Clause 7: Support

1. A list of the people, tools and budget assigned to the security programme.
2. Budget approvals or resource plans.
3. Records showing resources were assigned to each objective.
4. Be able to explain whether resources are enough.

1. ISMS scope statement
2. ISMS roles, responsibilities and authorities document
3. Corrective action and continual improvement procedure
4. Human Resource Security Policy
5. Information Security Roles and Responsibilities Policy

1. A list of the skills and knowledge needed for security roles.
2. Training records, certificates or CVs showing people have the needed skills.
3. Records of training planned to fill gaps, and checks that it worked.
4. People in key roles should be able to explain how they keep their skills current.

1. Human Resource Security Policy
2. Information Security Policy

1. Your awareness programme plan: topics, audience and timing.
2. Completion records for awareness training.
3. Awareness messages, posters or newsletters.
4. Staff should know the policy exists, how they contribute and what happens if rules are broken.

1. Human Resource Security Policy
2. Information Security Policy
3. Information security communication plan
4. ISMS roles, responsibilities and authorities document

1. Your communication plan: what is shared, when, with whom, by whom and how.
2. Examples of security communications sent internally and externally.
3. Records of messages to customers or authorities when needed.
4. Proof staff received important updates.
5. Be able to explain who is allowed to speak externally about security.

Information security communication plan

1. A list of the documents your security programme needs, including those required by the standard.
2. Copies of those documents and required records (such as audit results and review minutes), kept and easy to find.
3. Proof that records are kept for the time you decided.
4. Be able to show where documents and records are stored.

Document control procedure

1. Your document control rules: titles, version numbers, owners, approval and review.
2. Documents showing version, owner and approval.
3. Approval records showing documents were signed off before use.
4. Be able to show how a new version is approved.

Document control procedure

1. Your rules for storing, sharing, protecting and archiving documents.
2. Access settings for document storage.
3. Proof old versions are archived and not used by mistake.
4. Proof documents from outside sources (such as standards or contracts) are tracked.
5. Be able to show that staff can find the latest version.

Document control procedure