Clause 4.4 Information security management system
Clause 4.4 in ISO 27001:2022 (ISO/IEC 27001:2022). All ISO 27001:2022 controls held. Open ISO 27001:2022 on the standards site.
The control as we hold it
Information security management system. The organization must set up, put into operation, keep up and keep improving an ISMS, including the processes it needs and how those processes interact, in line with what this standard requires.
Reviewed and closest counterparts in the other frameworks
We hold no cross-framework row for Clause 4.4 yet. The reviewed pairs page lists the released pairs and their coverage.
What an auditor commonly asks for
General guidance for this control area (domain: Clause 4), in our words, not a statement of the standard and not binding on an assessor.
- An ISMS manual or process map showing the ISMS processes and how they interact
- Evidence each process required by Clauses 4 to 10 is defined and operating
- Records demonstrating maintenance and improvement over time, such as updated procedures and closed improvement actions
- Ownership assigned for each ISMS process