Resources

Plain-language summary

Determining and providing what the ISMS needs to be established, run, maintained and improved — people, time, money, tools and expertise — rather than expecting IT to absorb it.

What the clause is really asking

The clause is one sentence, but it is the one that decides whether everything else happens. Resources means more than a security budget: it is the ISMS lead's time, the hours process owners spend on risk workshops and audits, the training budget, the licences for monitoring and backup tooling, external expertise where internal skills are missing (penetration testing, legal review of POPIA obligations), and the internal audit capacity to cover the ISMS. Resourcing is also where leadership commitment becomes visible — the auditor will connect this clause to 5.1. In an integrated system the resources are shared: the same audit programme and document control serve both standards, which is the practical argument for extending an existing QMS rather than building a second one.

What auditors look for

Auditors ask how the resource need was determined and whether it was met: is there an ISMS budget line, who has time formally allocated, were requested resources refused and what happened to the risk as a result? They look for evidence of under-resourcing elsewhere — overdue audits, patching backlogs, incidents attributed to lack of staff, controls in the SoA marked 'planned' for two years. They also check expertise: who assesses technical risk if nobody in-house can, and how was that competence obtained?

Typical evidence

Approved ISMS budget and headcount or time allocations; management-review minutes showing resource decisions; contracts for external expertise; tool and licence inventory supporting controls; evidence that resource gaps raised at review were actioned or formally accepted as risk.

How to comply — recommendations

Cost the ISMS once, honestly: hours by role for the annual calendar (risk reviews, audits, management review, awareness), tooling, external testing and training, and present it to top management with the risks that remain if it is cut. Record the decision. Where a resource is refused, record the residual risk against it and have the risk owner accept it — that turns an under-resourced control into a managed decision rather than a finding. Share resources with your other management systems wherever you can.

Common nonconformities

Resource needs never determined; no budget or time allocated to the ISMS; controls perpetually 'planned' for lack of resources with no risk acceptance; no access to expertise for technical risk assessment or testing; internal audit programme under-staffed and overdue.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.