Clause 6.1.1 Actions to address risks and opportunities: general
Clause 6.1.1 in ISO 27001:2022 (ISO/IEC 27001:2022). All ISO 27001:2022 controls held. Open ISO 27001:2022 on the standards site.
The control as we hold it
Actions to address risks and opportunities: general. When planning the ISMS the organization considers the 4.1 issues and the 4.2 requirements and identifies the risks and opportunities it needs to address so that the ISMS can achieve its outcomes, undesired effects are prevented or reduced, and continual improvement happens. It must plan actions to address them, and plan how to integrate and implement those actions in its ISMS processes and how to evaluate whether they worked.
Reviewed and closest counterparts in the other frameworks
We hold no cross-framework row for Clause 6.1.1 yet. The reviewed pairs page lists the released pairs and their coverage.
What an auditor commonly asks for
General guidance for this control area (domain: Clause 6), in our words, not a statement of the standard and not binding on an assessor.
- A register of ISMS-level risks and opportunities traced to the 4.1 issues and 4.2 requirements
- Action plans addressing each, with owners and integration into ISMS processes
- Records evaluating whether the actions were effective
- Evidence that opportunities, not only risks, were considered