Communication

What the requirement asks

The organization must decide what internal and external communication the ISMS needs, covering what is communicated, when, to whom, and how.

What the guidance adds

Communication is expected to be planned: what, when, with whom and how. The guidance also asks who communicates, which matters when an incident message has to leave the organization. A communication plan that lists channels but no triggers is incomplete.

What good looks like

Keep A communication plan or matrix stating topics, timing, audiences and channels for ISMS communication with the clause record, and give it an owner and a review date.

Evidence an assessor asks for

• Communication planningA communication plan or matrix stating topics, timing, audiences and channels for ISMS communication
• Communication planningRecords of communications carried out according to the plan
• Communication planningExternal communication arrangements, for example with customers, regulators and suppliers
• Communication planningEvidence the plan is reviewed

The question an assessor will ask

An assessor will ask for A communication plan or matrix stating topics, timing, audiences and channels for ISMS communication. The test for 7.4 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.

Common gaps

• No communication plan exists, so communication is ad hoc
• External communication needs are not identified
• The plan is not followed in practice
• Responsibilities for communicating are not assigned

Before the next audit

Before the next audit, test this against one live record: no communication plan exists, so communication is ad hoc.