--- title: "ISO 27001 Clause 7.1: what auditors check for ISMS resources" canonical: https://www.grcmana.io/vault/iso-27001/clause-7-1-resources published: 2022-12-19 updated: 2026-10-07 author: "Harry West" framework: "ISO 27001" control: "Clause 7.1 Resources" journeyStage: implementation --- # ISO 27001 Clause 7.1: what auditors check for ISMS resources ## Key takeaways Clause 7.1 turns leadership commitment into checkable capacity: named people, protected hours, security-specific budget and live tooling. Auditors trace a risk treatment to its funding, probe interviewees on their real week and grade an ISMS with no identifiable resourcing as major. Record-keeping around resourcing automates well, while the judgement stays with leadership. - **Capacity versus capability** — Clause 7.1 tests whether people, protected hours, budget and tooling exist. Clause 7.2 tests whether those people are skilled, so a skilled lead without protected time still fails Clause 7.1. - **Accepted evidence** — Auditors accept security's own budget lines, risk treatment plans with owners, job descriptions, calendar blocks, live licences, outsourcing contracts and review minutes. No standalone Resource Plan is required. - **Handling a refusal** — Minute the decision, log the residual risk in the risk register and get executive acceptance. A documented refusal is defensible, while a silent one becomes a finding. - **Grading** — An ISMS with no identifiable resourcing grades major. A missing deputy, lapsed subscription or undocumented refusal usually grades minor, but a pattern of goodwill-driven gaps can aggregate to major. Your ISMS lead runs the whole programme on Thursday afternoons and goodwill, and the auditor is about to ask where security's budget line is. ISO 27001 Clause 7.1 is the requirement behind that question. This guide sets out what it demands, how a 25–250 person firm meets it and which evidence auditors accept. It is written for information security managers, heads of compliance and operations directors at UK regulated firms and B2B SaaS scale-ups. You need to prove resourcing without building corporate bloat. ## What does ISO 27001 Clause 7.1 require of your ISMS? Clause 7.1 requires the ISMS to run on real inputs for its whole life, from build through operation to improvement. That means people with actual time, money that is actually committed, and tooling that works. It is where the leadership commitment in Clause 5.1 becomes checkable capacity rather than a statement on paper. In practice, auditors read the clause through four inputs: - **People:** named owners holding defined roles, not a shared inbox. - **Protected time:** hours that sit in a calendar, not "when things are quiet". - **Money:** committed budget that security can point to. - **Tooling:** working, licensed and supported systems. A statement of commitment costs nothing, whereas a protected calendar block and a budget line can be checked. The test applies across the lifecycle, so the hours that built the system must still exist a year into operation. Leadership re-examines adequacy at the Clause 9.3 management review. The clause sets no headcount. A 50-person regulated firm needs a few protected hours a week for the lead, not a department, but it does need something an auditor can see. Sequence matters. Settle resourcing at programme start, because it gates everything else, and expect the documentation to take days rather than weeks. What cannot be rushed is operating history: protected time and funded tooling only count as evidence once they have genuinely been happening. ## How is Clause 7.1 different from Clause 7.2? Clause 7.1 asks whether the people, hours, tools and money exist; Clause 7.2 asks whether the people have the skills. Capacity sits in 7.1, capability in 7.2. Keeping the two apart matters at Stage 1 and Stage 2 audits, because a skilled person with no protected time still leaves a resourcing gap. At Stage 1 the auditor tests readiness on paper, so a missing allocation shows as a documentation gap. At Stage 2 it shows as an operating gap, when interviewees describe their real week. Each clause also draws a different kind of evidence: - **Clause 7.1, capacity:** budget approvals, calendar blocks, licences and outsourcing contracts. - **Clause 7.2, capability:** qualifications, training records and competence assessments. Consider a new ISMS lead with ten years' experience and a full-time delivery job. Clause 7.2 is satisfied and Clause 7.1 is not. The reverse fails too: a protected half-day each week handed to someone who has never run a risk assessment. Mixing the two produces the wrong fix. Sending a time-starved lead on a training course changes nothing, and hiring a specialist does not help if leadership never funded the tooling. Naming which gap you have tells you whether to buy hours or build skills. ## Why does a side-of-desk ISMS fail the audit? A side-of-desk ISMS fails because certification rests on one person's goodwill rather than allocated hours, budget and cover. An auditor who finds no committed budget or protected time concludes that leadership commitment exists on paper only. That judgement colours the whole assessment, not just this clause. In a 25–250 person firm the ISMS lead is often also the IT manager or operations director. When that person answers "I do it when I can", the auditor reads every later gap through that lens. The failure runs on a timeline. The firm certifies on one person's heroics, and the effort fades over the next year. Then the system falls over when that person leaves or gets busy. A security function running on goodwill also cannot sustain the evidence trail that enterprise buyers and regulators expect. The side-of-desk pattern usually shows up in three forms: - **Informal extra duty.** There are no protected hours, no job description change and no cover when the lead is on leave. - **The zero-budget ISMS.** Spend sits inside general IT costs, so nobody can show that the commitment exists. - **Everything in one head.** This is the single point of failure that turns a resignation into a certification event. Each form has the same cause: leadership agreed to the ISMS but never converted that agreement into hours, money or cover. The fix is structural rather than heroic, and the next section sets it out. A resignation letter shouldn't be able to take your certification with it. ## How do you resource an ISMS in a 25–250 person firm? Name four roles: an executive sponsor, an ISMS lead, a management review group and an independent internal auditor. Then give them protected weekly hours, security-specific budget lines and a deliberate in-house or outsourced split. Keep governance inside; buy spiky specialist work such as penetration testing and out-of-hours monitoring under contracts with real service terms. Start with the roles, and mean them: - **Executive sponsor:** approves the budget and formally accepts residual risk. - **ISMS lead:** owns the system day to day and keeps the evidence trail moving. - **Management review group:** meets to judge whether resources remain adequate. - **Internal auditor:** resourced so the role stays independent of the people operating the controls it examines. One person can hold several of these roles, and in a firm this size they will. The line that matters is separation between doing the work and auditing or approving it. The person who runs access reviews should not be the one who audits them. Then make the commitment visible: 1. **Write duties into job descriptions.** Add a realistic weekly allocation, a few hours for the lead, protected in the calendar. 2. **Create security-specific budget lines.** Cover tooling subscriptions, penetration testing, certification and audit fees, and training, rather than burying them in a general IT figure. 3. **Decide the sourcing split deliberately.** Keep governance and day-to-day ownership in-house. Buy internal audit, testing and monitoring from specialists, and name an internal person who oversees each contract. 4. **Build a deputy.** Someone who can run the essentials, backed by cross-training and documentation good enough to survive a resignation. 5. **Aim spend at risk priorities.** The [NCSC Risk Management Guidance](https://www.ncsc.gov.uk/collection/10-steps/risk-management) describes risk management as what keeps resources focussed on the things that matter most to your business. Let your risk assessment decide where the money goes. Small firms are tempted to spread ownership thinly so that nobody feels burdened. "Everyone is responsible for security" reliably means no one is. Give every control and duty a named owner instead, and review the responsibility matrix at each management review. Joiners, leavers and reorganisations quietly invalidate it between audits. A responsibility matrix frozen in time is a list of people who used to own things. | Resource element | What to put in place | Evidence it leaves | | --- | --- | --- | | Named roles | Executive sponsor, ISMS lead, management review group, internal auditor | Org chart, responsibility matrix, job descriptions | | Protected time | Weekly allocation for the lead and control owners | Recurring calendar blocks, timesheets, sprint allocations | | Budget | Security's own lines for tooling, testing, audit fees and training | Budget approvals with security line items | | Tooling | A licensed, supported security stack | Current licences and subscriptions | | Outsourced specialists | Penetration testing, out-of-hours monitoring, optionally internal audit | Contracts with service terms, reports, oversight record | | Continuity | Deputy, cross-training, documentation | Named deputy, handover notes, cover arrangements | | Adequacy review | Resourcing discussed at every management review | Minutes recording the discussion | ## What do UK boards and the FCA expect from security resourcing? The UK Cyber Governance Code of Practice asks boards to gain assurance that resources are allocated effectively to manage agreed cyber risks. FCA SYSC 15A.4 requires in-scope firms to document the people, processes, technology, facilities and information behind each important business service. Neither replaces Clause 7.1, but both make resourcing a board matter. The [UK Cyber Governance Code of Practice](https://www.gov.uk/government/publications/cyber-governance-code-of-practice/cyber-governance-code-of-practice) is written for directors and lists this assurance among its strategy actions, so the board needs records it can inspect. The [FCA Operational Resilience SYSC 15A Handbook](https://handbook.fca.org.uk/handbook/sysc15a) applies to banks, insurers, enhanced-scope SM&CR firms, and payment and e-money institutions, among others. For those firms, the mapping must be good enough to identify vulnerabilities and remedy them. The Code and SYSC 15A both sit outside ISO 27001, so do not cite them to an auditor as Clause 7.1 requirements. They do change the audience for your records. The budget lines, risk treatment plan and review minutes that satisfy the clause also answer a director who asks whether security is properly funded. For a payment or e-money institution in scope of SYSC 15A, the ISMS lead's availability and the outsourced monitoring contract may appear in both the ISMS records and the service mapping. One source of truth beats two spreadsheets that drift apart. ## What happens when leadership refuses a resource request? Minute the decision, record the resulting exposure in the risk register, and get formal executive acceptance of that residual risk. Auditors do not punish honest trade-offs; they punish invisible ones. A documented refusal is defensible, whereas a silent one becomes a nonconformity waiting to happen, because the exposure is unmanaged and unrecorded. The workflow takes four steps: 1. **Minute the decision** in the meeting where it was made, with the request, the reason and who decided. 2. **Log the residual risk** in the risk register, describing the exposure the refusal leaves and who owns it. 3. **Get executive acceptance** from someone with authority over that risk. 4. **Revisit it at management review**, so a refusal made in a lean quarter is tested again when conditions change. Take a declined request for out-of-hours monitoring. The register entry reads "no detection outside working hours", the chief operating officer accepts it, and the review date is set. When the auditor asks what happens to a turned-down spending request, you open that entry. Done this way, a refusal stops being a hole in the ISMS and becomes evidence that leadership weighs trade-offs openly. ## What evidence proves ISO 27001 Clause 7.1 to an auditor? Auditors look for security's own budget lines and a risk treatment plan with resources and owners attached. They also check job descriptions carrying ISMS duties, calendar blocks or timesheets, current licences, outsourcing contracts and Clause 9.3 management review minutes. No separate document called a Resource Plan is required. Collect these artefacts and keep them current: - Budget approvals showing security's own line items, not a generic IT bucket. - The risk treatment plan, with resources and owners attached to each treatment. - Org chart, responsibility matrix and job descriptions carrying ISMS duties. - Recurring calendar blocks, timesheets or sprint allocations showing time is genuinely allocated. - Current licences and subscriptions for the security stack. - Contracts and service terms for outsourced roles, such as an MSP, auditors and testers. - Management review minutes where adequacy was actually discussed. - Risk register entries and executive sign-offs for declined resource requests. The standard names no resourcing artefact, so you build a traceable chain instead. An auditor should be able to pick a risk and follow its treatment to an owner. From the owner, the trail should lead to hours in a calendar and a funded line in the budget. A missing link in that chain is the finding. Tooling is where chains break quietly. Free-tier and trial products doing compliance-critical jobs lack the logging and support an audit leans on, and a lapsed trial reads as a control that was never funded. Live, paid licences with renewal dates on record close that gap. ## What do auditors ask, and how is Clause 7.1 graded? Auditors trace one risk treatment to its funding and people, and check that security tooling has live licences. They also ask interviewees whether their claimed hours match their real week. An ISMS with no identifiable resourcing grades major. A missing deputy, lapsed subscription or undocumented refusal usually grades minor, but a pattern of them can add up to a major. Expect these questions in the room: - "Who worked out what the ISMS needs to run, and where did leadership approve it?" - "Show me where security sits in this person's job description, and how much time they really get." - "How is internal audit resourced so it stays independent of the people running the controls?" - "What happens when a security spending request gets turned down?" - "If your ISMS lead resigned tomorrow, what breaks first?" The interview probe is the fastest way an auditor exposes a paper ISMS. Before the audit, compare what each interviewee will say about their time with what their calendar shows. If the two differ, change the allocation or the calendar, never the story. A major is usually written against leadership commitment as much as against this clause. An absent owner, absent time and absent tooling together say leadership never committed. Minors are the ones you can still fix: appoint the deputy, renew the subscription, minute the refusal. Several of them in one audit tell a different story, because the auditor reads the pattern as well as each finding. ## How can you automate Clause 7.1 record-keeping? Resourcing is a governance judgement, but its record-keeping automates well. Tie control and duty ownership to the HR system so leavers flag orphaned duties. Monitor security-stack licence expiry automatically. Let a declined request create its own risk register entry and route it for executive acceptance. Three mechanisms carry most of the weight: - **Ownership as data.** Each control, duty and deputy arrangement is a record with a named owner. A leaver event lists every record that loses its owner, so reassignment happens during the notice period rather than at audit. - **Stack watch.** Renewal dates for EDR, vulnerability scanning, logging and backup sit on one calendar with alerts ahead of expiry, so the "EDR trial quietly lapsed in March" finding never happens. - **Refusal workflow.** The declined request, the reason, the residual risk and the executive's acceptance form one record, with the review date attached. What stays human is the judgement. The sponsor decides what the ISMS is worth, the ISMS lead judges whether the hours are adequate, and management review tests both. The automation only guarantees that the trail exists when someone asks for it. Automation keeps the records, but it does not supply the hours. Our Fractional CISO service gives a 25–250 person firm senior security capacity it can afford, with the governance roles genuinely filled rather than nominally assigned. Elastic GRC covers lumpy demand such as audit windows, due diligence and incidents without permanent headcount. The payoff is a certification that survives a resignation, and an evidence trail that enterprise buyers can sample without waiting for you to assemble it. ## Frequently asked questions ### How many hours a week should an ISMS lead get under Clause 7.1? The clause names no figure. The test is whether the claimed allocation survives an interview against the lead's real calendar. We would expect a few protected hours a week in steady state for a firm of around 50, rising during implementation and in the weeks before an audit. ### Can we outsource internal audit or penetration testing under Clause 7.1? Yes, and many firms of this size do. Check that the contract names scope, response times and who owns the report, and appoint an internal reviewer for the output. Avoid using the provider that designed your controls to audit them, because that undermines the independence you are paying for. ### How often should Clause 7.1 resource adequacy be reviewed? At every management review, on whatever planned cadence you have set. Bring it forward when headcount, systems or obligations change, for example after an acquisition, a new regulated product or a key resignation. The minutes should record the discussion, not a one-line "resources adequate" tick. ### Does Clause 7.1 require a deputy for the ISMS lead? The clause does not use the word. But a single point of failure is a recognised pitfall, and the "what breaks first" question will find it. The deputy needs to run the essentials: access reviews, risk register upkeep, evidence collection and incident contact. In a small firm the operations director often fills the role, and a good test is having them run one monthly task unaided.