GB/T 22080-2025Cybersecurity technology - Information security management systems - Requirements (English PDF)

4.1 Understanding the organization and its context

The organization shall identify external and internal matters relevant to its intentions and affecting its ability to achieve the intended results of its information security management system.

The organization shall determine whether climate change 1) is a relevant matter.

Note. For the determination of these matters, see Article 5.4.1, Establishing the external and internal environment, in GB/T 24353-2022.

4.2 Understanding stakeholder needs and expectations

The organization shall determine.

a) The stakeholders of the information security management system;

b) The relevant requirements of these stakeholders;

c) Which requirements will be addressed through the information security management system.

Note 1.Stakeholder requirements include legal, regulatory, contractual obligations.

Note 2.Stakeholders may raise requirements related to climate change.

4.3 Determining the scope of the information security management

system

The organization shall determine the boundaries and applicability of the information security management system to establish its scope.

The organization shall determine the scope of the information security management system based on.

a) The external and internal matters mentioned in 4.1;

b) The requirements mentioned in 4.2;

1 For more information on climate change, see the joint communiqué of ISO and the International Accreditation

Forum (IAF) on adding climate change factors to management system standards.

c) The interfaces and dependencies between the activities implemented by the organization and those implemented by other organizations.

The scope shall be documented and available.

4.4 Information security management system

The organization shall establish, implement, maintain, continually improve an information security management system, including the necessary processes and their interactions, in accordance with the requirements of this document.

5.1 Leadership and commitment

Top management shall demonstrate its leadership and commitment to the information security management system by.

a) Ensuring that an information security policy and information security objectives are established and aligned with the organization's strategic direction;

b) Ensuring that the requirements of the information security management system are integrated into the organization's business processes;

c) Ensuring that the resources required for the information security management system are available;

d) Communicating the importance of effective information security management and compliance with the requirements of the information security management system;

e) Ensuring that the information security management system achieves its intended results;

f) Guiding and supporting relevant personnel in contributing to the effectiveness of the information security management system;

g) Promoting continual improvement;

h) Supporting other relevant management roles in demonstrating their leadership within their responsibilities.

Note. The term "business" in this document can be broadly interpreted as activities that are central to the organization's intentions.

5.2 Policy

Top management shall establish an information security policy that.

a) Is appropriate to the organization's intentions;

b) Includes information security objectives (see 6.2) or provides a framework for setting information security objectives;

c) Includes a commitment to meeting applicable information security requirements;

d) Includes a commitment to the continual improvement of the information security management system.

The information security policy shall.

a) Be documented and available;

b) Be communicated within the organization;

c) Be available to stakeholders, where appropriate.

5.3 Organizational roles, responsibilities, authorities

Top management shall ensure that the responsibilities and authorities of those roles related to information security are assigned and communicated within the organization.

Top management shall assign responsibilities and authorities to.

a) Ensure that the information security management system conforms to the requirements of this document;

b) Report to them on the performance of the information security management system.

Note. Top management may also assign responsibilities and authorities within the organization, to report on the performance of the information security management system.

6.1 Measures to address risks and opportunities

6.1.1 General principles

......