Planning of changes

What the requirement asks

Where the organization decides the ISMS needs to change, the change has to be made in a planned way. This clause is new in the 2022 edition.

What the guidance adds

This clause is new in the 2022 edition and the guidance gives it real weight. Change is expected to be planned before it happens: the purpose, the consequences, the resources, the responsibilities and the effect on the system are recorded. A change log that records only the date and the title does not meet the clause.

What good looks like

Keep A procedure or approach for planning changes to the ISMS with the clause record, and give it an owner and a review date.

Evidence an assessor asks for

• ISMS change planningA procedure or approach for planning changes to the ISMS
• ISMS change planningRecords of ISMS changes showing the reason, plan, responsibilities and timing
• ISMS change planningEvidence that consequences of the change and resource needs were considered
• ISMS change planningUpdates to documented information following the change

The question an assessor will ask

An assessor will ask for A procedure or approach for planning changes to the ISMS. The test for 6.3 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.

Common gaps

• ISMS changes such as scope or process changes are made informally with no plan
• No record exists of why a change was made
• Changes are made without updating the documentation
• The clause is not addressed at all because it was new in 2022

Before the next audit

Before the next audit, test this against one live record: isms changes such as scope or process changes are made informally with no plan.