Planned implementation of changes to ISMS

Please note that ISO 27001 clause 6.3 does not require a specific document to be developed to manage changes in the ISMS.

Considering that, you can use one of these documents to manage changes:

• Risk Treatment Plan, located in folder 08 Implementation Plan - through this document you plan for each new security control, process, or activity
• Change Management Policy, located in folder 09 Annex A Security Controls
• Security Procedures for IT Department, located in folder 09 Annex A Security Controls

For further information, see:

• How to manage changes in an ISMS according to ISO 27001 A.12.1.2 https://advisera.com/27001academy/blog/2015/09/14/how-to-manage-changes-in-an-isms-according-to-iso-27001-a-12-1-2/