Key takeaways
- Provide the people, money and tools the ISMS needs.
- An ISMS without people, time and budget cannot work.
- Start here: identify resources needed to run the ISMS.
Purpose
Provide the people, money and tools the ISMS needs.
Requirement
Requirement summaryThe organization shall determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the information security management system.
Why it matters
An ISMS without people, time and budget cannot work.
How to implement
- Identify resources needed to run the ISMS.
- Secure approval from management.
- Track whether resources are adequate.
- Raise gaps at management review.
What evidence you need to provide
Here is what you will typically need to provide for Clause 7.1. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- A list of the people, tools and budget assigned to the security programme.
Records and examples to show
- Budget approvals or resource plans.
- Records showing resources were assigned to each objective.
Things you should be able to show or explain
- Be able to explain whether resources are enough.
How much to show: The current plan.
Common mistakes
- No dedicated resources.
- Objectives with no one assigned.
- No dedicated budget or time.
- Resource needs not reviewed.
- Tip: Auditors love version history. Control your documents from day one.
Policies & documents to have
- ISMS scope statement
- ISMS roles, responsibilities and authorities document
- Corrective action and continual improvement procedure
- Human Resource Security Policy
- Information Security Roles and Responsibilities Policy
FAQ
Can we exclude clause 7.1?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
Adequate resource relative to scope.