• Senior Management must demonstrate leadership and commitment with respect to the ISMS.
• Top Management must  establish,  implement  and   maintain an Information Security Policy and objectives. An information security policy outlines the organization’s stand on information security.

• Top Management shall ensure the responsibilities and authorities for relevant information security roles are assigned, communicated and understood within the organisation.

• The organisation is required to determine the  risks and opportunities that may affect the ISMS and plan actions to address them.
• Additionally it is required to  define  information security risk assessment process to select appropriate information security risk treatment options. Risk treatment options are mitigate, transfer, accept and avoid.
• Determine controls necessary to implement the treatment options. The controls can be designed by the organization or chosen from Annex A of ISO 27001:2022.
• Information Security Objectives must be documented. These objectives should be specific, measurable, realistic and timebound (SMART)

• The organization should provide resources needed for the establishment, implementation, maintenance and continual improvement of the ISMS.
• Determine the necessary competences of persons under the ISMS through education, training and experience.
• Make people aware  of  the  Information  Security Policy, Objectives and how they can contribute to the   effectiveness of the ISMS.
• Determine communications relevant  to the Information Security Management System.
• The organization should maintain documented information required by the Standard and organisation’s Information Security Management System.

The organization should :

• Plan and implement actions to fulfill its risk treatment plan.
• Perform security risk assessments at planned intervals.
• Implement the information security risk treatment plan.

• Determine what is to be monitored and measured
• The Organisation must plan, establish, implement and   maintain an internal audit programme and conduct internal audits at planned intervals.
• Top management must review the ISMS at planned intervals. This is done during management review meetings.

• The organization control nonconformity and implement any corrective actions. A non conformity is a non-fulfillment of a requirement
• A corrective action shall be implemented to ensure the non conformity does not reoccur.

• Annex A of ISO 27001:2022 contains 93 controls that organizations can choose to mitigate identified risks in clause 6 (Planning)        
•  These controls are structured into 4 groups ; Organizational, People, Physical and  Technological

• Organizational controls – These controls are numbered from 5.1 to 5.37. They dictate to pelvel controls or policies to maintain information security. An example of this is Control 5.2 Information security roles and responsibilities which dictates that responsibilities for information security should be allocated to persons in the organization.

• People Controls – Numbered from 6.1 to 6.8.These controls are about the governance of humans in the information security management system. An example is control 6.3 Information Security awareness, training and education.

• Physical Controls –  Numbered from 7.1 to 7.14. They focus on physical security of the information assets. An example is 7.2 Physical entry which outlines a procedure to control physical entry to facilities and offices.

• Technological controls – These 34 controls focus on using technology to protect information assets. Example is control 8.7 Malware Protection which outlines measures for preventing, detecting and eliminating malware.