ISO 27001 Requirements 2026: Clauses 4-10 + Template

ISO 27001 can feel complicated because the standard is written for auditors, not casual readers. 

But the aim is simple: to build and maintain an Information Security Management System (ISMS) that protects your organization’s information.

The ISO 27001 standard defines the requirements your ISMS must meet. 

Clauses 4 through 10 specify how to establish, implement, maintain, and continuously improve the ISMS, and Annex A provides 93 security controls to help address identified risks.

This guide breaks down both parts so you can understand what ISO 27001 demands and what auditors expect to see.

What are the ISO 27001 requirements?

ISO 27001 requirements are the mandatory provisions organizations must meet to conform with ISO/IEC 27001:2022, the international standard for establishing, operating, maintaining, and continually improving an Information Security Management System (ISMS).

The standard was developed through ISO and the International Electrotechnical Commission (IEC). 

They work under their joint technical committee for information technology, ISO/IEC JTC 1, and more specifically Subcommittee 27 (SC 27), which develops international standards for information security, cybersecurity, and privacy. 

The ISO/IEC 27001 document is divided into numbered sections, called clauses:

• Clauses 1 to 3 cover the standard’s scope and key terms and definitions.
• Clauses 4 to 10 contain the requirements for building, running, reviewing, and improving an ISMS.
• Annex A provides 93 information security controls that organizations use as a reference when deciding how to treat their security risks.

That is why you will often see ISO 27001 guidance focus heavily on Clauses 4 to 10. These sections contain the main ISMS requirements your organization must meet for certification.

The two-part ISO 27001 Requirement: 7 clauses + Annex A

ISO 27001 is organized into two main parts.

1. Clauses 4 – 10 (mandatory)

Clauses 4 through 10 describe how your ISMS must operate. They cover areas such as assessing risks and planning how to fix information security issues. 

To get ISO 27001 certified, you must meet the applicable requirements across these clauses. You cannot simply exclude requirements such as internal audits or corrective action because they are inconvenient.

2. Annex A (not fully mandatory)

Annex A contains 93 information security controls that cover your organization, your people and obviously your technological security. 

These controls are practical restrictions or safeguards that organizations can use to treat information security risks. You do not automatically have to implement all 93 controls.

Instead, ISO 27001 asks you to

1. Identify your information security risks.
2. Decide how to treat those risks.
3. Determine which security controls are necessary.
4. Compare those controls with Annex A to ensure you haven’t missed anything important.
5. Record your control decisions in a Statement of Applicability (SoA).

The SoA shows which controls your organization considers necessary, why it includes them, whether it has implemented them, and why it has excluded any Annex A controls.

Your controls can also come from sources outside Annex A. Annex A basically acts as a reference point to make sure your risk treatment plan is complete.

Here is the full ISO 27001 requirements list at a glance:

	What it covers	What your organization needs to do
Clause 4	Context of the organization	Understand what affects your ISMS and define what the ISMS covers
Clause 5	Leadership	Set an information security policy with management involvement and assign clear responsibilities
Clause 6	Planning	Identify risks and opportunities and set information security objectives
Clause 7	Support	Provide the people, skills, resources, communication, and documentation needed to run the ISMS
Clause 8	Operation	Carry out risk assessments and implement risk treatment
Clause 9	Performance evaluation	Check whether the ISMS is working through monitoring, internal audits, and management reviews
Clause 10	Improvement	Fix problems when they appear and continually improve the ISMS
Annex A	93 information security controls	Review the controls against your risks, decide which ones are needed, and record those decisions in the SoA

The main requirements that organizations are assessed against begin with Clause 4.

Let’s now look at these clauses up close.

What are the seven ISO 27001 requirements in Clauses 4 through 10?

The seven clauses in ISO 27001 (Clauses 4 to 10) explain how to build and run an ISMS. Together, they form the foundation of an ISO 27001 requirements checklist, outlining what your organization must do to establish, implement, maintain, and continually improve its ISMS. Let’s understand each requirement in more detail.

Clause 4: Context of the organization

Clause 4 requires an organization to define the scope and purpose of its ISMS by understanding its business environment and relevant requirements. This clause also considers the boundaries of the information security program.

Your organization needs to

• Identify internal and external issues that could affect information security.
• Understand the needs of relevant interested parties, such as customers, regulators, suppliers, or investors.
• Define the scope of the ISMS.
• Establish the processes needed to run and improve it.

The ISMS scope tells everyone exactly what your certification covers.

ISO/IEC 27001:2022 Amendment 1:2024 also added climate-change considerations to Clauses 4.1 and 4.2. Organizations must now determine whether climate change is relevant to their ISMS context and whether interested parties have relevant climate-related requirements.

Clause 5: Leadership and commitment

Clause 5 requires senior management to take responsibility for the ISMS. That includes setting the information security policy, assigning clear roles, and making sure security goals support the organization’s wider business objectives.

Clause 6: Planning for risk management

Clause 6 requires the organization to identify information security risks and opportunities and define how it will treat those risks.

This clause is concerned with

• Defining how risks will be assessed
• Identifying and evaluating information security risks
• Deciding how each risk will be treated
• Selecting the controls needed to reduce those risks
• Preparing a Statement of Applicability
• Setting measurable information security objectives
• Planning important changes to the ISMS

The Statement of Applicability records those decisions. It shows which controls are relevant, why they are needed, whether they have been implemented, and why any Annex A controls have been excluded.

Clause 7: Support

Clause 7 covers the resources needed to operate the ISMS effectively. 

Those resources include:

• Sufficient people and resources
• Competent staff for security-related work
• Security awareness among employees
• Clear internal and external communication
• Properly created and controlled documentation

Clause 7 also covers competence and awareness. Someone responsible for incident response should have the skills to do the job, and employees should understand the security responsibilities that apply to their work.

Clause 8: Regular assessments and evaluations of operational controls

Clause 8 requires the organization to put its security plans into practice. Your organization must operate the processes needed to meet its information security requirements and implement its risk treatment plan.

The same applies to other planned safeguards. If your risk treatment plan calls for backups, supplier reviews, employee training, or vulnerability management, those activities need to become part of normal operations.

You also need evidence that they happened. An auditor may look for completed review records, tickets, reports, logs, or other proof that the process is operating as described.

Clause 9: Performance evaluation

Clause 9 requires the organization to measure whether the ISMS is working as intended through assessments and reviews. 

It has three main parts:

• Monitoring and measurement: Decide what you need to track and evaluate the results.
• Internal audits: Regularly check whether the ISMS meets ISO 27001 requirements and your own policies and processes.
• Management reviews: Have top management review the ISMS at planned intervals and decide whether changes are needed.

An external certification audit does not replace the internal audit. Running your own audit program is itself an ISO 27001 requirement.

Clause 10: Improvement & correction plan for Nonconformity(s)

Clause 10 requires the organization to address nonconformities, take corrective action, and continually improve the ISMS’s adequacy and effectiveness.

When something goes wrong, the organization must do more than correct the immediate issue. It needs to understand why the problem happened and prevent it from happening again.

Suppose an internal audit finds that the organization missed quarterly access reviews. Completing the overdue review fixes the immediate problem. Corrective action goes further by asking why the reviews were missed in the first place.

The organization might discover that nobody was clearly responsible for scheduling them. The corrective action could then include:

1. Assigning an owner.
2. Adding automated reminders.
3. Updating the access-review procedure.
4. Checking later reviews to confirm the new process works.

Clause 10 also requires continual improvement. Audit results, incidents, monitoring data, management reviews, and corrective actions should all feed back into the ISMS so it becomes more effective over time.

How do Annex A controls relate to the ISO 27001 requirements?

Clauses 4 to 10 and Annex A work together, but they have different purposes. The clauses tell you how to build and run your ISMS, whereas Annex A gives you a list of security controls to consider when deciding how to treat your risks. 

Clauses 4 through 10 are mandatory requirements for the ISMS itself. They follow a logical order that we explained above.

In ISO/IEC 27001:2022, Annex A contains 93 controls grouped into four themes. 

	Controls	What it covers
Organizational	37	Security policies, asset management, suppliers, incident management, business continuity, and other organization-wide measures
People	8	Employee screening, security responsibilities, awareness, training, and other people-related risks
Physical	14	Offices, secure areas, equipment, storage media, and protection against physical threats
Technological	34	Access control, authentication, malware protection, logging, backups, networks, secure development, and other technical safeguards

The important point is that you do not automatically implement all 93 controls.

Instead, the process works like this:

1. Identify your information security risks
2. Decide how those risks should be treated
3. Choose the controls you need
4. Compare your choices with Annex A to make sure you have not overlooked a relevant control
5. Record the result in your Statement of Applicability

If unauthorized access to customer data is a major risk, your treatment plan may require controls around access rights, authentication, logging, and user access reviews.

Another organization may face different risks and need a different combination of controls.

This is why it is misleading to say that “Annex A is optional.” Annex A still plays a required role in the risk-treatment process. What varies is whether each individual control is necessary for your organization.

Meet every ISO 27001 requirement with Sprinto

Sprinto is an autonomous trust platform that runs compliance with AI agents rather than checklists. It connects to 300+ integrations across your cloud, identity, HR, and code systems, maps your risks to the right Annex A controls, and assembles your ISMS, policies, tasks, and Statement of Applicability for you.

Its agents then handle the ongoing work Clauses 4 to 10 ask for: they monitor your controls around the clock, and when something drifts, they close the gap, refresh the evidence, and route approvals for you to sign off. A human stays in the loop, so your team leads the decisions while the agents do the execution.

Your evidence, SoA, and decision trail stay audit-ready any day of the year, and the same controls map across 200+ frameworks like SOC 2, HIPAA, and GDPR, so the work carries forward instead of starting over. If you would rather have the ISO 27001 requirements set up, monitored, and evidenced for you, book a Sprinto demo and see it running on your own environment.