Clause 6.3 Planning of changes
Clause 6.3 in ISO 27001:2022 (ISO/IEC 27001:2022). All ISO 27001:2022 controls held. Open ISO 27001:2022 on the standards site.
The control as we hold it
Planning of changes. Where the organization decides the ISMS needs to change, the change has to be made in a planned way. This clause is new in the 2022 edition.
Reviewed and closest counterparts in the other frameworks
We hold no cross-framework row for Clause 6.3 yet. The reviewed pairs page lists the released pairs and their coverage.
What an auditor commonly asks for
General guidance for this control area (domain: Clause 6), in our words, not a statement of the standard and not binding on an assessor.
- A procedure or approach for planning changes to the ISMS
- Records of ISMS changes showing the reason, plan, responsibilities and timing
- Evidence that consequences of the change and resource needs were considered
- Updates to documented information following the change