Key takeaways
- Decide what to communicate about security, when, to whom, how and by whom.
- Consistent communication keeps people informed and reduces confusion.
- Start here: decide what to communicate, when, to whom, how and by whom.
Purpose
Decide what to communicate about security, when, to whom, how and by whom.
Requirement
Requirement summaryThe organization shall determine the need for internal and external communications relevant to the information security management system including: a) on what to communicate; b) when to communicate; c) with whom to communicate; d) how to communicate.
Why it matters
Consistent communication keeps people informed and reduces confusion.
How to implement
- Decide what to communicate, when, to whom, how and by whom.
- Document this in a communication plan.
- Include external communication such as customers and regulators.
- Review the plan periodically.
What evidence you need to provide
Here is what you will typically need to provide for Clause 7.4. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your communication plan: what is shared, when, with whom, by whom and how.
Records and examples to show
- Examples of security communications sent internally and externally.
- Records of messages to customers or authorities when needed.
- Proof staff received important updates.
Things you should be able to show or explain
- Be able to explain who is allowed to speak externally about security.
How much to show: A handful of communications.
Common mistakes
- No plan.
- Important updates not shared.
- No plan for incident communications.
- Communication done ad hoc.
- Tip: Auditors love version history. Control your documents from day one.
Policies & documents to have
- Information security communication plan
FAQ
Can we exclude clause 7.4?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
A defined communication approach in use.