ISO 27001 Clauses Explained

Clauses 4 through 10 are what an auditor certifies against directly. Unlike Annex A controls (which are selected based on applicability), every clause requirement applies to every certified organization.

Clause	Requirement area
4. Context of the Organization	Understanding internal/external issues, interested parties, and ISMS scope
5. Leadership	Top management commitment, policy, roles and responsibilities
6. Planning	Risk assessment and treatment, information security objectives
7. Support	Resources, competence, awareness, communication, documented information
8. Operation	Operational planning and control, risk assessment/treatment execution
9. Performance Evaluation	Monitoring, measurement, internal audit, management review
10. Improvement	Nonconformity handling, corrective action, continual improvement

Why clause structure matters for audits

Auditors trace evidence against specific clauses. A documented risk assessment satisfies Clause 6; management review meeting minutes satisfy Clause 9; a corrective action log satisfies Clause 10. Organizations that treat ISO 27001 purely as "which Annex A controls do we have" often struggle at audit because the clause-level ISMS process evidence is thin or missing.