Clause 7.1 Resources

"Put your money where your policy is" — that is clause 7.1 in one line. Leadership signed an information security policy (clause 5.2) and approved objectives (clause 6.2). This clause asks whether anything real was allocated to deliver them. It is among the shortest requirements in the standard and carries some of the sharpest interview questions.

Think in four buckets. People: named individuals with actual capacity, not an "ISMS manager" title bolted onto a full-time job with five percent of nobody's week behind it. Budget: tooling licenses, training, certification body fees, external support. Tools: the categories the ISMS leans on — a vulnerability scanner, a SIEM or log platform, MDM, identity and access tooling, a GRC tracker or its spreadsheet equivalent. Time: management review attendance, internal audit windows, awareness sessions, and the evidence preparation that precedes every external audit.

The determination should be derived, not guessed. The risk treatment plan, the objectives, the internal audit program, and the surveillance audit calendar collectively define what the ISMS will consume next year. Price that, present it to leadership, and record what was decided — including what was consciously deferred. A deliberate, documented decision to defer with eyes open is defensible. Silent under-allocation is not.

Here is the part practitioners miss: auditors rarely assess 7.1 from a budget document. They infer it from symptoms scattered across the audit — corrective actions that age past their due dates, internal audits that slip quarters, a risk register last touched before the previous surveillance visit, one person answering every interview question. By the time a 7.1 conversation happens, the evidence has usually already accumulated elsewhere.

Under-resourcing is the root cause behind the most common recurring nonconformities — overdue actions, stale registers, missed internal audits. Auditors are trained to connect those dots, and certification bodies increasingly write the connection down: the individual findings cite other clauses, while the root-cause narrative cites 7.1.

The certification stake escalates with persistence. At Stage 1, being unable to say who runs the ISMS and with what capacity signals unreadiness. At Stage 2 and surveillance, a pattern of missed ISMS activities can shift findings from the activity clauses to clause 7.1 — and a pattern that leadership has watched without acting reaches clause 5.1, where major nonconformities live.

What chronic under-resourcing produces:

• A paper ISMS – policies and registers exist, but nobody operates the controls or maintains the records between audits
• The overdue-actions fingerprint – corrective actions and audit findings aging past their due dates is the first under-resourcing signal every auditor reads
• Key-person fragility – a one-person ISMS stops the day that person resigns, and auditors increasingly probe succession and coverage directly
• Escalation to leadership findings – resource gaps that persist across audit cycles get written against top management commitment, not just against 7.1