ISO 27001 clauses 4 to 10 are the mandatory requirements for running an information security management system (ISMS): context, leadership, planning, support, operation, performance evaluation and improvement. Annex A, with its 93 controls, is a separate list you select from. Beginners often start with Annex A and skip the clauses, which auditors read first.
The seven clauses in one table
| Clause | Name | What it asks you to do |
|---|---|---|
| 4 | Context of the organization | Understand internal and external issues, interested parties and their requirements, and define the scope |
| 5 | Leadership | Top management commits, sets the security policy and assigns roles |
| 6 | Planning | Assess and treat risks, set measurable objectives, plan changes |
| 7 | Support | Provide resources, competence, awareness, communication and controlled documents |
| 8 | Operation | Run the processes, perform risk assessments, implement the treatment plan |
| 9 | Performance evaluation | Monitor and measure, run internal audits, hold management reviews |
| 10 | Improvement | Handle nonconformities and keep improving |
The descriptions follow a public guide to the structure of the standard. The standard itself is sold by ISO, so read the text before relying on this summary.
How the clauses fit together
Think of a loop. Clauses 4 and 5 set the frame: what you protect, for whom, and who is accountable. Clause 6 decides what to do about risk. Clause 7 gives you the people, time and records. Clause 8 does the work. Clause 9 checks it. Clause 10 fixes what the check finds, then the loop starts again.
Where beginners get stuck
- Scope and context (4). A vague scope makes every later step vague. A separate post covers context and interested parties.
- Leadership (5). Policy alone is not enough. See what top management needs to do.
- Planning (6). Risk assessment, the treatment plan and the Statement of Applicability link together. See assessment, treatment plan and register.
- Evaluation and improvement (9 and 10). These produce the records auditors sample most.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how one piece of evidence can map to more than one requirement.
A sensible reading order
- Read clauses 4 to 6 first and write your scope, risk method and objectives.
- Skim clause 7 and list the documents and records you must control.
- Read clauses 9 and 10 early, so you design records you can show later.
- Use Annex A last, as a checklist against the risks you identified.
Quick check
Are clauses 4 to 10 optional?
No. They are the requirements you must meet for certification. Annex A controls can be excluded with justification in your Statement of Applicability.
Do clauses 1 to 3 matter?
They cover scope, normative references and terms. They contain no requirements to implement, but the terms help you read the rest.
Safeguard's compliance and evidence automation can help collect operating records for several of these clauses. Certification is issued by an accredited certification body, not by software.
Sources
- ISO 27001 clause 4, context of the organization
- ISO 27001 clause 5, leadership
- ISO 27001 clause 6, planning
- ISO 27001 clause 7, support
- ISO 27001 clause 8, operation
- ISO 27001 clause 9, performance evaluation
- ISO 27001 clause 10, improvement
Last reviewed: 19 October 2026.
