All types Page Article White Paper Download
Solutions The best route to security compliance
Hicomply Privacy™ ISO 27001 ISO 9001 ISO 14001 SOC 2 NHS DSPT NIST 800-53 Hicomply GRC™ Services & Customer Support
Platform A powerful suite of ISMS features
Dashboard ISMS Scoping Policy Management Risk Management Information Asset Management Task Management Integrations Hicomply for Enterprises Trust Centre Controls Monitor Hicomply AI
Resources Everything you need to know
Knowledge & Insights Resources Hub Case Studies Sectors Glossary News ROI Calculator
Knowledge Base Learn more about infosec
ISO 27001 Knowledge Base SOC 2 Knowledge Base NHS DSPT Knowledge Base PCI DSS Knowledge Base NIST 800-53 Knowledge Base
Company Security and customers first
About News Partners Careers Contact

ISO 27001 Clause 7.4: Communication (2022)

Read the requirements of ISO 27001 Clause 7.4: Communication, which requires the organisation to determine what, when, how and with whom to communicate, as well as who should do the communicating.

This version of clause 7.4 is applicable to both ISO 27001:2022 and ISO 27001:2013.

In the implementation of the ISMS, communication plays an important role in supporting the programme in different ways and can be useful for both internal and external purposes.

ISO 27001 communication plan

When considering communication, senior management should look to put together an ISMS communication plan to ensure that all of the relevant considerations have been taken into account. According to the standard, this should include:

  1. What to communicate: When considering what to communicate, senior leadership should refer to the needs and expectations of interested parties, both internal and external, defined in clause 4.2. The amount and type of information required will necessarily be very different depending on the stakeholder. For example, those required to implement and update part of the ISMS internally will require very different levels of information from external parties.
  1. When information will be communicated: This is an important consideration, particularly in the context of continual improvement; interested parties must be kept up-to-date on any ongoing changes to policies, required training, etc.
  1. Who the information will be communicated to: Again, this should involve the interested parties identified in clause 4.2, considering to which of these parties any particular information is relevant.
  1. Who will communicate: Considering who is best placed to deliver the ISMS communication plan is important. This does not have to be top management in every instance and, indeed, it may be that different people communicate different parts of the plan.
  1. How the information should be communicated: As well as considering who will do the communicating, it is important to consider the ‘how’ of the approach. Consider what systems are used to illustrate the message, as well as the format. For example, think about how the impact might differ depending on whether messaging was delivered in a general meeting or in a documented form.