2.4 Support, Resources, and Documented Information (Clause 7)

2.4 Support, Resources, and Documented Information (Clause 7)

Clause 7 of ISO/IEC 27001:2022 defines the operational support structure required to maintain an effective Information Security Management System (ISMS). A robust security architecture and well-designed risk treatment plan cannot succeed without adequate resources, competent staff, pervasive security awareness, clear communications, and disciplined document control.

For a Lead Auditor, Clause 7 evaluation focuses on verifying that the organization's human capital, communication channels, and documentation workflows provide genuine structural support to the ISMS rather than remaining paper-based compliance exercises.

---

1. Resources (Clause 7.1)

Clause 7.1 requires the organization to determine and provide the resources needed for the establishment, implementation, maintenance, and continual improvement of the ISMS.

Categories of ISMS Resources

Auditors verify resource allocation across four distinct operational pillars:

• Financial Resources: Dedicated CapEx and OpEx budgets for security tooling, external audits, penetration testing, and risk remediation.
• Human Resources: Sufficient staffing levels for security operations, incident response, compliance monitoring, and system administration.
• Infrastructure & Technology: Hardware, software, secure cloud environments, physical access control systems, and monitoring tools.
• Organizational Knowledge: Specialized expertise regarding industry regulations, threat intelligence, and secure architecture design.

During audits, lead auditors review budget allocations, staffing headcount requests, and project roadmaps to ensure resource constraints are not crippling security controls.

---

2. Competence (Clause 7.2)

Clause 7.2 applies to all personnel performing work under the organization's control that affects its information security performance.

Mandatory Competence Workflow

The organization must:

1. Determine Necessary Competence: Define required skills, qualifications, certifications, and experience for security-impacting roles (e.g., CISO, Incident Responder, Network Engineer, Database Administrator).
2. Ensure Competence: Ensure personnel are competent on the basis of appropriate education, training, or experience.
3. Take Action & Evaluate: Where skill gaps are identified, take actions to acquire necessary competence (e.g., specialized training, mentoring, hiring, reassigning) and evaluate the effectiveness of the actions taken.
4. Retain Evidence: Retain appropriate documented information as evidence of competence (e.g., training certificates, university degrees, professional certifications like CISSP/CISM, performance evaluations, CVs).

+-------------------------------------------------------------------------+
|                       CLAUSE 7.2 COMPETENCE CYCLE                       |
+-------------------------------------------------------------------------+
| Define Skill Profiles ---> Evaluate Staff Gaps ---> Execute Training    |
|           ^                                                 |           |
|           |                                                 v           |
| Retain Documented Evidence <--- Evaluate Training Effectiveness         |
+-------------------------------------------------------------------------+

Auditor Verification Note: Simply presenting a training sign-in sheet is insufficient to satisfy Clause 7.2. The auditor must verify that the organization evaluated the effectiveness of the training (e.g., post-training examination, practical lab evaluation, or post-course supervisor review).

---

3. Information Security Awareness (Clause 7.3)

Clause 7.3 mandates that all persons doing work under the organization's control (including full-time employees, temporary workers, contractors, and third-party consultants) must be aware of:

1. The Information Security Policy: Understanding corporate security rules and core commitments.
2. Personal Contribution: How their daily work activities contribute to the effectiveness of the ISMS and the achievement of security objectives.
3. Implications of Nonconformity: The risks and operational consequences of not conforming with ISMS requirements (e.g., data breaches, disciplinary actions, legal liability).

Sampling Awareness During Stage 2 Audits

Lead auditors assess Clause 7.3 by conducting random, cross-departmental interviews with non-security staff (e.g., HR specialists, sales representatives, customer support agents, warehouse supervisors). Sample audit questions include:

• "Where do you access the company's Information Security Policy?"
• "What steps do you take if you receive a suspicious email attachment or notice unauthorized personnel in the building?"
• "How does your daily job help protect customer confidentiality?"

---

4. Communication (Clause 7.4)

Clause 7.4 requires the organization to determine internal and external communications relevant to the ISMS.

Structure of the ISMS Communication Matrix

The organization must establish a structured communication plan addressing five core parameters: $\text{Communication Protocol} = \text{What to communicate} + \text{When} + \text{With whom} + \text{How} + \text{Who communicates}$

---

5. Documented Information (Clause 7.5)

Clause 7.5 governs the creation, updating, protection, and control of all ISMS documentation.

Mandatory Documented Information Requirements

ISO/IEC 27001:2022 explicitly mandates documented information for specific clauses:

• Scope Statement (Clause 4.3)
• Information Security Policy (Clause 5.2)
• Risk Assessment Methodology & Process (Clause 6.1.2)
• Statement of Applicability (Clause 6.1.3)
• Risk Treatment Plan (Clause 6.1.3)
• Information Security Objectives (Clause 6.2)
• Evidence of Competence (Clause 7.2)
• Documented Information of Operational Planning & Control (Clause 8.1)
• Results of Risk Assessments (Clause 8.2) & Risk Treatments (Clause 8.3)
• Evidence of Monitoring and Measurement Results (Clause 9.1)
• Internal Audit Programme and Audit Results (Clause 9.2)
• Evidence of Management Review Results (Clause 9.3)
• Evidence of Nonconformities, Corrective Actions & Results (Clause 10.2)

Creating, Updating, and Control Protocols (Clause 7.5.2 & 7.5.3)

When creating and updating documented information, the organization must ensure appropriate identification (title, date, author, reference number), format, and review and approval for suitability and adequacy.

Under Clause 7.5.3, documented information must be controlled to ensure:

• Availability & Suitability: Accessible where and when needed for use.
• Protection: Adequately protected against loss of confidentiality, improper use, or loss of integrity.
• Lifecycle Controls: Regulated distribution, access, retrieval, storage, preservation, version control, retention, and disposition.
• External Documents: Documents of external origin determined by the organization to be necessary for the ISMS (e.g., vendor contracts, statutory laws) must be identified and controlled.

---

6. Lead Auditor Examination & Document Control Checklist

Document Control Audit Checklist

1. Version Control Integrity: Verify that operational SOPs display current version numbers, approval dates, and named approvers.
2. Access Permission Testing: Confirm that restricted security documentation (e.g., network architecture diagrams, vulnerability reports) cannot be accessed by unauthorized employees.
3. Obsolete Document Handling: Verify that outdated policy versions are promptly removed from intranet portals to prevent accidental use by operational staff.

Real-World Audit Scenario: Uncontrolled Operational SOPs

Scenario: During a Stage 2 audit of a software company's DevOps environment, the Lead Auditor inspects server deployment procedures. Engineers point to an internal open-wiki page containing deployment scripts. The auditor reviews the wiki page and discovers that any software engineer can edit the deployment rules without peer review, approval stamps, or change log tracking.

Auditor Finding: Minor Nonconformity against Clause 7.5.2 and Clause 7.5.3. Operational documented information critical to system deployment lacked formal approval for suitability, version control, and protection against unauthorized modification.