Management system clauses 4–10
These are the mandatory requirements. Clauses 1–3 cover scope, references and terms; certification is assessed against 4–10.
Clause 4
Context of the organization
Understand your organisation and decide what the ISMS covers.
Sub-clauses: 4.1, 4.2, 4.3, 4.4
Clause 5Leadership
Top management must own and drive information security.
Sub-clauses: 5.1, 5.2, 5.3
Clause 6Planning
Assess risks, choose controls, and set objectives.
Sub-clauses: 6.1, 6.2, 6.3
Clause 7Support
Resources, competence, awareness, communication and documents.
Sub-clauses: 7.1, 7.2, 7.3, 7.4, 7.5
Clause 8Operation
Do what you planned: run the processes and treat risks.
Sub-clauses: 8.1, 8.2, 8.3
Clause 9Performance evaluation
Monitor, measure, audit and review.
Sub-clauses: 9.1, 9.2, 9.3
Clause 10Improvement
Fix problems and keep getting better.
Sub-clauses: 10.1, 10.2