# Index to the original texts of ISO 27001
2022 version

| Clause      | Title                                                                                                                                                                                                                             |
| ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **F**       | **[Foreword](27001/EN/c-f-Foreword.md)**                                                                                                                |
| **0**       | **[Introduction](27001/EN/c-0-Introduction.md)**                                                                                                                       |
| **1**       | **[Scope](27001/EN/c-1-Scope.md)**                                                                                                                                     |
| **2**       | **[Normative references](27001/EN/c-2-Normative-references.md)**                                                                                                       |
| **3**       | **[Terms and definitions](27001/EN/c-3-Terms-and-definitions.md)**                                                                                                     |
| **4**       | **Context of the organization**                                                                                                                                                                                                   |
| 4.1         | [Understanding the organization and its context                               ](27001/EN/c-4.1-Understanding-the-organization-and-its-context.md)                      |
| 4.2         | [Understanding the needs and expectations of interested parties               ](27001/EN/c-4.2-Understanding-the-needs-and-expectations-of-interested-parties.md)      |
| 4.3         | [Determining the scope of the information security management system          ](27001/EN/c-4.3-Determining-the-scope-of-the-information-security-management-system.md) |
| 4.4         | [Information security management system                                       ](27001/EN/c-4.4-Information-security-management-system.md)                              |
| **5**       | **Leadership**                                                                                                                                                                                                                    |
| 5.1         | [Leadership and commitment                                                    ](27001/EN/c-5.1-Leadership-and-commitment.md)                                           |
| 5.2         | [Policy                                                                       ](27001/EN/c-5.2-Policy.md)                                                              |
| 5.3         | [Organizational roles, responsibilities and authorities                       ](27001/EN/c-5.3-Organizational-roles-responsibilities-and-authorities.md)               |
| **6**       | **Planning**                                                                                                                                                                                                                      |
| 6.1         | Actions to address risks and opportunities *(no content)*                                                                                                                                                                         |
| 6.1.1       | [General                                                                      ](27001/EN/c-6.1.1-General.md)                                                           |
| 6.1.2       | [Information security risk assessment                                         ](27001/EN/c-6.1.2-Information-security-risk-assessment.md)                              |
| 6.1.3       | [Information security risk treatment                                          ](27001/EN/c-6.1.3-Information-security-risk-treatment.md)                               |
| 6.2         | [Information security objectives and planning to achieve them                 ](27001/EN/c-6.2-Information-security-objectives-and-planning-to-achieve-them.md)        |
| 6.3         | [Planning of changes                                                          ](27001/EN/c-6.3-Planning-of-changes.md)                                                 |
| **7**       | **Support**                                                                                                                                                                                                                       |
| 7.1         | [ Resources                                                                   ](27001/EN/c-7.1-Resources.md)                                                           |
| 7.2         | [ Competence                                                                  ](27001/EN/c-7.2-Competence.md)                                                          |
| 7.3         | [ Awareness                                                                   ](27001/EN/c-7.3-Awareness.md)                                                           |
| 7.4         | [ Communication                                                               ](27001/EN/c-7.4-Communication.md)                                                       |
| 7.5         | [ Documented information                                                      ](27001/EN/c-7.5-Documented-information.md)                                              |
| 7.5.1       | General ↑                                                                                                                                                                                                                         |
| 7.5.2       | Creating and updating ↑                                                                                                                                                                                                           |
| 7.5.3       | Control of documented information ↑                                                                                                                                                                                               |
| **8**       | **Operation**                                                                                                                                                                                                                     |
| 8.1         | [Operational planning and control                                             ](27001/EN/c-8.1-Operational-planning-and-control.md)                                    |
| 8.2         | [Information security risk assessment                                         ](27001/EN/c-8.2-Information-security-risk-assessment.md)                                |
| 8.3         | [Information security risk treatment                                          ](27001/EN/c-8.3-Information-security-risk-treatment.md)                                 |
| **9**       | **Performance evaluation**                                                                                                                                                                                                        |
| 9.1         | [Monitoring, measurement, analysis and evaluation                             ](27001/EN/c-9.1-Monitoring-measurement-analysis-and-evaluation.md)                      |
| 9.2         | [Internal audit                                                               ](27001/EN/c-9.2-Internal-audit.md)                                                      |
| 9.2.1       | General ↑                                                                                                                                                                                                                         |
| 9.2.2       | Internal audit programme ↑                                                                                                                                                                                                        |
| 9.3         | [Management review                                                            ](27001/EN/c-9.3-Management-review.md)                                                   |
| 9.3.1       | General ↑                                                                                                                                                                                                                         |
| 9.3.2       | Management review inputs ↑                                                                                                                                                                                                        |
| 9.3.3       | Management review results ↑                                                                                                                                                                                                       |
| **10**      | **Improvement**                                                                                                                                                                                                                   |
| 10.1        | [Continual improvement                                                        ](27001/EN/c-10.1-Continual-improvement.md)                                              |
| 10.2        | [Nonconformity and corrective action                                          ](27001/EN/c-10.2-Nonconformity-and-corrective-action.md)                                |
| **Annex A** | **[Information security controls reference                                     ](Index%20to%20the%20original%20texts%20of%20ISO%2027002.md)**                                                                                     |

