ISO 27001 Clause 7.1 Resources: Certification Body Guide

ISO 27001 Clause 7.1 Resources is a management control that requires an organisation to determine and provide the resources needed to establish, implement, maintain, and continually improve the ISMS. It ensures the security function has the necessary people, infrastructure, and budget to operate and meet its security objectives.

ISO 27001:2022 Control Attributes

Implementation Difficulty & Cost

ISO 27002 Control Guidance

The guidance for Clause 7.1 focuses on three distinct resource pillars: personnel, infrastructure, and finance. Organisations must first identify what they need to satisfy their specific risk profile. In my experience, this begins with a gap analysis between your current state and the requirements of the Statement of Applicability. You cannot provide resources if you do not understand the scale of the security debt you are carrying.

Personnel resources include both internal staff and external consultants. I often see firms rely too heavily on a single “Security Hero” who handles everything from firewall rules to policy drafting. ISO 27002 suggests that roles should be clearly defined and that staff must have sufficient time allocated to ISMS duties. If your security officer spends 90% of their day on helpdesk tickets, you have failed to provide adequate resources.

Infrastructure resources refer to the physical and digital tools required to maintain the ISMS. This includes secure office spaces, server rooms, and software platforms like Jira or SharePoint for document control. You must ensure that these tools are not just present but are actively maintained and funded. Finance is the final pillar, providing the budget for training, audits, and technical security controls.

10 Steps to Implement ISO 27001 Clause 7.1

1. Conduct a Resource Gap Analysis

   Compare your current security capabilities against the ISO 27001 requirements. Identify missing skills, tools, or staff hours needed to run the ISMS. Document these findings in a SharePoint list to track your progress toward full resource compliance.

2. Define the ISMS Budget

   Create a dedicated budget line for information security. This should cover software licenses, external audit fees, and emergency incident response funds. I look for a signed budget document from the CFO to prove management commitment.

3. Appoint an ISMS Manager

   Designate a lead person responsible for the ISMS. Ensure their job description explicitly mentions ISO 27001 duties. Use Jira to track their time allocation if they hold multiple roles within the business.

4. Establish an Internal Audit Team

   You need people to check your work. If you are a small team, consider using external consultants or training staff from other departments. This ensures the independence required for successful internal audits later in the cycle.

5. Select Your Document Repository

   Choose a central tool like SharePoint or Confluence to host your ISMS documentation. Avoid scattered local folders or generic cloud drives. A structured repository is a vital infrastructure resource that proves your system is organised.

6. Identify Technical Tooling Needs

   Determine which technical tools are required to enforce security. This might include Microsoft Intune for device management or a SIEM for log monitoring. Ensure these tools have assigned owners and valid support contracts.

7. Map Roles and Responsibilities

   Create a RACI matrix (Responsible, Accountable, Consulted, Informed). Link every ISO 27001 control to a specific person or department. This prevents tasks from being missed due to “ownership ambiguity.”

8. Secure Physical Infrastructure

   Verify that your physical office or data centre meets security needs. This includes lockable racks, CCTV, and backup power. I find that many firms forget to budget for physical maintenance until an auditor points it out.

9. Formalise Outsourced Support

   If you use an MSP, ensure their contract specifies their role in your ISMS. You cannot outsource the accountability for Clause 7.1. You must show that you manage your vendors and provide them with the necessary information to help you.

10. Review Resource Adequacy Annually

    Include a “Resource Review” as a permanent agenda item in your Management Review Meetings. Document the discussion regarding whether the current team and budget are sufficient. This record is the “Gold Standard” for evidence during a Stage 2 audit.

Requirements by Environment

• The Office: Requires physical security resources like access control systems and shredding bins. Budget must cover the maintenance of these hardware items.
• Remote/Home Working: Requires secure connectivity resources like VPNs and multi-factor authentication. You must provide helpdesk resources to support remote staff effectively.
• Cloud Operations: Requires spend on SaaS security features and monitoring tools. Resources are often shifted from physical hardware to cloud licensing and configuration expertise.

The “Checkbox Compliance” Trap

10 Steps to Audit Clause 7.1 (Internal Audit Guide)

1. Review the Org Chart: Verify that the security roles listed in the ISMS actually exist in the HR records.
2. Check Job Descriptions: Ensure that key security staff have ISO 27001 responsibilities written into their contracts.
3. Interview the CISO: Ask them directly if they feel they have enough time and money to do their job.
4. Inspect the Budget: Look for evidence of spend on security training and external audit fees over the last 12 months.
5. Sample Meeting Minutes: Search for discussions regarding resource shortages or requests for new headcount.
6. Verify Tool Ownership: Pick a random security tool (e.g., Antivirus) and ask the owner to demonstrate a recent configuration change.
7. Check Training Records: Ensure budget was allocated for staff to attend ISO 27001 awareness or lead implementer courses.
8. Evaluate External Support: Review the Service Level Agreements (SLAs) for any outsourced security providers.
9. Look for Redundancy: Ask what happens to the ISMS if the primary manager is on leave for a month.
10. Assess Infrastructure Health: Check if server rooms or secure areas have received the maintenance they require.

Clause 7.1 Audit Evidence Checklist

Required Policy Content: A Lead Auditor’s Checklist

While Clause 7.1 doesn’t require a standalone “Resource Policy,” the following elements must be present across your ISMS documentation to satisfy an auditor:

• Resource Allocation Statement: A high-level commitment in the Information Security Policy stating that management will provide necessary resources.
• Role Definitions: Detailed sections in your Roles and Responsibilities document that define the time commitment required for security tasks.
• Training & Competency Clause: A section defining how the organisation identifies resource gaps in staff knowledge and how it funds the training to fill them.
• Infrastructure Maintenance Schedule: A documented plan for how physical and digital security infrastructure is kept in good working order.
• Budgetary Review Cycle: A defined process for how the CISO requests additional funds based on the results of risk assessments.

What to Teach Employees

• Resource Reporting: How to report when a security tool is failing or when they lack the time to follow a security process.
• Tool Usage: How to use the provided infrastructure (VPN, MFA, SharePoint) correctly to protect information.
• Ownership: Understanding who the “Resource Owners” are for different assets and how to contact them for support.

Common Implementation Challenges

Sample Statement of Applicability (SoA) Entry

“Clause 7.1 Resources is Applicable. The organisation provides the necessary personnel, infrastructure, and financial resources to operate the ISMS. Evidence is maintained through signed budget approvals, job descriptions, and Management Review minutes. This control is managed by the CISO and reviewed annually by the Board.”

Changes from ISO 27001:2013

How to Measure Effectiveness (KPIs)

• Budget Variance: The difference between the planned security budget and the actual spend on ISMS improvements.
• Staffing Ratio: The number of dedicated security hours available compared to the number of identified security tasks.
• Infrastructure Uptime: The availability of core ISMS tools (e.g., SharePoint, Jira, SIEM) over a 12-month period.

Related ISO 27001 Controls

• ISO 27001 Annex A 5.1 Policies for Information Security: This control provides the management intent that drives resource allocation. Without a strong policy, you will never secure the budget you need.
• ISO 27001 Annex A 5.9 Inventory of Assets: You cannot provide resources for assets you do not know you have. This control ensures your resource planning is based on a complete asset list.
• ISO 27001 Annex A 8.1 User Endpoint Device Security: Providing the actual hardware (laptops, phones) is a key infrastructure resource requirement of Clause 7.1.

ISO 27001 Clause 7.1 FAQ