ISO 27001 clause 6.1: Planning risks and opportunities
ISO 27001 clause 6.1 brings together planning for risks and opportunities, a defined information security risk assessment process and a risk-treatment process. These activities connect business context to practical decisions. A project is not complete when risks have scores; management needs to know what will change, who owns the response and how results will be evaluated.
What clause 6.1 requires in practice
Clause 6.1 groups three requirements that work together. Clause 6.1.1 asks the organisation, when planning the ISMS, to consider its context and interested-party requirements and decide which risks and opportunities need attention so the system achieves its outcomes, reduces unwanted effects and improves. It must plan actions, integrate them into ISMS processes and decide how to evaluate their effectiveness.
Clause 6.1.2 requires a defined risk assessment process with criteria, repeatable results, identification of confidentiality, integrity and availability risks, risk owners, analysis and evaluation. Clause 6.1.3 requires a risk treatment process: options, necessary controls, a comparison with Annex A, a Statement of Applicability, a treatment plan and owner approval, including acceptance of residual risk.
Documented information is required for the assessment process and for the treatment process. The combined output is a traceable route from a concern to a decision and an owner.
Three connected parts with different purposes
Clause 6.1.1 considers risks and opportunities affecting the ISMS’s intended outcomes, undesirable effects and improvement. It includes planning actions, integrating them into processes and evaluating their effectiveness. An example is a governance weakness that repeatedly prevents timely risk decisions.
Clause 6.1.2 addresses the assessment process for information security risks, including criteria, ownership, analysis and evaluation. The organisation needs a repeatable basis for deciding which exposures need attention. Clause 6.1.3 addresses treatment choices, necessary controls, comparison with Annex A, the Statement of Applicability, treatment planning and risk-owner approval and residual-risk acceptance.
Keep the chain of reasoning visible
Begin with important information and services inside the scope. Connect context and interested-party requirements to credible exposures. Apply assessment criteria, decide treatment and show how necessary controls address the decision. Then make the implementation work visible through owners, resources and operational arrangements.
The Statement of Applicability is not simply an attractive list of security products. It should communicate necessary controls, why they are included, implementation status and justified Annex A exclusions. Additional controls can be needed. Annex A comparison is a safeguard against overlooking necessary controls; it does not replace understanding the organisation’s risks.
Use enough detail to support decisions without splitting every minor technical issue into an unrelated management risk. Similarly, avoid a single risk called “cyberattack” that hides different consequences, owners and treatments. The appropriate level of detail depends on the business and its decision needs.
Why risk planning matters to the business
Risk planning is where security spending becomes a managed choice rather than a reaction. It lets leaders see which exposures matter most, what protection is proportionate and what is being knowingly accepted. Without it, controls accumulate because they are fashionable, not because they address the organisation's real exposures, and gaps appear where nobody was looking. Customers and regulators increasingly ask to see the reasoning behind control choices, and a clear chain from risk to treatment supports that conversation. It also helps absorb change: when a new service or supplier appears, the method already exists to judge what is needed.
How to implement clause 6.1
Build the three parts as a single flow so outputs from one become inputs for the next. One approach Sterling teams use is a single working group that owns the whole chain.
- Start with system-level risks and opportunities drawn from context and requirements, and plan how actions will be built into existing processes.
- Define the criteria used to judge risk, including how acceptance decisions are made.
- Run the assessment across in-scope information, recording owners and the reasoning behind priorities.
- Select treatment options and determine the controls needed, then compare them with Annex A.
- Complete the Statement of Applicability and the treatment plan, and take them to risk owners for approval.
- Keep the records of both processes and agree when the assessment will be repeated.
- Check regularly that outputs flow in both directions, so that findings from operation, incidents and audits feed back into the assessment and treatment decisions and not only the other way round.
Illustrative examples
The company finds that release teams consistently consult security too late. ISMS planning addresses the governance issue by changing the release-review process. Risk assessment separately evaluates the exposure associated with a new integration. Treatment addresses necessary safeguards, and the company checks both whether the integration is protected and whether earlier consultation is actually happening.
A plant relies on remote vendor access to maintain a critical system. Assessment considers misuse and loss of access alongside production consequences. Treatment may combine access restrictions, an approval process and recovery arrangements. The business owner approves the plan and residual exposure; a purchased remote-access tool alone is not the whole response.
Evidence across planning and operation
Clause 6 establishes the approach and decisions; clause 8.2 and clause 8.3 concern performing assessments and implementing treatment. Keep the documented assessment and treatment processes, the required outputs and evidence of actual implementation linked. A method that looks sound on paper can still fail when applied inconsistently.
An auditor may select a significant issue and follow it from context through assessment, control selection and results. They may also ask why an Annex A control was excluded. A defensible answer refers to scope, risks and requirements, not “our consultant said it was unnecessary”.
Common mistakes
Do not treat opportunities as a compulsory commercial-growth register, confuse a risk score with acceptance authority or mark a planned control as implemented. Avoid repeating the same action in several registers without a clear owner. The purpose of linked records is traceability and decision quality, not multiplication of spreadsheets.
For implementation support, bring a representative service, a significant recent change and a small set of existing risk decisions. Reviewing those examples often exposes the gaps between a declared method and the way the business actually makes decisions.
Explore each numbered part
6.1.1 · Risks and opportunities for the ISMS
Look beyond individual security threats to the conditions that help or prevent the ISMS from succeeding. Learn to plan actions for governance gaps, capability constraints and improvement opportunities, integrate those actions into normal processes and evaluate their effect. Examples distinguish system-level planning from the technical risk assessment required by clause 6.1.2.
6.1.2 · From Scenarios to Priorities
Build an information security risk-assessment process that produces consistent and useful decisions. Learn to establish criteria, identify owners and assess confidentiality, integrity and availability consequences. Practical examples explain analysis and prioritisation without requiring one universal scoring matrix, while the guide distinguishes the defined method from operational assessments and their retained results.
6.1.3 · ISO 27001 Risk Treatment and the Statement of Applicability
Turn assessment results into justified treatment decisions, necessary controls and an intelligible Statement of Applicability. This guide explains Annex A comparison, inclusion and exclusion reasoning, implementation status and risk-owner decisions. It helps teams distinguish a credible treatment process from a copied control checklist or a catalogue of purchased security products.
Frequently asked questions
Is clause 6.1 satisfied by a risk register?
No. The organisation needs suitable assessment and treatment processes, planning of actions and the required decisions and documented outputs. A register is only one possible tool.
Can one system track ISMS risks and information security risks?
Yes, if it preserves the different purposes, criteria, owners and actions clearly. Combining records should improve traceability rather than blur which requirement is being addressed.
Where do Annex A controls enter the process?
During risk treatment, compare necessary controls against Annex A to check that none have been overlooked. Record justified selection and exclusions in the Statement of Applicability.
Connect risk planning with practical implementation
Talk to Sterling to join your risk criteria, assessments, treatment decisions and Statement of Applicability into a coherent management process. Build the relevant knowledge through Risk Management at Sterling Academy. We can also assess whether Effivity ISO & GRC automation software suits the agreed workflow and programme. Certification decisions remain with an independent certification body.