Governance activities within the scope of an ISMS

What clause 6.2 asks

The management system standard does not use the term governance, yet several of its requirements are governance activities. The guidance maps them to the objectives of clause 7.2. Clause 4.1, the organization information security objectives and how they support the entity, serves objectives 1, 3 and 4. Clause 4.2, interested parties and their requirements, serves objective 4. Clause 4.3, the ISMS scope built from issues, requirements, interfaces and dependencies, serves objective 1. Clause 5, policy, objectives, integration into processes, resources, communication of importance, and direction and support for people and management roles, serves objectives 1 and 3. Clause 6, the risk management approach with risk owners and their approval of treatment, and the security objectives, serves objective 2. Clause 7, competence and communication, serves objective 5. Clause 8, planning, implementation and control, including outsourced arrangements, serves objectives 4 and 6. Clause 9, monitoring, reporting, internal audit, and the review and decisions of top management and the governing body on effectiveness, serves objective 6. Clause 10, nonconformity and continual improvement, serves objective 4.

Why it matters

This is the bridge between the management system and the board. A team can run a clean ISO/IEC 27001 programme and still fail the governance conversation, because the management system produces evidence for its own clauses rather than a report on the entity objectives. The matrix gives the ISMS manager a way to show that the work already done has a governance purpose. It also exposes the reverse: where a governance objective has no management system activity behind it, the objective is a slogan. The matrix is not a compliance test. It is a way to read the management system through the eyes of the governing body.

What good looks like

Build a two-way matrix. Down the side, put the ISO/IEC 27001 clauses 4 to 10. Across the top, put the six objectives. Mark each cell with the artefact that shows the link, and leave a cell blank where there is none. Then write one sentence for the board for each objective, naming the management system activity that serves it and the result. Review the matrix at the management review and at the board cycle. A blank cell is the next piece of work, not a reason to redraw the matrix.

Evidence a board or an auditor asks for

The clause-to-objective matrix with an artefact in each used cell; the management review minutes; the board report that names the objective served by each activity; the internal audit programme.

• Record The clause-to-objective matrix with an artefact in each used cell
• Record the management review minutes
• Record the board report that names the objective served by each activity
• Record the internal audit programme

Where it commonly fails

• An ISMS run as a compliance exercise with no line to a governance objective
• Board decisions on ISMS effectiveness missing from the clause 9 review record
• Objectives written for the board and never used in the management system

What to do before publication

Before the edition 3 text is published, put clause 6.2 on the governance and management agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.

Read across

• 7.2.1 Objective 1: Establish integrated, comprehensive, entity-wide information security
• 7.2.2 Objective 2: Make decisions using a risk-based approach
• 7.2.3 Objective 3: Set the direction of acquisition
• 7.2.4 Objective 4: Ensure conformance with internal and external requirements
• 7.2.5 Objective 5: Foster a security-positive culture
• 7.2.6 Objective 6: Ensure the security performance meets current and future requirements of the entity
• 7.3.4 Monitor

← 6.1 Overview: governance and management of information security6.3 Other related standards →

Full register / The dates / Free scope check