ISO 27001 Clause 7: Make ISMS Resources, Competence and Information Usable

What clause 7 requires in practice

Clause 7 covers what the ISMS needs to function. It has five parts. Resources: the organisation determines and provides what the system needs to be established, run, maintained and improved. Competence: it decides what skills people doing relevant work must have, ensures they have them through education, training or experience, acts to close gaps and checks the actions worked, and keeps appropriate evidence. Awareness: people working under its control must know the policy, how they contribute to ISMS effectiveness and what follows if they do not comply. Communication: it decides what to communicate, when, with whom and how, both internally and externally. Documented information: the ISMS includes what the standard requires and what the organisation judges necessary, with attention to creation, updating and control.

Competence evidence and the documents themselves are the main outputs.

7.1: provide the resources the ISMS needs

The organisation must determine and provide resources for establishing, operating, maintaining and improving the system. Those resources can involve people, time, technology and access to expertise. A security owner with nominal responsibility but no time to review changes may be unable to fulfil the role. Resource decisions should therefore relate to actual work and the system's intended results.

7.2: establish competence and examine development results

Determine the competence necessary for people whose work under organisational control affects information security performance. Appropriate education, training or experience can support competence. Where action is needed to develop it, evaluate whether that action worked and retain suitable evidence. An attendance record demonstrates attendance; a relevant assessed task may provide different evidence of ability.

For a hypothetical managed-service provider, an administrator may need to apply an approved access procedure and recognise when a request needs escalation. An awareness course alone cannot establish that technical capability. A proportionate development plan could combine instruction, supervised work and review of completed changes. These are suggestions; the organisation determines the appropriate competence evidence for the responsibility.

7.3: connect awareness with decisions

People working under organisational control need awareness of the policy, their contribution to ISMS effectiveness and the implications of failing to follow system requirements. Make that meaningful through the person's work. A sales colleague needs to understand why an unfamiliar customer data-transfer request should be reviewed, while an administrator needs to recognise the consequences of an unauthorised change.

A useful check asks a person to explain what they would do in a realistic situation and where they would obtain help. If the answer depends on an unavailable contact or an inaccessible instruction, address the practical barrier. Repeating a presentation without resolving that obstacle is unlikely to improve the response.

7.4: decide what communication is needed

The organisation determines relevant internal and external communications, including their subject, timing, audience and method. This can affect policy communication, supplier changes, performance reporting and handling security concerns. Applicable incident-notification obligations need appropriate specialist interpretation; clause 7.4 does not establish one universal deadline for every organisation.

Original implementation advice is to test an important communication route across different working hours. If a hosted-service problem emerges outside headquarters hours, the relevant people need a usable route for decisions. A contact list is helpful only when responsibilities, availability and the information to be passed are understood.

7.5: keep documented information useful and protected

Clause 7.5.1 includes information expressly required by ISO 27001 and information the organisation decides is necessary for an effective ISMS. Clause 7.5.2 addresses suitable identification, format, media and review and approval when information is created or changed. This supports reliable use without prescribing paper binders, a particular file naming scheme or a fixed number of policies.

Clause 7.5.3 concerns availability where needed and protection against inappropriate disclosure, use or alteration. Relevant controls address access, distribution, retrieval, storage, preservation, changes, retention and disposal. Necessary externally sourced information also needs appropriate identification and control. Reading a record and having authority to modify it are different permissions and should not be confused.

In the managed-service example, an obsolete recovery instruction may remain available in a local folder after the approved version changes. A useful review follows how updates reach users, how old copies are handled and whether staff can recognise the current instruction. The same review should consider the sensitivity of the recovery information and who genuinely needs access.

A second hypothetical example comes from construction: a site team receives revised instructions for sharing customer drawings, but night-shift supervisors cannot access the central system. Awareness communication has occurred, yet usable support is missing. The organisation should resolve access and responsibility alongside learning. See the documented-information guide for deeper information-control decisions.

Why support arrangements matter to the business

A well-written ISMS can still fail if the people running it lack time, skills or clear guidance. Clause 7 deals with exactly those gaps. Adequate resources keep controls operating after the certification project ends, competence evidence shows that staff can do what the system expects, and awareness reduces the everyday mistakes that cause most incidents. Sensible communication prevents confusion about who tells customers what, and controlled documents mean people work from the right version. Together they convert a design on paper into reliable daily behaviour, which is what customers and assessors ultimately want to see. Weak support is also the most common reason otherwise good systems produce repeated findings.

How to implement clause 7

Support is where a paper system becomes a working one. One approach Sterling teams use is to check each element against a real role, such as a process owner.

1. Estimate the people, time, tools and expertise the ISMS needs for the work it has planned, and secure them.
2. Define the competence needed for roles that affect security, assess the people in them and arrange development where there are gaps.
3. Check whether training or mentoring worked, for instance by observing work or questioning staff.
4. Build awareness into induction and regular communication, using real examples from the business.
5. Agree what needs communicating, to whom, by whom and through which channel, for staff, customers and suppliers.
6. Decide which documents the system truly needs, then set sensible rules for identification, approval, access, version control and retention.
7. Review support arrangements at management review, using evidence such as training outcomes, resource gaps and document problems, and feed what you learn into planning so the next cycle starts from a realistic position.

Evidence and mistakes to avoid

Explore each numbered part

Illustrative example: support at a UK SaaS provider

A hypothetical UK software-as-a-service provider has a security policy and a risk register but finds its practices inconsistent. The leadership team reviews its support arrangements. Resourcing is first: the engineer responsible for access reviews has no time allocated, so part of the role is reassigned. Competence is next, and the company identifies that few staff understand secure code review, arranges mentoring and checks results by sampling merge requests. For awareness, short sessions use the company's own near-miss reports. A communication plan sets out who tells customers about service-related security events. Finally, the team replaces overlapping documents with a smaller set held in one controlled location with clear owners. At the next review, staff can explain what they do and why.