Key takeaways
- Plan, run and control the processes needed to meet requirements, including outsourced ones, and manage changes.
- Plans only matter if they are carried out.
- Start here: define criteria for processes and implement controls accordingly.
Purpose
Plan, run and control the processes needed to meet requirements, including outsourced ones, and manage changes.
Requirement
Requirement summaryThe organization shall plan, implement and control the processes needed to meet requirements, and to implement the actions determined in Clause 6, by: — establishing criteria for the processes; — implementing control of the processes in accordance with the criteria. Documented information shall be available to the extent necessary to have confidence that the processes have been carried out as planned. The organization shall control planned changes and review the consequences of unintended changes, taking action to mitigate any adverse effects, as necessary. The organization shall ensure that externally provided processes, products or services that are relevant to the information security management system are controlled.
Why it matters
Plans only matter if they are carried out. Operational control makes the ISMS real.
How to implement
- Define criteria for processes and implement controls accordingly.
- Keep documented information to show processes are carried out as planned.
- Control planned changes and review unintended ones.
- Control externally provided processes.
What evidence you need to provide
Here is what you will typically need to provide for Clause 8.1. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your plans and procedures for running security processes day to day.
Records and examples to show
- Records showing processes ran as planned.
- Change records and checks on outsourced processes.
Things you should be able to show or explain
- Be able to explain how you know processes are working as planned.
How much to show: A handful of processes.
Common mistakes
- Processes not followed.
- Outsourced work not controlled.
- Outsourced processes ignored.
- Changes not reviewed for impact.
- Tip: Re-run your risk assessment whenever something big changes, not just yearly.
Policies & documents to have
- Information Security Policy (ISMS policy)
- Management review procedure
- Information security objectives plan
- Risk Management Policy
- Third-Party Management Policy
FAQ
Can we exclude clause 8.1?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
Processes operate as designed; changes controlled.