LinkedIn

YouTube
0 Introduction
Aron Lange
Twitter 1. Scope
Informative sections
2. Normative references

3. Terms and definitions

4.1 Understanding the organization and its context

4.2 Understanding the needs and

expectations of interested parties

A.5 Organizational Controls 4. Context of the organization

Scope of the ISMS
4.3 Determining the scope of the ISMS

A.7 Physical Controls

4.4 Information security management system
Annex A
5.1 Leadership and commitment
A.6 People Controls

Information security policy

5. Leadership
5.2 Policy
A.8 Technological Controls

5.3 Organizational roles, responsibilities and authorities

Plan
10.1 Continual improvement
6.1.1 General
Nature of the nonconformities
and any subsequent actions 10. Improvement
taken Act Information security risk assessment process

10.2 Nonconformity and

ISO/IEC 27001:2022 6.1 Actions to address risks 6.1.2 Information security risk assessment
Results of any corrective action corrective action and opportunities
Information security risk treatment process
Results of monitoring and measurement
9.1 Monitoring, measurement, analysis and evaluation 6.1.3 Information security risk treatment Statement of applicability
6. Planning
Audit results
Information security objectives
6.2 Information security objectives and
9.2.1 General planning to achieve them

9.2 Internal audit 6.3 Planning of changes

Audit results
9. Performance evaluation
Check 7.1 Resources
Audit programme 9.2.2 Internal audit programme

Evidence of competence
9.3.1 General 7.2 Competence

9.3.2 Management review inputs 7.3 Awareness

9.3 Management review 7. Support

Results of management reviews 7.4 Communication

9.3.3 Management review outputs
7.5.1 General

7.5 Documented information 7.5.2 Creating and updating

7.5.3 Control of documented information

Do
Evidence for processes
8.1 Operational planning and being carried out as planned
control

Results of information
8.2 Information security risk security risk assessments
8. Operation
assessment

Results of information
8.3 Information security risk security risk treatment
treatment