Operational planning and control

Plain-language summary

Running the processes that deliver information security day to day — to criteria you have set, with the records to prove it, with changes controlled and with the suppliers and cloud services you depend on under control too.

What the clause is really asking

Clause 8 is short because the detail lives in Annex A; 8.1 is the frame around it. You plan and run the processes that meet the ISMS requirements and deliver the actions from clause 6 — the risk treatment plan and the objectives — by setting criteria for each process and running it to those criteria (wording new in 2022). You keep enough documented information to be confident the processes ran as planned. Changes you plan are controlled; changes you did not plan are reviewed for their consequences, with action taken to limit any harm. And whatever you obtain from outside that matters to the ISMS — processes, products or services — is kept under control; the 2022 edition broadened this from 'outsourced processes' to catch cloud platforms, managed service providers, payroll bureaus and software vendors. In POPIA terms this is where operator agreements (s20–s21) sit: anyone processing personal information for you must do so under a written contract and with your security measures. The core of the clause is the same text as ISO 9001's 8.1, without the product and service requirements.

What auditors look for

Auditors pick operational processes that carry controls — user access provisioning, patching, backup, change, supplier onboarding — and ask for the criteria (how often, to what standard, who approves) and the records showing they were met. They check that the risk treatment plan's actions were actually implemented on time. They look hard at external providers: the list, the contracts with security terms, the evidence of review (certificates, audit reports, questionnaires), and the controls on the interface (access, data transfer). They ask what happened the last time an unplanned change caused a problem, and whether the consequences were reviewed.

Typical evidence

Operating procedures or criteria for security processes (access, change, patching, backup, logging, supplier onboarding); records showing processes ran as planned (tickets, checklists, approvals, logs); risk treatment plan status; change records including review of unintended changes; register of external providers with contracts carrying security requirements, assurance evidence and review dates; POPIA operator agreements.

How to comply — recommendations

For each control in your SoA write the operating criterion in one line — what is done, how often, by whom, to what standard — and point to where the record is produced automatically (the ticketing tool, the backup console, the identity system). Automate the record wherever you can; a report pulled from the system beats a spreadsheet filled in afterwards. Keep a supplier and cloud register with four facts per provider: what they do for you, what data they touch, what security clause binds them, and when you last checked their assurance. Treat unintended changes as incidents: log them, review the effect, fix the control. Reuse your ISO 9001 operational and purchasing procedures where they already exist.

Common nonconformities

No criteria defined for security processes, so 'as planned' cannot be shown; records insufficient to demonstrate processes ran (patching, access reviews, backups unverifiable); risk treatment actions overdue with no revised plan; external providers not identified, not contracted with security terms or never reviewed; cloud services outside any control; unintended changes not reviewed; POPIA operator agreements missing.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.