ISO/IEC 27001 Clause 6 Explained – Planning for Information Security
Effective information security requires more than identifying risks or defining security policies. Organizations also need a structured approach for deciding what needs to be addressed, which objectives should be achieved and how planned changes to the Information Security Management System are implemented.
This is the purpose of ISO/IEC 27001 Clause 6 – Planning.
Clause 6 connects the organizational context and leadership commitments established in the previous clauses with concrete information security planning activities.
It addresses three central areas:
- Actions to address risks and opportunities
- Information security objectives and planning to achieve them
- Planning changes to the Information Security Management System
This article explains the main concepts behind ISO/IEC 27001 Clause 6 and how they contribute to an effective ISMS.
What Is ISO/IEC 27001 Clause 6?
Clause 6 focuses on planning the activities required to establish, maintain and continually improve an effective Information Security Management System (ISMS).
The organization has already established important foundations in the preceding clauses.
Clause 4 – Context of the Organization establishes the organizational context, interested parties and scope of the ISMS.
Clause 5 – Leadership addresses leadership commitment, information security policy and organizational responsibilities.
Clause 6 builds upon these foundations.
The organization now needs to determine which risks and opportunities must be addressed, establish information security objectives and plan relevant changes to the ISMS.
The Structure of ISO/IEC 27001 Clause 6
Clause 6 can be divided into three main areas:
6.1 – Actions to Address Risks and Opportunities
The organization determines relevant risks and opportunities and establishes appropriate actions.
This includes the information security risk assessment and risk treatment processes.
6.2 – Information Security Objectives and Planning to Achieve Them
Organizations establish information security objectives and determine how those objectives will be achieved.
6.3 – Planning of Changes
When changes to the ISMS are required, they need to be carried out in a planned manner.
Together, these requirements create the planning foundation for the subsequent operation of the ISMS.
Clause 6.1 – Actions to Address Risks and Opportunities
Planning begins with understanding which uncertainties could affect the intended outcomes of the Information Security Management System.
The organization needs to consider the issues and requirements identified through its organizational context and determine relevant risks and opportunities.
Actions should then be planned to address them.
This helps the organization:
- support the intended outcomes of the ISMS
- prevent or reduce undesired effects
- support continual improvement
The planned actions also need to be integrated into the relevant ISMS processes and their effectiveness evaluated.
This creates an important connection between organizational context, risk management and operational information security activities.
Information Security Risk Assessment
A central element of Clause 6 is the establishment of an appropriate information security risk assessment process.
The objective is to systematically identify and evaluate information security risks relevant to the organization.
A structured process typically considers:
Risk Identification
↓
Risk Analysis
↓
Risk Evaluation
The organization needs to establish and maintain suitable risk criteria so that assessments can be performed consistently and produce comparable and reproducible results.
Identifying Information Security Risks
The first step is identifying risks associated with the loss of:
Confidentiality
Integrity
Availability
of information within the scope of the ISMS.
Risk identification should consider the organization’s actual information, processes, systems and business environment.
Responsibilities for identified risks also need to be established.
This is important because risk management requires ownership.
Without clearly assigned responsibility, identified risks can remain documented without being effectively managed.
Analyzing Information Security Risks
After risks have been identified, they need to be analyzed.
Risk analysis considers the potential consequences that could result if a risk materializes.
It also considers the realistic likelihood of occurrence.
These factors are then used to determine the resulting level of risk.
A simplified conceptual relationship is:
Likelihood + Consequence → Risk Level
The exact assessment methodology can differ between organizations.
For example, an organization may use qualitative categories such as:
Low – Medium – High
or a more detailed scoring system.
What matters is that the methodology is defined, appropriate and applied consistently.
Evaluating Information Security Risks
Risk analysis alone does not determine what should be done.
The calculated or estimated risk levels need to be compared with the organization’s established risk criteria.
This allows the organization to determine which risks require treatment and how priorities should be established.
The complete assessment process therefore follows a logical progression:
Identify → Analyze → Evaluate
The output provides the basis for information security risk treatment.
MASTER ISO/IEC 27001 INFORMATION SECURITY MANAGEMENT
Build a structured understanding of ISO/IEC 27001 — from organizational context and leadership to risk management, security objectives, operational controls and continual improvement.
✓ Practical explanations of ISO/IEC 27001 requirements
✓ Structured Information Security Management training
✓ Certificate of Completion included
Information Security Risk Treatment
Once risks have been assessed and evaluated, the organization needs to determine how they should be treated.
Risk treatment involves selecting appropriate options for addressing identified information security risks.
Depending on the situation, this can involve reducing or modifying a risk through suitable measures, avoiding activities that create the risk, or making other justified treatment decisions.
The selected treatment needs to be appropriate to the organization’s risk criteria and risk acceptance approach.
Selecting Information Security Controls
One of the most important steps in risk treatment is determining which controls are necessary.
Controls are selected based on the organization’s identified information security risks and chosen risk treatment approach.
ISO/IEC 27001 includes Annex A as an important reference set of information security controls.
However, Annex A should not simply be treated as a checklist where every control is automatically implemented.
The control selection needs to reflect the organization’s actual risks and treatment requirements.
Organizations may also require controls beyond those listed in Annex A when necessary.
This risk-based approach is fundamental to ISO/IEC 27001.
What Is the Statement of Applicability?
The Statement of Applicability, commonly abbreviated as SoA, is an important output associated with the risk treatment process.
It documents the controls considered necessary for the organization’s ISMS and provides important information regarding their applicability and implementation status.
Where Annex A controls are excluded, the organization needs to justify those exclusions.
The Statement of Applicability therefore creates an important connection between:
Risk Assessment
↓
Risk Treatment
↓
Control Selection
↓
Statement of Applicability
It provides transparency regarding how the organization’s control environment relates to its information security risks.
The Information Security Risk Treatment Plan
The selected risk treatment activities also need to be translated into a risk treatment plan.
The plan establishes how the selected treatment decisions will be implemented.
Depending on the organization, this can include responsibilities, actions, resources and implementation priorities.
The relevant risk owners also need to be involved in accepting the treatment plan and the remaining information security risks.
This prevents risk treatment from becoming purely a technical cybersecurity exercise.
Information security risk remains a business responsibility.
Clause 6.2 – Information Security Objectives
Clause 6 is not limited to managing risks.
Organizations also need to establish information security objectives at relevant functions and levels.
Objectives help translate the information security policy and strategic direction into measurable or evaluable outcomes.
Examples might relate to areas such as:
- reducing information security incidents
- improving security awareness
- increasing completion of security activities
- improving vulnerability remediation
- strengthening access management
The appropriate objectives depend on the organization and its information security context.
What Makes a Good Information Security Objective?
Information security objectives should not simply be broad statements such as:
“Improve cybersecurity.”
An effective objective should provide sufficient direction for implementation and evaluation.
ISO/IEC 27001 requires organizations to consider several aspects when defining and managing information security objectives.
Objectives should be consistent with the information security policy and should be measurable where practicable.
They should also consider applicable information security requirements and relevant results from risk assessment and risk treatment.
Objectives need to be monitored, communicated and updated where appropriate.
This turns objectives into active management tools rather than static statements.
Planning How to Achieve Information Security Objectives
Defining an objective is only the beginning.
The organization also needs to determine how the objective will actually be achieved.
Planning should address questions such as:
What will be done?
What resources are required?
Who is responsible?
When will the activity be completed?
How will the results be evaluated?
This creates a direct relationship between strategic information security objectives and concrete organizational actions.
A useful conceptual workflow is:
OBJECTIVE
↓
ACTION
↓
RESPONSIBILITY
↓
RESOURCES
↓
TIMELINE
↓
EVALUATION
Without this planning step, objectives can easily remain aspirational rather than operational.
Clause 6.3 – Planning Changes to the ISMS
Information Security Management Systems are not static.
Organizations change.
Technology changes.
Business processes change.
Threats and information security requirements change.
The ISMS therefore also needs to evolve.
Clause 6.3 requires changes to the Information Security Management System to be carried out in a planned manner.
This helps prevent uncontrolled changes from undermining established information security processes or management-system effectiveness.
Examples of changes that could affect an ISMS include:
- organizational restructuring
- introduction of new technologies
- changes to business processes
- new information systems
- changes in suppliers or external services
- changes to regulatory or contractual requirements
The significance and consequences of a change should therefore be considered before implementation.
How Clause 6 Connects to the ISO/IEC 27001 ISMS
Clause 6 should not be viewed as an isolated planning exercise.
It connects directly with the surrounding management-system requirements.
A simplified sequence is:
Clause 4 – Context
↓
Clause 5 – Leadership
↓
Clause 6 – Planning
↓
Clause 7 – Support
↓
Clause 8 – Operation
↓
Clause 9 – Performance Evaluation
↓
Clause 10 – Improvement
Clause 6 therefore represents an important transition.
The organization moves from understanding its environment and establishing leadership direction toward defining what needs to be addressed and how information security objectives will be achieved.
Later clauses then support implementation, operation, evaluation and improvement.
Risk Assessment vs Risk Treatment
Risk assessment and risk treatment are closely connected but serve different purposes.
Risk Assessment asks:
What could happen, how significant is the risk and which risks require attention?
Risk Treatment asks:
What are we going to do about those risks?
The relationship can be summarized as:
Identify Risk
→ Analyze Risk
→ Evaluate Risk
→ Select Treatment
→ Select Controls
→ Accept Residual Risk
Keeping these concepts separate helps organizations maintain a structured and traceable information security risk management process.
Common Mistakes When Implementing Clause 6
Several implementation mistakes can reduce the effectiveness of Clause 6.
Treating Risk Assessment as a One-Time Exercise
Information security risks change as technologies, processes and threats evolve.
Risk assessment therefore needs to remain part of the ongoing ISMS.
Using Annex A as a Simple Checklist
Controls should reflect actual risk treatment requirements rather than being selected only because they appear in Annex A.
Defining Objectives Without Implementation Plans
An objective without responsibilities, resources and evaluation criteria may have little practical effect.
Using Inconsistent Risk Criteria
Risk assessments should produce consistent and comparable results.
Undefined or constantly changing criteria make this difficult.
Failing to Assign Risk Ownership
Someone needs to be responsible for identified information security risks and the associated decisions.
Making Uncontrolled ISMS Changes
Changes to the management system should be planned rather than introduced without considering their wider consequences.
Why Clause 6 Matters
Clause 6 is where many of the strategic elements of the Information Security Management System begin to become actionable.
The organizational context identifies what matters.
Leadership establishes direction and commitment.
Planning determines:
Which risks require attention?
How will those risks be treated?
Which controls are necessary?
Which information security objectives should be achieved?
How will those objectives be achieved?
How should changes to the ISMS be managed?
This makes Clause 6 a central connection between information security governance and practical implementation.
Key Takeaways
ISO/IEC 27001 Clause 6 establishes the planning requirements for an effective Information Security Management System.
Its three major areas are:
6.1 – Actions to address risks and opportunities
6.2 – Information security objectives and planning to achieve them
6.3 – Planning of changes
Information security risk assessment identifies, analyzes and evaluates risks.
Risk treatment determines appropriate actions and controls for addressing those risks.
Information security objectives translate organizational priorities into defined outcomes, while planning establishes how those objectives will be achieved.
Together, these activities transform information security requirements and intentions into structured, risk-based action.
Learn More About ISO/IEC 27001
Understanding Clause 6 is one part of implementing and maintaining an effective Information Security Management System.
The complete ISO/IEC 27001 framework connects organizational context, leadership, planning, support, operation, performance evaluation and continual improvement.
Our ISO/IEC 27001 Online Training provides a structured introduction to these requirements and explains how the different elements of the ISMS work together.
EXPLORE THE ISO/IEC 27001 ONLINE TRAINING →
