Planning of changes

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

Where the organization decides the ISMS needs to change, the change has to be made in a planned way. This clause is new in the 2022 edition.

How the 2020 guidance taught the audit

The 2020 annex has no row for this clause because the 2013 edition had no planning-of-changes clause. The audit has to test whether a change to the ISMS was planned, risk reviewed and approved before it was made, and whether the change achieved what it was meant to achieve. The evidence is the change record, not the change itself.

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

This is a new clause in ISO/IEC 27001:2022. The 2020 Annex A has no row for it, so this row is new in the DIS. It asks the organization to plan changes to the ISMS in a planned manner.

Evidence an auditor asks for

• Planning of changesA procedure or approach for planning changes to the ISMS
• Planning of changesRecords of ISMS changes showing the reason, plan, responsibilities and timing
• Planning of changesEvidence that consequences of the change and resource needs were considered
• Planning of changesUpdates to documented information following the change

The questions an auditor will ask

Ask for a change to the ISMS in the last year and for the plan, the risk review and the approval that preceded it.

Common gaps

• Change made without a plan or a risk review
• Change approved after it was implemented
• No review of whether the change achieved its purpose

Prepare before the next audit

Extend the change procedure to changes in the ISMS itself, not only changes to technology. Record the plan, the risk review and the approval.

Cross-references