Clause 6: Planning

1. Your approach to planning: how risks and opportunities from your issues and interested parties are identified.
2. Your risk register showing risks linked to those issues and needs.
3. Plans showing how actions are built into everyday work and how you check they worked.
4. Be able to explain how planning connects to the business.

1. Master list of ISMS documents
2. ISMS scope statement
3. ISMS roles, responsibilities and authorities document
4. Risk assessment and treatment methodology
5. Corrective action and continual improvement procedure
6. Information security objectives plan

1. Your risk assessment method: how you identify risks, rate likelihood and impact, and decide which risks are acceptable.
2. A completed risk register with an owner, rating and date for each risk.
3. Proof the assessment was repeated, giving consistent results.
4. Records of new risks added after changes.
5. The risk owner should be able to explain how a risk was rated.

1. Risk assessment and treatment methodology
2. Risk Management Policy

1. Your risk treatment plan: what you will do about each risk, who owns it and by when.
2. Your Statement of Applicability (SoA): the list of all 93 Annex A controls showing which you use and why, and why any are left out.
3. Proof risk owners approved the plan and accepted the remaining risk.
4. Progress updates on treatment actions.
5. Be able to explain how a risk led to the controls you chose.

1. Risk assessment and treatment methodology
2. Statement of Applicability (SoA)

1. Your security objectives: measurable goals with an owner, deadline and resources.
2. Progress reports against each objective.
3. Proof objectives were shared with the relevant people.
4. Owners should be able to explain progress and next steps.

Information security objectives plan