ISO 27001:2022 Requirements: Clause 7.4 Communication

This version of clause 7.4 is applicable to both ISO 27001:2022 and ISO 27001:2013.

In the implementation of the ISMS, communication plays an important role in supporting the programme in different ways and can be useful for both internal and external purposes.

ISO 27001 communication plan

When considering communication, senior management should look to put together an ISMS communication plan to ensure that all of the relevant considerations have been taken into account. According to the standard, this should include:

• What to communicate: When considering what to communicate, senior leadership should refer to the needs and expectations of interested parties, both internal and external, defined in clause 4.2. The amount and type of information required will necessarily be very different depending on the stakeholder. For example, those required to implement and update part of the ISMS internally will require very different levels of information from external parties.
• When information will be communicated: This is an important consideration, particularly in the context of continual improvement; interested parties must be kept up-to-date on any ongoing changes to policies, required training, etc.
• Who the information will be communicated to: Again, this should involve the interested parties identified in clause 4.2, considering to which of these parties any particular information is relevant.
• Who will communicate: Considering who is best placed to deliver the ISMS communication plan is important. This does not have to be top management in every instance and, indeed, it may be that different people communicate different parts of the plan.
• How the information should be communicated: As well as considering who will do the communicating, it is important to consider the ‘how’ of the approach. Consider what systems are used to illustrate the message, as well as the format. For example, think about how the impact might differ depending on whether messaging was delivered in a general meeting or in a documented form.