ISO 27001 Requirements: Clauses 4-10 Explained | Osto<\/title>\n<meta name=\"description\" content=\"ISO 27001 requirements explained: the mandatory Clauses 4 to 10 that define the ISMS, what each asks for, and why they matter more than Annex A controls.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">ISO 27001 requirements explained: the mandatory management clauses, 4 to 10, that define the ISMS and decide whether you pass, in plain language for founders.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>9 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>Most ISO 27001 guides obsess over the 93 Annex A controls, but those are selectable. The real, mandatory requirements are Clauses 4 to 10, which define the ISMS itself: context, leadership, planning, support, operation, evaluation, and improvement.<\/p>\n <p>You cannot exclude these. Get the clauses right and the controls fall into place; skip them and no amount of tooling will pass the audit.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#why\">Why the clauses matter most<\/a><\/li>\n <li><a href=\"#map\">The clauses at a glance<\/a><\/li>\n <li><a href=\"#each\">What each clause asks for<\/a><\/li>\n <li><a href=\"#loop\">The improvement loop<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"why\">ISO 27001 requirements: why the clauses matter more than the controls<\/h2>\n <p>Here is the distinction that trips up most first-time teams. ISO 27001 has two parts. <a href=\"https:\/\/www.osto.one\/resources\/glossary\/annex-a-controls\/\">Annex A<\/a> is a catalogue of 93 controls you select from based on risk. Clauses 4 to 10 are the mandatory management-system requirements, and they are not optional. An auditor can accept that a given Annex A control does not apply to you. An auditor will never accept that you skipped a clause.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The core point<\/div>The certificate is awarded for running a working Information Security Management System, and the clauses are what define that system. The controls are how the system does its job; the clauses are the system itself.<\/div>\n\n <h2 class=\"sec\" id=\"map\">The clauses at a glance<\/h2>\n <p>The seven mandatory clauses form a cycle. They set up the system, run it, measure it, and improve it, then repeat.<\/p>\n\n <div style=\"background:linear-gradient(180deg,#fbfcff,#f4f6ff);border:1px solid #e3e6f5;border-radius:18px;padding:28px 30px;margin:28px 0;box-shadow:0 8px 30px rgba(28,38,122,.07)\">\n <div style=\"font-size:11.5px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;color:#3a46c0;margin-bottom:6px\">The mandatory clauses<\/div>\n <div style=\"font-size:19px;font-weight:800;color:#0e1330;margin-bottom:6px\">Clauses 4 to 10: what the ISMS must contain<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:22px\">Annex A controls are selectable. These seven clauses are not, they are required for every certification.<\/div>\n <svg viewBox=\"0 0 700 250\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"ISO 27001 mandatory clauses 4 to 10\">\n <g font-family=\"Inter,Arial,sans-serif\">\n <defs><marker id=\"ac\" markerWidth=\"9\" markerHeight=\"9\" refX=\"6\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L7 4 L0 8 Z\" fill=\"#b9bfe0\"\/><\/marker><\/defs>\n \n <g font-size=\"12.5\" font-weight=\"700\">\n <g><rect x=\"8\" y=\"12\" width=\"150\" height=\"60\" rx=\"12\" fill=\"#e6f7f4\" stroke=\"#00c2a8\" stroke-width=\"1.5\"\/><text x=\"83\" y=\"36\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"12\" font-weight=\"800\">4. Context<\/text><text x=\"83\" y=\"55\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">scope + stakeholders<\/text><\/g>\n <g><rect x=\"183\" y=\"12\" width=\"150\" height=\"60\" rx=\"12\" fill=\"#eef0ff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><text x=\"258\" y=\"36\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"12\" font-weight=\"800\">5. Leadership<\/text><text x=\"258\" y=\"55\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">top-level ownership<\/text><\/g>\n <g><rect x=\"358\" y=\"12\" width=\"150\" height=\"60\" rx=\"12\" fill=\"#f1f0ff\" stroke=\"#9d97ff\" stroke-width=\"1.5\"\/><text x=\"433\" y=\"36\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"12\" font-weight=\"800\">6. Planning<\/text><text x=\"433\" y=\"55\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">risk + objectives<\/text><\/g>\n <g><rect x=\"533\" y=\"12\" width=\"150\" height=\"60\" rx=\"12\" fill=\"#e6f7f4\" stroke=\"#00c2a8\" stroke-width=\"1.5\"\/><text x=\"608\" y=\"36\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"12\" font-weight=\"800\">7. Support<\/text><text x=\"608\" y=\"55\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">people + resources<\/text><\/g>\n <g><rect x=\"533\" y=\"105\" width=\"150\" height=\"60\" rx=\"12\" fill=\"#eef0ff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><text x=\"608\" y=\"129\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"12\" font-weight=\"800\">8. Operation<\/text><text x=\"608\" y=\"148\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">run the controls<\/text><\/g>\n <g><rect x=\"358\" y=\"105\" width=\"150\" height=\"60\" rx=\"12\" fill=\"#f1f0ff\" stroke=\"#9d97ff\" stroke-width=\"1.5\"\/><text x=\"433\" y=\"129\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"12\" font-weight=\"800\">9. Evaluation<\/text><text x=\"433\" y=\"148\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">audit + review<\/text><\/g>\n <g><rect x=\"183\" y=\"105\" width=\"150\" height=\"60\" rx=\"12\" fill=\"#1c267a\"\/><text x=\"258\" y=\"129\" text-anchor=\"middle\" fill=\"#fff\" font-size=\"12\" font-weight=\"800\">10. Improvement<\/text><text x=\"258\" y=\"148\" text-anchor=\"middle\" fill=\"#c6ccf0\" font-size=\"10.5\">fix + get better<\/text><\/g>\n <\/g>\n \n <line x1=\"158\" y1=\"42\" x2=\"181\" y2=\"42\" stroke=\"#b9bfe0\" stroke-width=\"2\" marker-end=\"url(#ac)\"\/>\n <line x1=\"333\" y1=\"42\" x2=\"356\" y2=\"42\" stroke=\"#b9bfe0\" stroke-width=\"2\" marker-end=\"url(#ac)\"\/>\n <line x1=\"508\" y1=\"42\" x2=\"531\" y2=\"42\" stroke=\"#b9bfe0\" stroke-width=\"2\" marker-end=\"url(#ac)\"\/>\n <path d=\"M608 72 L608 103\" stroke=\"#b9bfe0\" stroke-width=\"2\" marker-end=\"url(#ac)\"\/>\n <line x1=\"531\" y1=\"135\" x2=\"510\" y2=\"135\" stroke=\"#b9bfe0\" stroke-width=\"2\" marker-end=\"url(#ac)\"\/>\n <line x1=\"356\" y1=\"135\" x2=\"335\" y2=\"135\" stroke=\"#b9bfe0\" stroke-width=\"2\" marker-end=\"url(#ac)\"\/>\n <text x=\"350\" y=\"210\" text-anchor=\"middle\" font-family=\"Inter,Arial\" font-size=\"12.5\" font-weight=\"700\" fill=\"#3a46c0\">Clauses 6, 9 and 10 form the continual-improvement loop that keeps the ISMS alive<\/text>\n <\/g>\n <\/svg>\n<\/div>\n\n <h2 class=\"sec\" id=\"each\">What each clause actually asks for<\/h2>\n <p>In plain terms, here is what an auditor is looking for under each clause.<\/p>\n\n <div class=\"checkgrid\">\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">4<\/span><h4>Context<\/h4><\/div><ul><li>Define the ISMS scope<\/li><li>Identify interested parties and their needs<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">5<\/span><h4>Leadership<\/h4><\/div><ul><li>Demonstrate genuine top-level ownership<\/li><li>Set a security policy and assign roles<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">6<\/span><h4>Planning<\/h4><\/div><ul><li>Run a <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-assessment\/\">risk assessment<\/a> and treatment plan<\/li><li>Set measurable security objectives<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">7<\/span><h4>Support<\/h4><\/div><ul><li>Provide resources, competence, awareness<\/li><li>Control documented information<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">8<\/span><h4>Operation<\/h4><\/div><ul><li>Actually run the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-treatment-plan\/\">risk treatment<\/a><\/li><li>Operate the controls day to day<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">9<\/span><h4>Evaluation<\/h4><\/div><ul><li>Monitor, run an internal audit<\/li><li>Hold a management review<\/li><\/ul><\/div>\n <\/div>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Clause 10: Improvement<\/div>The final clause requires you to handle nonconformities with corrective action and to continually improve the ISMS. Auditors look for evidence that when something went wrong, you caught it, fixed the root cause, and adjusted the system, not just patched the symptom.<\/div>\n\n <h2 class=\"sec\" id=\"loop\">The improvement loop that keeps the ISMS alive<\/h2>\n <p>Clauses 6, 9, and 10 are not one-time steps. Together they form a loop: plan based on risk, evaluate how it is working, improve, then plan again. This is what auditors mean when they say ISO 27001 is a living system rather than a project with an end date. A startup that treats certification as a one-off scramble will struggle at the first surveillance audit; one that runs the loop stays ready.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path through the clauses<\/h2>\n <p>The clauses are about management and process, but several depend directly on real security operating underneath. Clause 6 needs a genuine risk assessment, Clause 8 needs controls that actually run, and Clause 9 needs monitoring and evidence to evaluate. When those live across scattered tools, satisfying the clauses becomes a coordination burden.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. The controls Clause 8 expects run on one platform, the monitoring and evidence Clause 9 needs come from the same modules, and that live posture maps to ISO 27001 automatically. The management clauses stay your responsibility, but the security they rest on is real and already operating, which is why lean teams treat Osto as the default foundation for a certifiable ISMS.<\/div>\n\n <div class=\"callout\">\n <h3>Build an ISMS that stands up to every clause.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Run the controls the clauses depend on, with monitoring and evidence in one place, and map it all to ISO 27001 automatically. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What are the ISO 27001 requirements?<\/summary><p>The mandatory requirements are Clauses 4 to 10: context of the organisation, leadership, planning, support, operation, performance evaluation, and improvement. Together they define the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/isms\/\">Information Security Management System<\/a>. The Annex A controls are selected separately based on your risk assessment.<\/p><\/details>\n <details><summary>Are the ISO 27001 clauses mandatory?<\/summary><p>Yes. Unlike Annex A controls, which you select based on risk, Clauses 4 to 10 are required for every certification. You cannot exclude a clause; an auditor will check each one.<\/p><\/details>\n <details><summary>What is the difference between the clauses and Annex A?<\/summary><p>Clauses 4 to 10 are the mandatory management-system requirements that define the ISMS. Annex A is a menu of 93 controls you select from based on your risks. The clauses are the system; the controls are how the system protects information.<\/p><\/details>\n <details><summary>Which clause do startups most often get wrong?<\/summary><p>Clause 5, leadership. Auditors look for genuine top-level ownership, not a policy signed and forgotten. In a small company this is straightforward to demonstrate, but it has to be real involvement, not a formality.<\/p><\/details>\n <details><summary>What is the continual improvement loop?<\/summary><p>Clauses 6, 9, and 10 form a cycle: plan based on risk, evaluate through monitoring and internal audit, then improve by fixing nonconformities at the root. It is what makes ISO 27001 a living system rather than a one-time project.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>ISO 27001 Requirements: Clauses 4-10 Explained | Osto ISO 27001 requirements explained: the mandatory management clauses, 4 to 10, that\u2026<\/p>\n","protected":false},"author":8,"featured_media":758,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[290],"class_list":["post-757","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-iso-requirements"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/757","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=757"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/757\/revisions"}],"predecessor-version":[{"id":759,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/757\/revisions\/759"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/758"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=757"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=757"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=757"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":757,"date":"2026-08-16T18:11:03","date_gmt":"2026-08-16T18:11:03","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=757"},"modified":"2026-08-16T18:11:03","modified_gmt":"2026-08-16T18:11:03","slug":"iso-27001-requirements-clauses","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/iso-27001-requirements-clauses\/","title":{"rendered":"ISO 27001 Requirements: Clauses 4-10 Explained"},"content":{"rendered":"\n\n\n\n\n\nISO 27001 Requirements: Clauses 4-10 Explained | Osto<\/title>\n<meta name=\"description\" content=\"ISO 27001 requirements explained: the mandatory Clauses 4 to 10 that define the ISMS, what each asks for, and why they matter more than Annex A controls.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">ISO 27001 requirements explained: the mandatory management clauses, 4 to 10, that define the ISMS and decide whether you pass, in plain language for founders.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>9 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>Most ISO 27001 guides obsess over the 93 Annex A controls, but those are selectable. The real, mandatory requirements are Clauses 4 to 10, which define the ISMS itself: context, leadership, planning, support, operation, evaluation, and improvement.<\/p>\n <p>You cannot exclude these. Get the clauses right and the controls fall into place; skip them and no amount of tooling will pass the audit.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#why\">Why the clauses matter most<\/a><\/li>\n <li><a href=\"#map\">The clauses at a glance<\/a><\/li>\n <li><a href=\"#each\">What each clause asks for<\/a><\/li>\n <li><a href=\"#loop\">The improvement loop<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"why\">ISO 27001 requirements: why the clauses matter more than the controls<\/h2>\n <p>Here is the distinction that trips up most first-time teams. ISO 27001 has two parts. <a href=\"https:\/\/www.osto.one\/resources\/glossary\/annex-a-controls\/\">Annex A<\/a> is a catalogue of 93 controls you select from based on risk. Clauses 4 to 10 are the mandatory management-system requirements, and they are not optional. An auditor can accept that a given Annex A control does not apply to you. An auditor will never accept that you skipped a clause.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The core point<\/div>The certificate is awarded for running a working Information Security Management System, and the clauses are what define that system. The controls are how the system does its job; the clauses are the system itself.<\/div>\n\n <h2 class=\"sec\" id=\"map\">The clauses at a glance<\/h2>\n <p>The seven mandatory clauses form a cycle. They set up the system, run it, measure it, and improve it, then repeat.<\/p>\n\n <div style=\"background:linear-gradient(180deg,#fbfcff,#f4f6ff);border:1px solid #e3e6f5;border-radius:18px;padding:28px 30px;margin:28px 0;box-shadow:0 8px 30px rgba(28,38,122,.07)\">\n <div style=\"font-size:11.5px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;color:#3a46c0;margin-bottom:6px\">The mandatory clauses<\/div>\n <div style=\"font-size:19px;font-weight:800;color:#0e1330;margin-bottom:6px\">Clauses 4 to 10: what the ISMS must contain<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:22px\">Annex A controls are selectable. These seven clauses are not, they are required for every certification.<\/div>\n <svg viewBox=\"0 0 700 250\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"ISO 27001 mandatory clauses 4 to 10\">\n <g font-family=\"Inter,Arial,sans-serif\">\n <defs><marker id=\"ac\" markerWidth=\"9\" markerHeight=\"9\" refX=\"6\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L7 4 L0 8 Z\" fill=\"#b9bfe0\"\/><\/marker><\/defs>\n \n <g font-size=\"12.5\" font-weight=\"700\">\n <g><rect x=\"8\" y=\"12\" width=\"150\" height=\"60\" rx=\"12\" fill=\"#e6f7f4\" stroke=\"#00c2a8\" stroke-width=\"1.5\"\/><text x=\"83\" y=\"36\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"12\" font-weight=\"800\">4. Context<\/text><text x=\"83\" y=\"55\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">scope + stakeholders<\/text><\/g>\n <g><rect x=\"183\" y=\"12\" width=\"150\" height=\"60\" rx=\"12\" fill=\"#eef0ff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><text x=\"258\" y=\"36\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"12\" font-weight=\"800\">5. Leadership<\/text><text x=\"258\" y=\"55\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">top-level ownership<\/text><\/g>\n <g><rect x=\"358\" y=\"12\" width=\"150\" height=\"60\" rx=\"12\" fill=\"#f1f0ff\" stroke=\"#9d97ff\" stroke-width=\"1.5\"\/><text x=\"433\" y=\"36\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"12\" font-weight=\"800\">6. Planning<\/text><text x=\"433\" y=\"55\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">risk + objectives<\/text><\/g>\n <g><rect x=\"533\" y=\"12\" width=\"150\" height=\"60\" rx=\"12\" fill=\"#e6f7f4\" stroke=\"#00c2a8\" stroke-width=\"1.5\"\/><text x=\"608\" y=\"36\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"12\" font-weight=\"800\">7. Support<\/text><text x=\"608\" y=\"55\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">people + resources<\/text><\/g>\n <g><rect x=\"533\" y=\"105\" width=\"150\" height=\"60\" rx=\"12\" fill=\"#eef0ff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><text x=\"608\" y=\"129\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"12\" font-weight=\"800\">8. Operation<\/text><text x=\"608\" y=\"148\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">run the controls<\/text><\/g>\n <g><rect x=\"358\" y=\"105\" width=\"150\" height=\"60\" rx=\"12\" fill=\"#f1f0ff\" stroke=\"#9d97ff\" stroke-width=\"1.5\"\/><text x=\"433\" y=\"129\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"12\" font-weight=\"800\">9. Evaluation<\/text><text x=\"433\" y=\"148\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">audit + review<\/text><\/g>\n <g><rect x=\"183\" y=\"105\" width=\"150\" height=\"60\" rx=\"12\" fill=\"#1c267a\"\/><text x=\"258\" y=\"129\" text-anchor=\"middle\" fill=\"#fff\" font-size=\"12\" font-weight=\"800\">10. Improvement<\/text><text x=\"258\" y=\"148\" text-anchor=\"middle\" fill=\"#c6ccf0\" font-size=\"10.5\">fix + get better<\/text><\/g>\n <\/g>\n \n <line x1=\"158\" y1=\"42\" x2=\"181\" y2=\"42\" stroke=\"#b9bfe0\" stroke-width=\"2\" marker-end=\"url(#ac)\"\/>\n <line x1=\"333\" y1=\"42\" x2=\"356\" y2=\"42\" stroke=\"#b9bfe0\" stroke-width=\"2\" marker-end=\"url(#ac)\"\/>\n <line x1=\"508\" y1=\"42\" x2=\"531\" y2=\"42\" stroke=\"#b9bfe0\" stroke-width=\"2\" marker-end=\"url(#ac)\"\/>\n <path d=\"M608 72 L608 103\" stroke=\"#b9bfe0\" stroke-width=\"2\" marker-end=\"url(#ac)\"\/>\n <line x1=\"531\" y1=\"135\" x2=\"510\" y2=\"135\" stroke=\"#b9bfe0\" stroke-width=\"2\" marker-end=\"url(#ac)\"\/>\n <line x1=\"356\" y1=\"135\" x2=\"335\" y2=\"135\" stroke=\"#b9bfe0\" stroke-width=\"2\" marker-end=\"url(#ac)\"\/>\n <text x=\"350\" y=\"210\" text-anchor=\"middle\" font-family=\"Inter,Arial\" font-size=\"12.5\" font-weight=\"700\" fill=\"#3a46c0\">Clauses 6, 9 and 10 form the continual-improvement loop that keeps the ISMS alive<\/text>\n <\/g>\n <\/svg>\n<\/div>\n\n <h2 class=\"sec\" id=\"each\">What each clause actually asks for<\/h2>\n <p>In plain terms, here is what an auditor is looking for under each clause.<\/p>\n\n <div class=\"checkgrid\">\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">4<\/span><h4>Context<\/h4><\/div><ul><li>Define the ISMS scope<\/li><li>Identify interested parties and their needs<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">5<\/span><h4>Leadership<\/h4><\/div><ul><li>Demonstrate genuine top-level ownership<\/li><li>Set a security policy and assign roles<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">6<\/span><h4>Planning<\/h4><\/div><ul><li>Run a <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-assessment\/\">risk assessment<\/a> and treatment plan<\/li><li>Set measurable security objectives<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">7<\/span><h4>Support<\/h4><\/div><ul><li>Provide resources, competence, awareness<\/li><li>Control documented information<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">8<\/span><h4>Operation<\/h4><\/div><ul><li>Actually run the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-treatment-plan\/\">risk treatment<\/a><\/li><li>Operate the controls day to day<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">9<\/span><h4>Evaluation<\/h4><\/div><ul><li>Monitor, run an internal audit<\/li><li>Hold a management review<\/li><\/ul><\/div>\n <\/div>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Clause 10: Improvement<\/div>The final clause requires you to handle nonconformities with corrective action and to continually improve the ISMS. Auditors look for evidence that when something went wrong, you caught it, fixed the root cause, and adjusted the system, not just patched the symptom.<\/div>\n\n <h2 class=\"sec\" id=\"loop\">The improvement loop that keeps the ISMS alive<\/h2>\n <p>Clauses 6, 9, and 10 are not one-time steps. Together they form a loop: plan based on risk, evaluate how it is working, improve, then plan again. This is what auditors mean when they say ISO 27001 is a living system rather than a project with an end date. A startup that treats certification as a one-off scramble will struggle at the first surveillance audit; one that runs the loop stays ready.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path through the clauses<\/h2>\n <p>The clauses are about management and process, but several depend directly on real security operating underneath. Clause 6 needs a genuine risk assessment, Clause 8 needs controls that actually run, and Clause 9 needs monitoring and evidence to evaluate. When those live across scattered tools, satisfying the clauses becomes a coordination burden.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. The controls Clause 8 expects run on one platform, the monitoring and evidence Clause 9 needs come from the same modules, and that live posture maps to ISO 27001 automatically. The management clauses stay your responsibility, but the security they rest on is real and already operating, which is why lean teams treat Osto as the default foundation for a certifiable ISMS.<\/div>\n\n <div class=\"callout\">\n <h3>Build an ISMS that stands up to every clause.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Run the controls the clauses depend on, with monitoring and evidence in one place, and map it all to ISO 27001 automatically. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What are the ISO 27001 requirements?<\/summary><p>The mandatory requirements are Clauses 4 to 10: context of the organisation, leadership, planning, support, operation, performance evaluation, and improvement. Together they define the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/isms\/\">Information Security Management System<\/a>. The Annex A controls are selected separately based on your risk assessment.<\/p><\/details>\n <details><summary>Are the ISO 27001 clauses mandatory?<\/summary><p>Yes. Unlike Annex A controls, which you select based on risk, Clauses 4 to 10 are required for every certification. You cannot exclude a clause; an auditor will check each one.<\/p><\/details>\n <details><summary>What is the difference between the clauses and Annex A?<\/summary><p>Clauses 4 to 10 are the mandatory management-system requirements that define the ISMS. Annex A is a menu of 93 controls you select from based on your risks. The clauses are the system; the controls are how the system protects information.<\/p><\/details>\n <details><summary>Which clause do startups most often get wrong?<\/summary><p>Clause 5, leadership. Auditors look for genuine top-level ownership, not a policy signed and forgotten. In a small company this is straightforward to demonstrate, but it has to be real involvement, not a formality.<\/p><\/details>\n <details><summary>What is the continual improvement loop?<\/summary><p>Clauses 6, 9, and 10 form a cycle: plan based on risk, evaluate through monitoring and internal audit, then improve by fixing nonconformities at the root. It is what makes ISO 27001 a living system rather than a one-time project.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>ISO 27001 Requirements: Clauses 4-10 Explained | Osto ISO 27001 requirements explained: the mandatory management clauses, 4 to 10, that\u2026<\/p>\n","protected":false},"author":8,"featured_media":758,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[290],"class_list":["post-757","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-iso-requirements"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/757","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=757"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/757\/revisions"}],"predecessor-version":[{"id":759,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/757\/revisions\/759"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/758"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=757"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=757"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=757"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}