Organization and ISMS

What clause 8.1 asks

This clause is the constitution of each management system. The board should require one or more systems to support the entity's aims, with objectives that match or are aligned, and with design consistent with entity policy and risk management. A system may use the board's risk method so risk can be communicated clearly. If that method does not meet ISO/IEC 27001, the system should use another and agree how risk information will be exchanged in terms the board understands, or the board can change the entity method. The board charters each system, sets its scope and separately its certification scope, gives direction on objectives, requirements, roles and resources, decides acceptable residual risk or treatment, and gives the system channels and authority to communicate.

Why it matters

This clause is the constitution of the management system. It settles who charters it, what it covers, what it may accept and how it speaks. The separation of the scope from the certification scope is a small sentence with large consequences. A system can be right to cover a supplier, a joint venture or a shared service and still be impractical to certify across that boundary. Writing both scopes down prevents the audit from being designed around a boundary the business does not actually use. The risk process paragraph is the other practical gem. Two risk processes can coexist, but only if someone has agreed how a risk crosses from one language to the other. Without that agreement, the board sees one picture and the security team manages another.

What good looks like

Charter each management system with a one-page decision that names its purpose, its scope, its certification scope, its objectives, its top management and its reporting line. Record the risk process decision: adopted, separate with a translation, or entity process changed. Write the translation method down with an example. Set the residual risk authority in the charter, including the level above which a decision goes to the governing body. Give the system a communication channel and name who may use it. Review the charter when the scope or the group structure changes.

Evidence a board or an auditor asks for

The charter for each management system with both scopes; the risk process decision and the translation method with an example; the residual risk authority and a decision log; the communication authority and channel; the governing body approval minute.

• Record The charter for each management system with both scopes
• Record the risk process decision and the translation method with an example
• Record the residual risk authority and a decision log
• Record the communication authority and channel
• Record the governing body approval minute

Where it commonly fails

• A management system scope set by the security function without governing body approval
• Residual risk accepted by whoever runs the management system
• Risk reported to the board in terms its own risk process does not use

What to do before publication

Before the edition 3 text is published, put clause 8.1 on the the governing body and the isms agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.

Read across

• 1 Scope
• 7.3.3 Direct
• 8.2.1 Type A: The entity and the ISMS organization are the same
• 8.2.2 Type B: The entity contains the ISMS organization
• 8.2.3 Type C: One ISMS is shared by multiple entities

← 7.3.5 Communicate8.2.1 Type A: The entity and the ISMS organization are the same →

Full register / The dates / Free scope check