High Level Structure

0 Introduction

ISO 27001:2013
1 Scope

2 Normative
references

3 Terms and
definitions
PLAN DO CHECK ACT
4 Context of the 9 Performance
5 Leadership 6 Planning 7 Support 8 Operation 10 Improvement
organization evaluation

4.1 5.1 6.1 7.1 8.1 9.1 10.1

Understanding the Leadership and Actions to address Resources Operational planning Monitoring, measure- Nonconformity and
organization and its commitment risks and and control ment, analysis and corrective action
context opportunities 7.2 evaluation
5.2 Competence 8.2 10.2
Policy 6.1.1
4.2 Information security 9.2 Continual
General 7.3
Understanding the risk evaluation Internal audit improvement
5.3 6.1.2 Awareness
needs and
Organizational roles, Information security 8.3 9.3
expectations of 7.4
responsibilities and risk evaluation Information security Management review
interested parties Communication
authorities 6.1.3 risk treatment
4.3 Information security 7.5
Determining the risk treatment Documented
scope of the ISMS information
6.2 7.5.1
Information security General
targets and planning
to achieve them 7.5.2
4.4 Creating and
Information security updating
management sys- 7.5.3
tem (ISMS) Control of
documented
information

Annex A (normative): Reference control objectives and controls