Resources
The organization has to identify and supply the resources needed to set up, run, keep and keep improving the ISMS.
What the requirement asks
The organization has to identify and supply the resources needed to set up, run, keep and keep improving the ISMS.
What the guidance adds
The guidance asks the organization to decide what the system needs and then provide it. That includes people, time, tools, information and access to expertise. The record is a resourcing decision, not a statement that resources will be provided when needed.
Status of the guidance. The guidance lens for 7.1 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Keep an ISMS budget and resource plan approved by management with the clause record, and give it an owner and a review date.
Evidence an assessor asks for
- ISMS resourcingAn ISMS budget and resource plan approved by management
- ISMS resourcingRecords of staffing for ISMS roles and allocated time
- ISMS resourcingEvidence of tools and services funded for security processes
- ISMS resourcingManagement review records addressing resource adequacy
The question an assessor will ask
An assessor will ask for an ISMS budget and resource plan approved by management. The test for 7.1 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.
Common gaps
- Resource needs are never formally determined
- The ISMS depends on unfunded part-time effort
- Tooling needed for controls was never budgeted
- Resource shortfalls raised in reviews are not acted on
Before the next audit
Before the next audit, test this against one live record: resource needs are never formally determined.