Key takeaways
- When the ISMS needs to change, do it in a planned way.
- Changes to the ISMS should be deliberate so nothing important breaks.
- Start here: identify when the ISMS needs to change: new scope, restructuring, new risks.
Purpose
When the ISMS needs to change, do it in a planned way.
Requirement
Requirement summaryWhen the ISMS needs to change, do it in a planned way.
Why it matters
Changes to the ISMS should be deliberate so nothing important breaks.
How to implement
- Identify when the ISMS needs to change: new scope, restructuring, new risks.
- Assess the impact and plan the change.
- Update documents and inform affected people.
- Record the change and review outcomes.
What evidence you need to provide
Here is what you will typically need to provide for Clause 6.3. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your process for planning changes to the security programme.
Records and examples to show
- Records of recent changes showing purpose, impact, resources and responsibilities were considered.
- Approvals for those changes.
Things you should be able to show or explain
- Be able to walk through how a change was planned.
How much to show: One or two recent changes.
Common mistakes
- Changes made with no planning.
- Effects on other processes not considered.
- Changing scope without updating documents.
- Ad hoc changes with no record.
- Tip: Your Statement of Applicability is the document auditors ask about most. Make it tidy!
Policies & documents to have
No specific document is listed for this item in the playbook. Keep records that show the requirement is met, controlled under clause 7.5.
FAQ
Can we exclude clause 6.3?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
Changes to the ISMS assessed and managed, not ad hoc.