Actions to address risks and opportunities: general
When planning the ISMS the organization considers the 4.1 issues and the 4.2 requirements and identifies the risks and opportunities it needs to address so that the ISMS can achieve its outcomes, undesired effects are prevented or....
What the requirement asks
When planning the ISMS the organization considers the 4.1 issues and the 4.2 requirements and identifies the risks and opportunities it needs to address so that the ISMS can achieve its outcomes, undesired effects are prevented or reduced, and continual improvement happens. It must plan actions to address them, and plan how to integrate and implement those actions in its ISMS processes and how to evaluate whether they worked.
What the guidance adds
The guidance treats risk and opportunity as part of the management system, not a separate project. It asks for the criteria the organization uses, the way risk and opportunity are integrated into the processes, and the evidence that the results change a decision. The output should connect to the risk assessment and the treatment plan.
Status of the guidance. The guidance lens for 6.1.1 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Keep A register of ISMS-level risks and opportunities traced to the 4.1 issues and 4.2 requirements with the clause record, and give it an owner and a review date.
Evidence an assessor asks for
- ISMS risk and opportunity planningA register of ISMS-level risks and opportunities traced to the 4.1 issues and 4.2 requirements
- ISMS risk and opportunity planningAction plans addressing each, with owners and integration into ISMS processes
- ISMS risk and opportunity planningRecords evaluating whether the actions were effective
- ISMS risk and opportunity planningEvidence that opportunities, not only risks, were considered
The question an assessor will ask
An assessor will ask for A register of ISMS-level risks and opportunities traced to the 4.1 issues and 4.2 requirements. The test for 6.1.1 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.
Common gaps
- Only information security risks are recorded and ISMS-level risks and opportunities are ignored
- Actions are planned but never evaluated
- No link exists between the context analysis and the risks identified
- Opportunities for improvement are never recorded
Before the next audit
Before the next audit, test this against one live record: only information security risks are recorded and isms-level risks and opportunities are ignored.