What ISO 27001 clauses 4 to 10 ask for before any audit
A customer questionnaire or contract that asks for ISO 27001 usually means one thing: the organization must show an information security management system (ISMS) that an accredited certification body can audit. Clauses 4 to 10 of ISO/IEC 27001:2022 set the ISO 27001 requirements that cannot be excluded, and every certification audit tests them. The 2022 edition is the current version, and it covers context of the organization, leadership, planning, support, operation, performance evaluation and improvement. Clause 1 of the standard states that no requirement in clauses 4 to 10 may be left out of a conformity claim, so a scope limitation applies to which systems and sites are covered, never to the management system clauses themselves.
The 93 Annex A controls work differently. The organization determines the controls it needs through risk treatment under clause 6.1.3, compares them with Annex A so none is overlooked, and records the outcome in the Statement of Applicability. Confirm with your certification body which edition its audit plan references before you start, because transition deadlines under IAF MD 26:2023 have already passed for the 2013 edition. Ownership also needs to be clear from the start: your organization owns the ISMS, its policies and its decisions, and an implementation partner can prepare systems and evidence, but only an accredited certification body issues the certificate. Check any certificate you are shown in the IAF CertSearch database, which ISO points to for accredited certificates.
What each clause in ISO 27001 clauses 4 to 10 covers
Clauses 4 to 10 form the management system that every certified ISMS must run, and none of them can be excluded. Each card below names one clause or cluster, what it asks the organization to decide, run or keep as evidence, and what an auditor will check.
Clause 4: context and scope
Clause 4 asks the organization to document the internal and external issues that affect its information security, identify the interested parties and their requirements, and set the boundary of the ISMS (4.1 to 4.3). Clause 4.4 requires the ISMS itself to be established, implemented, maintained and continually improved. Auditors test whether the scope statement matches the services, sites and systems actually in use, and whether the context reflects the 2024 climate change amendment to 4.1 and 4.2. Confirm the scope with your certification body before the first audit.
Clause 5: leadership and commitment
Clause 5 covers what top management must do: show leadership and commitment to the ISMS, set an information security policy, and assign roles, responsibilities and authorities. The clause puts accountability with executives rather than with the security team alone. Auditors look for evidence that leaders approved the policy, took part in reviews and understood their duties. See the clause 5 leadership page for the detail auditors test.
Clause 6: risk and objectives
Clause 6.1 requires a defined risk assessment process, a risk treatment process, and a Statement of Applicability that compares your chosen controls with Annex A so none is omitted by accident. Clause 6.2 requires information security objectives that are measurable, consistent with the policy and assigned owners, plus a plan for achieving them. Auditors trace a risk from the assessment to its treatment and then to the control and the Statement of Applicability.
Clause 7: support resources
Clause 7 covers the support the ISMS needs: adequate resources (7.1), competence of people doing security work (7.2), awareness of the policy and their contribution (7.3), communication (7.4) and documented information (7.5). It is the clause that makes the rest of the system workable and visible. Auditors check that the people named in the controls have the skills they need and that documents are versioned and controlled. Detailed guidance sits on the competence, awareness and documented information pages.
Clause 8: operational planning
Clause 8 requires the organization to plan, implement and control the processes needed to meet the security requirements, and to carry out risk assessments and risk treatment at planned intervals or when significant changes occur. It is where the decisions from clause 6 are put into daily practice. Auditors test continuing operational control, which means they look at how controls run in real systems, not only at the written process. Ask which risk assessments are scheduled and which trigger events you have defined.
Clause 9: performance evaluation
Clause 9.1 requires you to decide what to monitor and measure, when, and how results are analyzed. Clause 9.2 requires internal audits at planned intervals, with an audit programme and reports to management. Clause 9.3 requires management review with defined inputs and recorded results. Auditors expect these three to connect: metrics feed the internal audit, and audit findings feed the management review. Ask for the minutes of the last management review as part of your readiness check.
Clause 10: improvement and corrective action
Clause 10.1 requires the organization to keep improving the suitability, adequacy and effectiveness of the ISMS. Clause 10.2 requires you to react to nonconformities, correct them, deal with their consequences, and take corrective action to prevent recurrence, keeping records of what was done. Auditors check that each nonconformity has a root cause, a fix and a verified closure. Auditors often treat repeated findings as a sign that corrective action is not working.
How clause 6.1.3 links the Annex A controls to the Statement of Applicability
Clause 6.1.3 sets a sequence that every ISMS must follow. First, the organization determines the controls it needs to treat the risks identified in its risk assessment. Second, it compares those controls with the Annex A reference set, so that no relevant control is left out by accident. Third, it records the outcome in a Statement of Applicability (SoA). Annex A is normative and lists 93 controls in four themes: 37 organizational, 8 people, 14 physical and 34 technological. The organization does not have to adopt all 93, but every control it excludes needs a documented justification, and every control it keeps needs a stated treatment. The organization owns these decisions. An implementation partner can draft the comparison, but the people accountable for the risks must agree with the result.
The SoA is a clause 4 to 10 record, not a control library. It shows, for each Annex A control, whether the control is applicable, why it is or is not, and how it is implemented or where its evidence sits. It is not a substitute for the management system clauses, which apply in full regardless of the SoA. Before drafting, confirm that your risk register, treatment plan and SoA use the same control identifiers and the same wording of the 2022 edition, since mismatches are a common source of early audit findings. Keep the SoA versioned and approved, because the auditor will compare it against the risk treatment plan and the evidence you present on site.
An auditor tests the reasoning, not just the list. Expect questions such as why a physical control was marked not applicable for a fully cloud-hosted service, which risk drove the inclusion of a technological control, and whether the justification still holds after the last risk assessment. A clean list with thin justifications is a weak position. Before the certification audit, walk through a sample of exclusions and inclusions with the owners of the controls, check that each one traces back to a risk decision, and confirm with your certification body which level of detail it expects in the SoA.
What auditors test at every visit versus each stage
The initial certification in ISO/IEC 27001 is a two-stage process. In stage 1, the auditor reviews documentation to judge whether the management system is designed to meet the requirements, including the scope under clause 4.3, the information security policy, the risk assessment and treatment under clause 6.1, the Statement of Applicability and the internal audit and management review arrangements. In stage 2, the auditor tests whether the system is implemented and operating, which is where clauses 4 to 10 are verified in practice.
- Design review in stage 1: Auditors check that a documented process exists for each clause, including the internal audit programme under 9.2 and the management review under 9.3.
- Operating evidence in stage 2: Auditors look for records showing that internal audits were run, findings were raised and management reviews took place with the required inputs.
- Corrective action trails: Auditors follow a sample of nonconformities from identification through root cause analysis to closure under clause 10.2.
- Scope and context consistency: The scope in clause 4.3 must match the risks, interested party requirements and Statement of Applicability that were reviewed.
- Ongoing control in stage 2: Auditors expect the system to have run for long enough to produce records, so a freshly written system with no history is a readiness issue.
Before booking stage 1, confirm with your certification body how it plans the two stages and what documentation it wants in advance.
Surveillance audits take place during the certification cycle, and the certification body must audit at least once in each calendar year. European Accreditation FAQ 37.12 states this requirement, which applies under ISO/IEC 17021-1. European Accreditation FAQ 44.2 cites clause 9.6.2.2 of ISO/IEC 17021-1, which requires every surveillance audit to include continuing operational control. A surveillance audit therefore cannot be limited to reviewing the management system documents and records.
- Operational control checks: Auditors observe how controls run day to day, such as access reviews, change approvals, incident handling and supplier checks.
- Internal audit and management review: Auditors typically sample the most recent internal audit report under 9.2 and the latest management review minutes under 9.3.
- Corrective actions: Auditors check that nonconformities from earlier visits were addressed and that the fixes are effective, not only recorded.
- Changes since the last visit: Scope changes, new sites, new products and significant risk changes are tested against clauses 4.3 and 6.1.
- Objectives and measurement: Auditors review whether the results from clause 9.1 monitoring show progress against the objectives set under 6.2.
Ask your certification body which clauses and sites it plans to sample at each surveillance visit, so that the evidence is ready before the visit.
At the end of the three-year cycle, the certification body runs a recertification audit. It reviews the whole management system again, including changes over the cycle, and it confirms that the system has been effective throughout. Because the audit covers the full scope, recertification takes more time than a surveillance visit, and it is the point where gaps accumulated over several years become visible.
- Full clause review: Auditors revisit clauses 4 to 10 across the cycle, including how context and interested party requirements changed under 4.1 and 4.2.
- Trend analysis: Auditors look at monitoring results, internal audit findings and management review decisions over three years to judge whether the system improved.
- Continual improvement: Clause 10.1 evidence should show changes made in response to results, risks and audit findings.
- Recurring nonconformities: Repeated findings on the same clause raise questions about the root cause analysis and the effectiveness of corrective action under 10.2.
- Timing and expiry: Recertification should be planned before the certificate expires, because the recertification process differs if the certificate lapses (European Accreditation FAQ 47.5 covers this).
Confirm with your certification body how recertification timing and scope will be handled, and whether any changes to the certification body or accreditation status apply to your cycle.
Certification bodies do not publish a fixed sample size for each clause, and auditors choose samples based on risk and the audit plan. In practice, a few clauses appear at every visit because they show whether the management system is controlled and improving. Clauses 9.2, 9.3 and 10.2 are the most consistently sampled, because they show how the organization checks its own system and responds to what it finds.
- Clause 9.2 internal audit: Auditors ask for the audit programme, the criteria used, the auditor independence arrangements and the reports from the most recent cycle.
- Clause 9.3 management review: Auditors check that the review considered the required inputs and produced decisions, and that the minutes show top management involvement.
- Clause 10.2 corrective action: Auditors trace nonconformities from the internal audit, management review or prior visit to documented closure.
- Clause 6.1 risk and Statement of Applicability: Auditors test whether risk treatment decisions are current and whether the Statement of Applicability reflects them.
- Clause 9.1 monitoring: Auditors check that measurement results exist, are analyzed and lead to decisions.
Before each visit, confirm with your auditor which clauses are in the plan and make sure the most recent records for those clauses are complete and easy to retrieve.
How to check clauses 4 to 10 before the auditor arrives
This sequence walks the management system from scope to corrective action, so each clause produces a record the certification body can sample before its audit. Work through it in order, because each output feeds the next step.
Confirm the ISMS scope under clause 4.3
Leadership, with the people who own the in-scope services, writes down which business units, products, sites, systems and third parties the ISMS covers, and what it excludes and why. The check is that every boundary decision can be traced to the context work under clauses 4.1 and 4.2 and to the interfaces the scope touches. The output the auditor will ask for is a written scope statement that matches the certificate scope you intend to request. Confirm with your certification body how it expects scope to be described before you finalize the wording.
Record the risk assessment and treatment under clause 6.1
The risk owner runs the documented risk assessment using a defined method, then decides how each risk will be treated. Each treatment decision is compared against Annex A so no necessary control is overlooked, and the outcome is recorded in the Statement of Applicability under clause 6.1.3. The check is that every risk links to a treatment, and every Annex A control is marked as included or excluded with a reason. The auditor will ask to see the risk register, the treatment plan and the current Statement of Applicability, and will sample a few controls back to their evidence.
Set information security objectives under clause 6.2
Management sets a small number of security objectives that follow from the risk treatment plan, each with an owner, a measure, a target and a review date. Objectives should say what will be achieved and how success is measured, so they can be reported in later reviews. The check is that each objective traces back to a risk or policy commitment. The auditor will expect a written objectives register and evidence that progress was tracked. Confirm with the certification body how far back it expects objective records to go before stage 2.
Run one full internal audit cycle under clause 9.2
An internal auditor who is independent of the controls being checked works through the internal audit programme, covering the ISMS clauses and the in-scope Annex A controls. Findings are recorded as nonconformities or observations, and each nonconformity is passed to the corrective action process. The check is that the programme covers the whole scope and that the auditor is not auditing their own work. The auditor will ask for the audit programme, the audit plan, the checklists or notes, and the findings report.
Hold a management review under clause 9.3
Top management reviews the ISMS using the required inputs, including the status of actions from earlier reviews, changes in context, performance of objectives, internal audit results and risk treatment status. The meeting records decisions about improvement, resources and changes to the ISMS. The check is that the minutes show each required input was considered and that outputs have owners. The auditor will look at the minutes, the attendance and the action list, and will test whether the outputs were carried into later work.
Log and close a corrective action under clause 10.2
Each nonconformity from the internal audit or management review gets a corrective action record that describes the cause, the fix, the owner and the evidence that the fix works. The record should show whether the action addressed the root cause and whether the same issue has recurred. The check is that at least one real corrective action has been opened and closed, so the process has been used rather than only designed. The auditor will sample these records and ask how the lessons fed back into the risk assessment and the Statement of Applicability.
Where clause gaps usually appear and how to prioritize them
Clause gaps tend to cluster in the same few places: scope, risk criteria, management review and corrective action. ISO/IEC 27001 states that its requirements are not listed in order of importance, so the way to rank a gap analysis is by risk to the organization and by what customers or regulators will ask to see first.
Scope that does not match real systems
Clause 4.3 requires the organization to determine the boundaries and applicability of the ISMS. Gaps appear when the documented scope omits cloud accounts, subsidiaries, remote endpoints or a SaaS production environment that actually holds customer data. Rank this high when an excluded system stores or processes information in the scope of a contract. Check the scope statement against an inventory of accounts, networks and locations, and confirm that every exclusion has a stated reason.
Risk criteria not tied to objectives
Clause 6.1.2 requires a defined risk assessment process, including the criteria for accepting risk. A common gap is a risk method that scores threats in isolation, with no link to the information security objectives in clause 6.2 or to the impacts the business cares about. Rank this high because every later decision, including the Statement of Applicability, depends on it. Check that each criterion can be traced to an objective and that two assessors would reach similar scores.
Statement of Applicability without justification
Clause 6.1.3 requires the organization to compare its necessary controls with Annex A and record the result in a Statement of Applicability. Gaps appear when controls are marked as applicable with no reference to a risk treatment, or excluded with no reason. Rank this high when a customer questionnaire asks about a specific Annex A control, because a mismatch between the answer and the document is quickly noticed. Check each row against the risk treatment plan.
Management review that records no decisions
Clause 9.3 requires top management to review the ISMS at planned intervals, using defined inputs and recording outputs. Many organizations hold the meeting but minute only attendance and status updates. Rank this medium-high, since auditors test this at every visit and it links to whether leadership actually owns the ISMS. Check that minutes show the inputs reviewed, the decisions taken, and the resources or changes agreed.
Corrective actions without root cause
Clause 10.2 requires the organization to react to nonconformities, determine root causes and check that corrective actions are effective. A typical gap is closing an incident or internal audit finding by fixing the symptom, with no analysis of why it happened. Rank this high when the nonconformity recurs or affects a customer or regulator. Check that each corrective action record names a cause, an owner, a due date and a verified effect.
Questions about ISO 27001 clauses 4 to 10
Can we outsource ISO 27001 clauses 4 to 10 to a consultant?
Not the ownership. The organization must own its context, leadership commitment, risk assessment, objectives, management review and corrective actions, because the certification body tests whether management actually runs the management system. An implementation partner can prepare the documents, set up the registers and tracking tools, run a gap analysis and help draft the evidence trail. Clause 1 states that no requirement in clauses 4 to 10 may be excluded, so every clause is audited at every visit. Ask any provider to show which decisions remain with your leadership team and which artifacts they will hand over for you to maintain after the engagement ends.
How much effort do clauses 4 to 10 take, and what drives it?
The effort depends on how many interested parties, sites, business processes and suppliers fall inside the scope, how mature your existing risk and governance practices are, and how many documented information items you must create or reconcile. Clause 6.1.2 risk assessment and clause 9 performance evaluation usually take the most time, because they recur and generate records. Expect the work to be partly one-time (scope, context, first risk assessment, policy set) and partly recurring (internal audits, management reviews, objective measurement, corrective actions). Ask any quote to split effort by clause and by one-time versus recurring work, and to state which internal roles it assumes.
Does the 2024 climate change amendment change what auditors check?
It adds to the existing requirements rather than replacing them. Amendment 1:2024 requires the organization to determine whether climate change is a relevant issue when it understands its context under clause 4.1, and adds a note under clause 4.2 that interested parties can have climate-related requirements. In practice, the auditor will expect a documented decision, with reasons, on whether climate change is relevant to the scope and risk picture. A decision of 'not relevant' still needs a rationale on record. Confirm with your certification body how it will test this in your first audit after the amendment.
Can an internal team run clauses 4 to 10 without outside help?
Yes, if the team has the time, authority and skills to run the processes. The standard does not require a consultant, and many organizations maintain the ISMS internally after an initial build. The internal team needs a named ISMS owner, a management sponsor who genuinely chairs the management review, someone competent to run internal audits independent of the work they check, and a risk method that the business accepts. The usual gap is capacity: internal audits, management reviews and corrective action follow-up keep running after the initial project ends. Before deciding, check whether the team can produce a full cycle of evidence without help.
What does the certification body check, and what does a consultant prepare?
The certification body checks conformity and effectiveness. Accredited bodies work under ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024, and they test your management system through document review, interviews, observation and sampling of records. A consultant or implementation partner prepares the system: scope, risk assessment, Statement of Applicability, policies, evidence collection and internal audit preparation. The certification body cannot prepare the system for you without creating a conflict of interest, so ask any provider to confirm it is independent of the body that will audit you. Only the accredited certification body issues the certificate.
How does the move from ISO 27001:2013 to 2022 affect existing certificates?
Under IAF MD 26:2023, all certifications to ISO/IEC 27001:2013 had to expire or be withdrawn by 31 October 2025, the end of the 36-month transition period. If you still hold a 2013 certificate, you need to have transitioned to the 2022 edition through the certification body's process. The clause structure of 4 to 10 changed less than Annex A, but the 2022 edition expects a Statement of Applicability that maps to the 93 controls in four themes, so the clause 6.1.3 work must be redone. Ask your certification body to confirm your current certificate status and the evidence it will review.
Which clause do auditors test first, and why does the order matter?
Auditors test every clause in 4 to 10, but the introduction to the standard states that the order of requirements does not reflect their importance or the order of implementation. That means you can prioritize a gap analysis by risk rather than clause number. The clauses that most often produce nonconformities are the ones with weak links between them: scope that does not match the risk assessment, objectives with no measurement, and management reviews that do not record decisions. Check the link between scope, risk and management review first, because a weakness there affects everything else.
How DeployOpen prepares clause evidence for your ISMS
DeployOpen works on the clause 4 to 10 requirements as a fixed-scope implementation partner inside your own infrastructure. We prepare the systems, records and evidence that show your management system operates, while your leadership owns the decisions and an independent certification body issues any certificate.
How we scope
- Scope agreed in writing before work starts, covering which clauses and systems the engagement touches
- Current-state review of your context, interested party inputs, ISMS scope and existing documents
- Clear split of what your team owns, such as policy approval and management review, and what we prepare
How we build
- Self-hosted open-source tooling deployed in your cloud accounts, data centers or air-gapped networks
- Records for risk assessment, risk treatment, objectives, internal audit and corrective action set up in version-controlled form
- Testing of the evidence trail so each clause can be traced to a dated, owned and retrievable record
How we hand over
- Documented deliverables, configuration notes and runbooks delivered to your team with named owners
- Evidence packs organized by clause, ready for your internal audit and for the certification body's review
- Knowledge transfer so your staff can run the management system without depending on us
How we support
- Ongoing support, upgrades and continuous testing available as a retainer after handover
- Help preparing for surveillance and recertification audits, limited to systems and evidence we delivered
- Ask any prospective partner to confirm in writing which parts of clauses 4 to 10 remain with your organization
