Communication

Plain-language summary

Deciding what information security communication the organisation needs, internally and externally — what is said, when, to whom and how — so that policy changes, incidents, breach notifications and customer assurances do not depend on improvisation.

What the clause is really asking

The clause asks you to work out which internal and external communications the ISMS needs and to settle four things for each: what to communicate, when, with whom, and how (the 2022 edition replaced the older items on who communicates and by what process with a single 'how'). Internally that covers policy launches and changes, awareness messages, incident alerts, and management reporting. Externally it covers breach notification to the Information Regulator and affected data subjects under POPIA section 22 (and GDPR's 72-hour rule where it applies), material-incident notification to the FSCA or Prudential Authority for regulated entities, customer notifications under contract, communication with suppliers about security requirements, and responses to security questionnaires and audits. A communication plan is also where you decide who may speak to the press or a customer during an incident — the moment improvisation is most expensive.

What auditors look for

Auditors ask for the communication plan or matrix and test it against events: when the last policy changed, how were people told; when the last incident happened, who was informed, how fast and by whom; if a reportable breach occurred tomorrow, who would notify the Regulator and in what form? They check external obligations are mapped — POPIA s22, contractual notification windows, regulator timelines — with owners and templates, and that internal management reporting (5.3's performance role) actually reaches top management.

Typical evidence

Communication matrix (what, when, with whom, how, owner) covering internal and external communications; breach-notification procedure and templates for the Information Regulator and data subjects; contractual notification obligations register; incident communication roles including media and customer contact; records of communications sent (policy launches, awareness messages, incident notifications, management reports).

How to comply — recommendations

Draw a one-page matrix with two halves. Internal: policy and changes, awareness, incident alerts, management reports — each with timing, audience, channel and owner. External: the Information Regulator and data subjects (POPIA s22), the sector regulator if any, customers under contract, suppliers, insurers, media — each with the trigger, the deadline, the template and the spokesperson. Pre-write the breach-notification letters so the first draft is not written at 2 a.m. Review the matrix after every incident and every new major contract.

Common nonconformities

No communication plan, or one covering internal communications only; breach notification obligations (POPIA s22, contracts, regulators) not identified or not assigned; no templates or spokesperson for incident communication; policy changes not communicated; performance reporting to top management not happening; communication needs never reviewed after incidents.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.