ISO 27001 Clause 6: Connect ISMS Risk Assessment, Treatment and Objectives
Clause 6 turns the organisation's information security concerns into reasoned plans. It connects the ISMS context with risk assessment, treatment, objectives and controlled change. The practical value is traceability: a reviewer should be able to understand why a control is needed, which risk it addresses and who has accepted what remains.
What clause 6 requires in practice
Clause 6 turns understanding into a plan. Clause 6.1 asks the organisation to determine risks and opportunities affecting the ISMS and to plan action, and it sets out two defined processes: information security risk assessment, which covers criteria, identification, analysis and evaluation, and information security risk treatment, which covers options, necessary controls, comparison with Annex A, the Statement of Applicability, a treatment plan and approval by risk owners of both the plan and the remaining risk. Clause 6.2 asks for security objectives set for the functions and levels of the organisation where they matter, with planning for how they will be met. Clause 6.3 asks that changes to the ISMS are carried out in a planned way.
Documented information is required about the risk assessment and treatment processes and about the objectives. The Statement of Applicability is a specific output of 6.1.3.
6.1.1: plan for the management system's risks and opportunities
Planning considers the context and interested-party requirements to identify risks and opportunities affecting intended ISMS outcomes, undesirable effects and improvement. The organisation plans action, integrates it into ISMS processes and decides how effectiveness will be evaluated. This includes the management system's ability to function, not merely a list of technical vulnerabilities.
For example, reliance on one overloaded specialist may undermine the risk-review process itself. An opportunity could be using an existing procurement review to obtain security information earlier. The useful question is how action changes the way decisions are made. A risk list that is disconnected from resources, owners and follow-up is a weak planning tool.
6.1.2: establish a repeatable information security risk assessment
The process needs assessment and acceptance criteria and must support consistent, valid and comparable results. It identifies risks to confidentiality, integrity and availability within scope, with risk owners. Analysis considers consequences, realistic likelihood and risk levels; evaluation compares those results with the criteria and establishes treatment priorities. Documented information about the process must be retained.
A suggested implementation exercise is to have two competent colleagues assess the same fictional scenario. If they reach different results, examine the assumptions and definitions rather than average the scores mechanically. An ordinal scale can help communication, but the explanation should remain understandable without the colour assigned to a spreadsheet cell.
6.1.3: select treatment and establish the Statement of Applicability
Treatment options follow assessment. Determine the controls necessary for the selected response, then compare them with Annex A so that necessary controls have not been overlooked. Annex A is a reference for this decision, not an instruction to implement every control without analysis. Additional controls may be needed where the organisation's risks or applicable requirements demand them.
The Statement of Applicability records necessary controls, the reasons for including them, their implementation status and reasons for excluding Annex A controls. A treatment plan must be formulated, approved by risk owners, and accompanied by their acceptance of residual risks. Retain documented information about the treatment process. A statement that a control is “not applicable” needs a reason grounded in the actual situation.
In a hypothetical recruitment platform, candidate records are exported for support investigations. The team identifies risks from unnecessary copies and excessive access. Treatment may combine changes to the support process, access restrictions and controlled retention. The control decisions should explain how they address that scenario, including the residual risk. Listing “encryption” alone would not answer who can create copies or why they are retained.
6.2: set objectives that can guide action
Information security objectives must fit the policy and consider applicable requirements and risk results. They need monitoring, communication and appropriate updating, with measurement where practicable. Objectives are documented, and achievement planning identifies the work, resources, responsibilities, timing and evaluation. “Improve security” is difficult to evaluate unless the organisation explains the intended result.
For the platform, an objective might focus on making support investigations possible without uncontrolled candidate-data exports. The organisation would determine an appropriate measure and acceptance basis rather than copy an arbitrary target. An objective should not encourage staff to hide necessary investigations simply to reduce the number of recorded exports.
6.3: plan changes to the ISMS
Changes to the management system must be carried out in a planned way. A new risk method, altered responsibility structure or revised approval process can affect existing evidence and decisions. Practical planning should identify who is affected, how continuity is maintained and how the revised arrangement will be evaluated. The organisation chooses the proportionate method.
Two original examples show why planning needs business detail. A BPO firm assessing a customer-data export considers recipient error and retention after processing. A manufacturer assesses whether an obsolete engineering file could alter production settings. Confidentiality dominates one discussion; integrity is central to the other. Their criteria and treatment decisions should reflect those consequences rather than reuse an unexplained generic score.
Continue with the deeper guides to risk assessment and risk treatment and the Statement of Applicability when developing the decision trail.
Why connected risk planning matters to the business
Clause 6 is where the ISMS earns its credibility with customers. It shows that controls were selected because of identified risks, that someone with authority accepted what remains, and that objectives follow from those decisions. Businesses that treat the pieces separately end up with a risk register nobody reads, a list of controls with no rationale and objectives disconnected from either. A connected plan lets leaders spend on what matters, explain exclusions confidently and answer due-diligence questions without scrambling. It also makes later change easier, because the reasoning is visible and can be updated, not rebuilt from scratch every time the business moves.
How to implement clause 6
Treat the clause as a chain from context to action, so each link can be explained. One approach Sterling teams use is to build and review the chain with the same small working group.
- Use the context and interested-party conclusions to identify risks and opportunities for the ISMS itself.
- Agree how risks will be judged, including what level the organisation is prepared to accept.
- Assess risks to confidentiality, integrity and availability within the scope, naming an owner for each.
- Choose treatment options, determine the controls needed and check them against Annex A, recording the reasoning in the Statement of Applicability.
- Prepare the treatment plan and obtain risk-owner approval, including acceptance of what remains.
- Set objectives that follow from policy and risk, plan their delivery, and decide how ISMS changes will be controlled.
- Review the whole chain once it is complete, following one risk from identification through treatment, approval and objective, and repair any link where the reasoning cannot be explained to someone outside the working group.
Evidence, review and common mistakes
An auditor can follow a risk from assessment through treatment, the Statement of Applicability, approval and operational results. Criteria, assessment and treatment methods, objectives and approval evidence should agree. Common weaknesses include changing scores to fit a preferred answer, treating supplier assurances as proof without examination, and using the same exclusion explanation regardless of the service's dependencies.
Explore each numbered part
6.1 · Planning risks and opportunities
Clause 6.1 joins three related tasks: planning the ISMS, assessing information security risks and deciding treatment. Understand the different outputs and how to keep them connected. The guide shows how context becomes action, how the Statement of Applicability fits and why a scored risk register alone does not complete planning.
6.2 · Security objectives and achievement plans
Security objectives turn policy and risk priorities into results that managers can pursue and evaluate. Learn to choose relevant objectives, plan the work, assign ownership and avoid misleading measures. The examples show how service reliability, access decisions and recovery readiness can be evaluated without treating a technology purchase as the objective itself.
6.3 · Planning ISMS changes
Changes to an ISMS need deliberate planning so that responsibilities, controls and evidence remain coherent. This page explains when a management-system change needs attention, how to assess dependencies and how to distinguish clause 6.3 from operational and technology change controls. Examples cover acquisitions, new services and revised governance arrangements.
Illustrative example: planning at a UAE manufacturer
A hypothetical UAE manufacturer of industrial components supplies design files to overseas customers. In planning, the leadership team sees that its main concerns are leakage of design information and interruption to production scheduling software. The working group sets criteria for judging risk, then assesses scenarios such as a contractor copying files and an outage at the scheduling provider, assigning each to an owner among the department heads. Controls are chosen and compared with Annex A, and the Statement of Applicability records which are implemented, which are planned and why a few are not relevant. The plan is approved by the owners, who also accept two lower risks. Objectives follow, such as improving recovery for the scheduling system, and a change to merge two sites is handled through a planned ISMS change.
Frequently asked questions
Is a particular risk matrix mandatory?
The clause specifies characteristics and activities of the process, rather than one universal matrix. Choose a method that supports the required assessment and produces defensible decisions in your context.
Does a low score remove contractual requirements?
No. Risk evaluation does not erase applicable obligations. Requirements must inform the system and relevant decisions, including treatment choices.
When should risk owners reconsider acceptance?
Use the established assessment and review arrangements when conditions or evidence change. Acceptance based on an earlier service model should not be assumed to cover a materially different exposure.
Build a defensible assessment-to-control trail
Discuss ISMS risk planning with Sterling for scoped assessment, treatment and evidence support, including agreed Effivity ISO & GRC automation software. For practical development, enrol in ISMS Risk Assessment & Statement of Applicability; Information Security Risk Management offers a related risk-learning route.
Independent certification bodies make their own assessment and certification decisions.
Previous: clause 5. Return to the hub or continue to clause 7: support.