, and retaining the results.
Information security risk treatment
Implementing the risk treatment plan and retaining the results — where Annex A controls become operational reality.
Clause 9: Performance Evaluation
Measure, internally audit, and review the ISMS at the top.
Monitoring, measurement, analysis and evaluation
Deciding what to measure, how, and when — then evaluating ISMS performance and control effectiveness from the results.
Internal audit
Running an internal audit programme that objectively tests the ISMS against the standard and your own requirements.
Management review
Top management reviewing the ISMS at planned intervals — the required inputs, the decisions, and the retained minutes.
Clause 10: Improvement
Fix nonconformities at the root and keep the ISMS improving.
Keep Exploring
Related Reading
ISO 27001 Knowledge Hub
All 93 Annex A controls, all clauses, every guide in the cluster.
Read moreISO 27001 Controls Library
Browse all 93 Annex A controls with implementation guidance.
Read moreAnnex A Controls Overview
All 93 controls across organizational, people, physical and tech domains.
Read moreISO 27001 Requirements
Clauses 4–10 and the 93 Annex A controls, explained.
Read moreISO 27001 Certification Guide
The step-by-step path from gap assessment to certificate.
Read moreISO 27001 Overview
The ISMS standard — the baseline certificate global buyers ask for.
Read moreGet in touch
Book a free consultation or send us your requirements. We respond within 24 hours.
Quick Call
Pick a time slot
Send Requirements
Get a custom quote in 24 hours