Implementation measure
Manage ISMS risks and objectives together
Further framework mappings of this measure
ISO/IEC 27001 · 6.1.2
ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution
The procedure connects maintained assessment and acceptance criteria, comparable repeated assessments and CIA risks within scope with owners, reasoned consequences and likelihoods, risk levels and prioritisation. The user must decide suitable criteria and actually carry out and retain assessments.
Read the source ↗ISO/IEC 27001 · 6.1.3
ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution
Treatment is connected with necessary safeguards, a complete Annex A comparison, SoA justifications and actual implementation status, the treatment plan and explicit risk-owner consent to the plan and residual risk. Specific decisions and actual treatment remain operational work.
Read the source ↗ISO/IEC 27001 · 6.2
ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution
Objective planning considers the policy, applicable requirements and risk assessment and treatment. The procedure identifies measurability where practicable, communication, monitoring and updates, as well as work, resources, ownership, completion and result evaluation. Objectives must be defined for the organisation and followed up.
Read the source ↗ISO/IEC 27001 · 9.1
ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution
The procedure defines the subject, suitable method and source, and responsibilities and timing for collection and evaluation. Actual results are retained and assessed for security performance and ISMS effectiveness. A register or software dashboard alone does not evidence this evaluation.
Read the source ↗