ISO27001 - Clause 6 (Planning) Explained

In ISO27001, Clause 6 we start talking about Risk Assessment and Risk Treatment. In truth, this is Risk Management and is a fundamental part of the Information Security Management System (ISMS).

If you're trying to implement ISO27001 without understanding risk, or what risks there are in your organisation, then not only will you find it difficult, but you'll fail the audit!

Clause 6 includes;
6.1 Actions to address risks and opportunities
6.1.1 - General
6.1.2 - Information Security Risk Assessment
6.1.3 - Information Security Risk Treatment

6.2 Information Security Objectives and Planning To Achieve Them

6.3 - Planning of Changes