# Clause 7: Support  

Clause 7 covers five distinct areas, from resources to documented information. These are **the building blocks of the management system**. These need to be in place to make the management system work effectively:

- Resources (7.1)
- Competence (7.2)
- Awareness (7.3)
- Communication (7.4)
- Documented information (7.5)
## Resources

The first is Resources ([Clause 7.1](../../../MoCs/ISO_27001_2022_7.1_MoC%20Resources.md)). This clause says the organization shall determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the ISMS. These resources can be human (people), financial (budget), tools and technologies, and physical workspace (if relevant).

As an auditor you're looking for evidence of proper planning to have the right resources in place at the right time. This planning should have a reasonable time horizon (let's say for the coming 12 months) or at least line up with the planning in other area's of the organization.

## Competence

When dealing with human resources[^1], they should not only be available, but competent as well according to Clause 7.2.
[Clause 7.2](../../../MoCs/ISO_27001_2022_7.2_MoC%20Competence.md) states that competence should be established on the basis of education, training or experience, and that the organization should take actions to ensure adequate competence where this is not the case.

So if the organization establishes roles and responsibilities for security[^1], they must also define the skill sets needed to fulfill those roles.

This will affect business processes beyond the domain of information security, for instance hiring strategy, screening, onboarding programs, and training[^2]. 

Clause 7.2 also says that this applies to 'persons doing work under its control' that affects security performance, so this could be permanent staff, temporary staff and insourced personnel.

[^1]:  There's also a link with [Clause 5.3](../../../MoCs/ISO_27001_2022_5.3_MoC%20Organizational%20roles,%20responsibilities%20and%20authorities.md): Organizational roles, responsibilities and authorities.
[^2]: See [A 6.1](../../../MoCs/ISO_27002_2022_6.1_MoC%20Screening.md) Screening, [A 6.3](../../../MoCs/ISO_27002_2022_6.3_MoC%20Information%20security%20awareness,%20education%20and%20training.md) Awareness, education and training

## Awareness

[Clause 7.3](../../../MoCs/ISO_27001_2022_7.3_MoC%20Awareness.md), Awareness, again applies to persons doing work under the organization's control: employees, freelancers, contractors and even suppliers.
These persons shall be aware of the information security policy, their contribution to the effectiveness of the ISMS and the implications of not conforming to the requirements of the ISMS[^3].

This is often tackled by having a broad awareness programme for both new longer term employees, with initiatives like e-learning, awareness training sessions, etc. But what we're looking for is efforts to really drive the right security behaviors, like building a strong security culture where people think about security being a normal part of their duties instead of a separate organizational discipline. For that you can look at training records, or interview a sample of employees on, for instance, what they recall of their training.

[^3]: See [A 6.4](../../../MoCs/ISO_27002_2022_6.4_MoC%20Disciplinary%20process.md) Disciplinary process

## Communication  

Communication is the topic of [Clause 7.4](../../../MoCs/ISO_27001_2022_7.4_MoC%20Communication.md).

You cannot run an effective management system without having regular communication with the interested parties (who have been identified under [|Clause 4.2](../../../MoCs/ISO_27001_2022_4.2_MoC%20Understanding%20the%20needs%20and%20expectations%20of%20interested%20parties.md)). Like for instance the customers, whose confidence you need, the management, to ensure ongoing buy-in, or the users, to encourage the right behaviors.

This requires a plan describing what will be communicated, to whom, when and how often, in what kind of language, and through what methods or channels.

As an auditor you will look for that plan, examples of communication, and evidence of establishing the impact or effectiveness of the communication.

The communication should not be one way, so how does the organization manage questions about security, or feedback on the training methods? Are these used to improve the communication about security?

## Documented information

The point of creating documentation is that it helps the organization in **doing things well** and doing them **in a consistent manner**.

There's two kinds of documentation required by [Clause 7.5.1](../../../MoCs/ISO_27001_2022_7.5_MoC%20Documented%20information.md): what is literally mentioned in the standard itself (a), and what the organization has determined necessary to run the ISMS effectively(b).

What is literally mentioned is documentation like the scope statement, the information security policy, the risk management process, the statement of applicability, the resource requirements, and planning – [4.3](../../../MoCs/ISO_27001_2022_4.3_MoC%20Determining%20the%20scope%20of%20the%20information%20security%20management%20system.md), [5.2](../../../MoCs/ISO_27001_2022_5.2_MoC%20Policy.md), [6.1](../../../MoCs/ISO_27001_2022_6.1_MoC%20Actions%20to%20address%20risks%20and%20opportunities.md), [6.1.3d](../../../MoCs/ISO_27001_2022_6.1_MoC%20Actions%20to%20address%20risks%20and%20opportunities.md), [7.1](../../../MoCs/ISO_27001_2022_7.1_MoC%20Resources.md), and [6.2](../../../MoCs/ISO_27001_2022_6.2_MoC%20Information%20security%20objectives%20and%20planning%20to%20achieve%20them.md), respectively. These can be identified in the standard with the word 'Shall'.

Do not step into the trap of 7.5.1b by thinking you need to have a document for every clause and control in the 27001. The keyword is effectiveness.

If you have a complex task in a complex environment with possibly high security risks, it's important that this task is consistently performed in detail. In that case you need a detailed document with step-by-step instructions. For simpler, lower risk tasks that will be performed by competent staff, the documentation may be quite sparse.

Other aspects that have an effect on the necessity of documentation are the size of a company (smaller is usually less) and the frequency of events the documentation describes (like a written Leavers procedure for a small organization that has had very few leavers in the past 10 years). In those cases written documentation may not be required, but the auditor may raise an opportunity for improvement.

As an auditor you need to think about proportionality and added value.

#### Managing the document life cycle
There need to be rules on how to manage the life cycle of documentation in the ISMS.

These are rules about:
- the identification of documents: Is it a policy? Is it a procedure?
- the use of metadata (e.g. date, author, or reference number) and titles
- who should be able to create and update documentation (levels of authorization)
- review and approval of documentation
- version control
- their classification and security level
- access and handling, especially for sensitive information
- sharing and distribution, making sure people can find relevant documentation
- archiving and disposal

(related: [C 5.3](../../../MoCs/ISO_27001_2022_5.3_MoC%20Organizational%20roles,%20responsibilities%20and%20authorities.md), [A 5.10](../../../MoCs/ISO_27002_2022_5.10_MoC%20Acceptable%20use%20of%20information%20and%20other%20associated%20assets.md), [A 5.12](../../../MoCs/ISO_27002_2022_5.12_MoC%20Classification%20of%20information.md), [A 5.13](../../../MoCs/ISO_27002_2022_5.13_MoC%20Labelling%20of%20information.md), [A 5.15](../../../MoCs/ISO_27002_2022_5.15_MoC%20Access%20control.md), [A 5.18](../../../MoCs/ISO_27002_2022_5.18_MoC%20Access%20rights.md), [ A 8.10](../../../MoCs/ISO_27002_2022_8.10_MoC%20Information%20deletion.md))

To check if documents are being used adequately, you can look at if people actually referring to them, and are behaving according to the contents of the documents. This can be discovered through things like monitoring and metrics, or the internal audit process[^4].

If documents are archived, it's important to know how the archives are protected. For the disposal of documents, the method may very depending on the sensitivity of the information.

An organization should have a document management policy that addresses all of these points.

 If the organization already has another management system in place, like ISO 9001, they will probably already have these processes in place, and they can reuse them for ISO 27001, as all ISO management systems have the same demands here.

 [^4]:Related: [C 9.1](../../../MoCs/ISO_27001_2022_9.1_MoC%20Monitoring,%20measurement,%20analysis%20and%20evaluation.md), [C 9.2](../../../MoCs/ISO_27001_2022_9.2_MoC%20Internal%20audit.md), [A 8.16](../../../MoCs/ISO_27002_2022_8.16_MoC%20Monitoring%20activities.md)