Actions to address risks and opportunities — General

Plain-language summary

The planning principle behind the whole ISMS: use what you learned about context and interested parties to decide what could stop the ISMS achieving its outcomes, what could help, and what you will do about both.

What the clause is really asking

Before the formal information security risk assessment in 6.1.2, the standard asks a broader question about the management system itself. Considering the issues from 4.1 and the requirements from 4.2, what risks and opportunities need to be addressed so that the ISMS can achieve its intended outcomes, so that undesired effects are prevented or reduced, and so that it keeps improving? These are risks to the system — losing the only person who understands the firewall, a budget cut, a merger, a regulator changing the rules — and opportunities such as a customer certification demand that would fund the programme, or a cloud migration that lets you retire a weak control. You must plan actions for them and plan how to integrate those actions into ISMS processes and evaluate whether they worked. The information-level risks themselves are handled under 6.1.2 and 6.1.3, which make up the heart of the standard. ISO 9001 practitioners will recognise 6.1 almost word for word.

What auditors look for

Auditors check that the organisation distinguishes risks to the ISMS from information security risks, and that the former were actually considered: 'what could stop this management system working, and what did you do about it?' They look for the connection back to 4.1 and 4.2 and forward to actions with owners and dates, and for evaluation — did the action work? They also look for opportunities, because a register that lists only threats shows the question was answered by reflex. A single combined register is acceptable as long as the system-level items are visible in it.

Typical evidence

Risk and opportunity register or section covering risks to the ISMS itself (resources, competence, change, regulation) and opportunities; planned actions with owners and dates; evidence the actions were integrated into ISMS processes (objectives, projects, budgets); evaluation of effectiveness at management review.

How to comply — recommendations

Hold a short planning exercise after the context work: list five to ten things that could derail the ISMS (key-person dependency, budget, business change, a regulator, a supplier) and five opportunities (a customer demand, a technology change, a sister certification). Give each an action, an owner and a date, and fold them into the objectives or the project plan so they are not a separate list that dies. Evaluate them at management review with one word each — worked, partly, not yet. Keep the detailed information security risk assessment for 6.1.2; do not try to make this clause carry it.

Common nonconformities

No consideration of risks and opportunities to the ISMS as a system, only technical threats; actions not planned or not owned; no evaluation of whether the actions worked; opportunities ignored entirely; no link between 4.1/4.2 outputs and this planning.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.