ISO 27001 clause 7.4: ISMS communication
ISO 27001 clause 7.4 requires the organisation to determine relevant internal and external ISMS communication needs. It addresses what is communicated, when, with whom and how. The purpose is dependable information flow, not simply producing a communication calendar or increasing the number of emails sent.
What clause 7.4 requires in practice
Clause 7.4 requires the organisation to decide which communications about the ISMS it needs, both inside the business and with outside parties. For each communication need, four questions must be answered: what is communicated, when, with whom, and by what means. The clause lists exactly these four. Internal needs could include telling staff about a policy change, escalating an incident to management or sharing audit results. External needs could include notifying customers of an event affecting them, working with regulators, or agreeing security expectations with suppliers.
The requirement is to determine the need, which makes it a planning step rather than a call for a communication procedure of a particular shape. The output is a shared understanding of who tells whom what, and when, so that important messages are neither missed nor sent ad hoc by whoever happens to know. Many organisations capture this in a simple table, but that is a convenient method, not something the clause demands.
Start with the decision or action the recipient needs
Different audiences need different information. Management needs material performance, risks and decisions requiring authority. Process owners need changes that affect their work. Employees need usable instructions and reporting routes. Customers or providers may need agreed information about service changes, incidents or assurance evidence.
Separate routine communications from time-sensitive routes. A scheduled management report should not be the only way to escalate an urgent issue. Likewise, an incident channel is not a substitute for controlled communication of a revised policy or changed responsibility. Identify the relevant purpose and audience before choosing a channel.
Make communication arrangements workable
Determine triggers or timing, recipients and suitable methods. Identify practical ownership and approval needs through the organisation’s responsibilities and processes. The clause’s current wording does not prescribe a particular communication-matrix template; ownership remains important for ensuring that the arrangement actually happens.
Use information appropriate to the audience. A customer may need a clear service-impact update without confidential internal investigation material. A supplier may need an actionable control requirement rather than the entire internal risk register. Protect sensitive information and consider contractual, regulatory and other applicable communication obligations with the responsible specialists.
Maintain contact and escalation routes as people and services change. Test important handovers, including out-of-hours situations where relevant. A distribution list can exist while key recipients no longer monitor it. Communication is effective only if the intended recipient can understand and use what arrives.
Why ISMS communication matters to the business
Security events punish poor communication faster than most business problems. If a staff member does not know whom to tell, a minor issue grows. If a customer hears about a problem from a third party rather than from the supplier, trust falls quickly, and contract terms or regulations may add duties on top. Clear communication arrangements also help day-to-day work: management hears about risks while options remain, suppliers know what is asked of them, and staff learn about changes before they cause confusion. In an audit, gaps usually appear as an inability to say who would speak to a customer or authority during an incident, which is an uncomfortable discovery to make at the wrong moment.
How to implement clause 7.4
The aim is to settle responsibilities for important messages before they are needed. One way Sterling teams work is shown below. Start with the handful of messages that matter most when something goes wrong, because those are the ones nobody has time to design in the moment.
- List the audiences that matter: staff, management, customers, suppliers, regulators, insurers and the public where relevant.
- For each audience, note the situations that call for a message, such as a policy change, a security event or a planned outage.
- Decide who is responsible for sending each message and who approves it when the content is sensitive.
- Choose suitable channels and timing, including a fallback if the usual system is the thing that has failed.
- Agree rules for what may be disclosed, keeping legal and contractual duties in view.
- Brief the people named, and rehearse at least the incident-related messages in an exercise.
- Review the arrangements after real events and when audiences or obligations change.
Illustrative examples
The client changes how sensitive records may be transferred. The account owner identifies the affected shifts, updates the controlled instruction and communicates the change through supervisors. A sample check confirms that employees use the new route. Sending an email only to the account manager would not establish that operating teams know what changed.
An event affects availability while technical analysis is still underway. The provider separates internal investigation, management escalation and customer updates. It uses agreed approval and contact arrangements to communicate known impact without presenting unverified speculation as fact. Later communication updates the position as evidence improves.
Evidence and practical checks
Communication plans, records, approved messages and recipient feedback can help demonstrate arrangements. Clause 7.4 does not demand a dedicated communications register or a record of every routine conversation. Retain information where necessary to demonstrate operation or fulfil another applicable requirement.
Select an important recent communication and trace its path. Was it timely? Did the intended recipients receive the appropriate information? Did they understand the required action? A high email-open rate would not answer all those questions. Link findings to awareness or improvement where relevant.
Common failure patterns
Watch for communication sent to job titles with no named coverage, outdated supplier contacts, inconsistent instructions between locations and excessive distribution of sensitive evidence. Another risk is allowing sales assurances to create commitments that delivery teams do not know about.
Build communication into normal processes. Interested-party requirements help establish the need; responsibilities help establish accountability. The resulting arrangement should help people act, not merely demonstrate that information was broadcast.
Frequently asked questions
Is a communication matrix mandatory?
No particular matrix is prescribed. It can be a useful way to organise what, when, with whom and how relevant ISMS communications occur.
Does clause 7.4 set incident-notification deadlines?
It does not set universal deadlines. Applicable law, contracts and other obligations may create specific requirements that need appropriate specialist interpretation and operational arrangements.
Should we share the full risk register with customers?
Not automatically. Determine the relevant information and appropriate disclosure route, considering confidentiality, contractual commitments and the recipient’s actual need.
Make security communication reach the right people
Talk to Sterling to define audiences, timing, responsible communicators and suitable channels for routine decisions and time-sensitive information. Build the relevant knowledge through ISO/IEC 27001:2022 Awareness at Sterling Academy. Certification decisions remain with an independent certification body.