Clause 7.4 of ISO/IEC 27001 requires you to establish, implement, and maintain a documented communication process for information relevant to your ISMS. In practice, that means a short written plan naming what gets communicated, when, to whom, who sends it, and through which channel. The fastest path to compliance is to formalize that plan now and tie it to your existing ISMS scope and role assignments.
TL;DR:
- Cover policy updates, objectives, risks, control changes, incidents, and security relevant supplier or system changes, using fixed schedules or event triggers as appropriate.
- Assign communication ownership to roles rather than individuals, and define escalation to leadership for confirmed incidents or regulatory exposure in advance.
- A small organization can draft, pilot, and launch a working plan in two to four weeks, while multi site teams need longer pilots.
- Keep a signed, versioned plan, timestamped distribution records, recipient lists, approval minutes, and training records; auditors also expect evidence for each communication category.
- Tailor messages by audience, restrict sensitive details to logged channels, and use separate templates for staff, leadership, and external stakeholders.
Table of Contents
- What Clause 7.4 Actually Requires
- The 5 W’s of Communication: What, When, With Whom, Who, How
- How to Implement Clause 7.4: Step-by-Step Playbook
- Ready-to-Use Communication Plan Template
- What Auditors Check for Clause 7.4
- Keeping the Plan Current
- Sizing the Work With Benchmarks and Planning Tools
- What Compliance Officers Should Prioritize First
- Plan Faster With an ISO 27001 Estimation Tool
- FAQ
- Sources
What Clause 7.4 Actually Requires
Clause 7.4 sits inside the “Support” section of ISO/IEC 27001, alongside resources, competence, and documented information. The standard’s intent is straightforward: an information security management system only works if the people running it, and the people affected by it, actually know what is happening. A risk treatment plan nobody reads protects nothing.
The standard itself frames communication as a support process that keeps the ISMS functioning as it is established, implemented, maintained, and improved. That means communication is not a one-time announcement when you launch your ISMS. It is a recurring activity tied to the system’s full lifecycle.
Items typically covered under Clause 7.4 include:
- The information security policy and any updates to it
- Security objectives and progress toward them
- Identified risks, chosen controls, and changes to either
- Security incidents and their resolution status
- Changes to systems, suppliers, or processes that carry security implications
Communication shows up at every stage of the ISMS lifecycle: during onboarding, when new staff need to understand their obligations; during incident response, when speed and accuracy both matter; and during continual improvement, when management review findings or audit outcomes need to reach the right people before the next cycle begins.
The 5 W’s of Communication: What, When, With Whom, Who, How
Clause 7.4 breaks down cleanly into five practical questions. Answering each one in writing is most of the work of building a compliant plan.
- What to communicate: policy statements, security objectives, identified risks, control changes, incident summaries, and audit outcomes. Each item should map to a specific ISMS document or process, so a policy update maps to staff awareness training and a risk treatment change maps to the affected system owners.
- When to communicate: some items run on a fixed cadence (quarterly policy reminders, annual objective reviews), while others are trigger-based (a confirmed incident, a new supplier onboarding, a statutory deadline tied to a breach notification law).
- With whom to communicate: internally, this covers employees, department leads, and the ISMS team; externally, it covers customers, regulators, auditors, and suppliers. A supplier contract change, for instance, often needs a notification to the supplier’s security contact and an internal note to the risk owner, a pattern we cover in more detail in our guide to supplier management under ISO 27001.
- Who communicates: ownership should be role-based, not person-based, so the plan survives staff turnover. A typical structure assigns the information security manager as the primary sender for policy and risk communications, with an escalation path to leadership for anything involving a confirmed incident or regulatory exposure.
- How to communicate: channel and format depend on sensitivity and audience. A staff-wide policy reminder might go out by email with a short summary. An incident notification to a regulator needs a formal, dated letter or secure portal submission. Classified or sensitive details never go into a broadcast channel; they move through restricted distribution lists with access logging.
Pro Tip: Keep one message template per audience type (staff, leadership, external party) rather than drafting from scratch each time; it cuts response time during incidents and keeps wording consistent for auditors.
ISO’s own stakeholder engagement guidance recommends mapping stakeholders deliberately, using multiple channels suited to each group, and reviewing the stakeholder list regularly so it stays current as the organization changes. That same discipline, applied to Clause 7.4, is what turns a vague intention to “communicate” into an auditable process.
How to Implement Clause 7.4: Step-by-Step Playbook
Building a communication plan that survives an audit follows a predictable sequence. Treat it as a short project with owners and deadlines, not an afterthought bolted onto your ISMS documentation.
- Draft the plan. Define scope (which ISMS processes it covers), map your audiences, state your objectives, and pull together templates for each message type. Keep the first draft short: a table with the 5 W’s answered for each communication type is enough to start.
- Assign ownership and sign-off. Name a single accountable owner, usually the information security manager, and a responsible party for each communication category. A simple RACI works well here: the ISMS owner is Accountable, department leads are Responsible for distributing within their teams, leadership is Consulted on anything regulatory, and all staff are Informed.
- Pilot before you roll out. Run the plan through one onboarding cycle and one simulated incident before treating it as final. This surfaces gaps, such as a missing escalation contact or a channel that staff ignore.
- Roll out formally. Fold the plan into onboarding materials, policy training, and your incident response procedure so new staff and existing teams see it as part of normal operations, not a separate compliance exercise.
- Document evidence and version control. Every communication needs a timestamp, a record of who received it, and proof of distribution. Version your plan document itself, since auditors check that the current version matches what was actually followed.
Resourcing this work is usually lighter than teams expect. A small organization can draft, pilot, and roll out a working plan within two to four weeks, with the bulk of effort falling on the information security manager and one or two department leads who need to validate audience lists. Larger, multi-site organizations should budget more calendar time for the pilot stage, since testing across regions and departments takes longer to coordinate.
Documentation needs:
- A signed, versioned plan document
- Updated distribution and mailing lists
- Meeting minutes where the plan was reviewed or approved
- Training records confirming staff received and understood key messages
Ready-to-Use Communication Plan Template
A compact template keeps the plan auditable without turning it into a bureaucratic burden. The core fields map directly to what Clause 7.4 asks for and what an auditor will look for later.
- Purpose: why this communication exists (policy rollout, incident update, audit outcome)
- Scope: which ISMS process or document it relates to
- Audience: internal roles or external parties affected
- Channel: email, intranet post, formal letter, secure portal
- Cadence or trigger: fixed schedule or triggering event
- Responsible person: named role, not a named individual
- Escalation path: who gets notified if the message requires urgent follow-up
- Evidence record: where proof of distribution and acknowledgment is stored
Four scenarios cover most of what organizations need in year one: launching a new ISMS policy to all staff, notifying affected parties of a confirmed security incident, informing a supplier of a change in security requirements, and communicating audit findings to leadership and relevant teams. For incident notifications specifically, structured status update formats and a defined cadence reduce confusion during a live event, a pattern well documented in status page communication templates for incidents used widely in technical operations teams.
Message templates should differ by audience: leadership gets a short summary with business impact and next steps; staff get plain-language instructions tied to their daily work; external stakeholders get a formal notice with dates, scope, and a named contact for follow-up questions.
What Auditors Check for Clause 7.4
Auditors look for proof that the plan exists, has been followed, and produced evidence someone can point to. A plan that only lives in someone’s head does not pass.
Expect auditors to check for:
- A signed, current version of the communication plan
- Distribution records such as mailing lists or portal access logs
- Meeting minutes showing the plan was reviewed or discussed
- Training completion records tied to policy or awareness communications
- Timestamped incident communications showing what was sent and when
A short pre-audit checklist helps: confirm the plan is current, confirm every audience on your list still exists in its stated form, confirm at least one communication record exists for each category in the plan, and confirm training records are complete for the current cycle. Our certification checklist walks through the broader set of steps auditors expect across the full ISMS, with Clause 7.4 evidence as one piece of that larger picture.
Keeping the Plan Current
A communication plan that never gets reviewed drifts out of sync with the organization it serves. Review it on a fixed cadence, typically alongside your management review, and assign the ISMS owner responsibility for catching outdated audience lists or stale channels.
- Track simple indicators: message delivery rate, read or acknowledgment confirmations, and staff awareness scores from training quizzes
- Feed any gaps straight into your corrective action process so a missed notification becomes a tracked improvement, not a repeated mistake
Pro Tip: Tie your communication plan review to the same meeting as your management review; it keeps both processes synchronized and gives auditors one clear trail to follow.
Sizing the Work With Benchmarks and Planning Tools
Estimating how much effort Clause 7.4 implementation needs is easier with a structured tool than with guesswork. A cost and effort calculator built for ISO 27001 projects can turn your organization’s size, industry, and current maturity into a realistic timeline and resourcing estimate.
- Model reference comparisons help you check whether your planned communication cadence and staffing are in line with what similar organizations budget
- A maturity assessment across the four Annex A control themes shows where communication-related gaps sit relative to the rest of your ISMS
- Exportable Gantt timelines and readiness check results give you dated artifacts you can attach directly to your Clause 7.4 evidence file
Our cost model methodology explains how these estimates are built and versioned, so the numbers behind your plan stay traceable if an auditor asks where they came from.
What Compliance Officers Should Prioritize First
Role ownership matters more than polish. A plan with clear, auditable records and short message templates per audience beats a long document nobody follows.
Resist the urge to send everything to everyone. Tailor each message to its audience and keep a record of who received what. In the first 90 days, focus on drafting the template, naming owners, and running one pilot incident notification: that alone covers most of what an early audit will ask to see.
— Martin
Plan Faster With an ISO 27001 Estimation Tool
Drafting a communication plan is faster when you already know how much time and staff the rest of your ISMS implementation needs. We built the ISO 27001 Cost Calculator to give real-time, organization-specific estimates based on your size, industry, and current security maturity, with editable assumptions you can check line by line rather than take on faith.
- Some ISO 27001 cost calculators generate Gantt timelines and maturity assessments across ISO domains that can serve as planning evidence for Clause 7.4 and the rest of your ISMS
- Many tools let you save and compare multiple estimates as your scope changes, sometimes without requiring signup for the first calculation
Our free 2-minute readiness check gives you a starting estimate you can validate against your own assumptions before committing resources. It is a quick way to size the communication workstream alongside everything else Clause 7.4 and the broader ISMS require. Start with the free readiness check or review our full cost calculator to see where your plan fits into the bigger implementation timeline.
FAQ
What should be included in a communication plan?
A Clause 7.4 communication plan should name what gets communicated, when, to whom, who sends it, and which channel carries it. Add fields for escalation paths and evidence records so every message has a traceable owner and a stored record of distribution.
Can you explain ISO 27001 in a simple way?
ISO/IEC 27001 is an international standard that sets requirements for building and running an information security management system, a structured set of policies and controls that protect an organization’s data. It covers everything from risk assessment to staff communication, with the goal of keeping information confidential, accurate, and available when needed, as defined by ISO.
Is the ISO 27001 exam difficult?
Difficulty depends on which certification you mean: personal certifications like Lead Implementer or Lead Auditor require study and exam preparation, while organizational ISO 27001 certification is an external audit of your ISMS rather than a test taken by an individual. Preparation time varies by prior experience with information security management.
What is the ISO 27001 checklist?
An ISO 27001 checklist is a step-by-step list of the activities an organization completes to build, implement, and certify its ISMS, covering scope definition, risk assessment, control selection, documentation, and the audit stages. Our certification checklist walks through the full sequence, including where communication evidence fits into the broader audit preparation.