Operational planning and control
The organization must plan, run and keep under control the processes that meeting its requirements depends on and to carry out the actions set in Clause 6, by setting criteria for those processes and controlling them according to the....
What the requirement asks
The organization must plan, run and keep under control the processes that meeting its requirements depends on and to carry out the actions set in Clause 6, by setting criteria for those processes and controlling them according to the criteria. Documented information must be available to the extent needed to be confident the processes ran as planned. Planned changes are controlled, the consequences of unintended changes are reviewed with action taken to limit adverse effects, and externally provided processes, products or services relevant to the ISMS are controlled.
What the guidance adds
Operational planning is expected to set criteria for the processes, control them against the criteria and manage planned changes. Outsourced processes stay in scope. The guidance asks for the plan, the criteria, the record of operation and the response when a process drifts.
Status of the guidance. The guidance lens for 8.1 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Keep process criteria and operating procedures for ISMS processes and planned actions with the clause record, and give it an owner and a review date.
Evidence an assessor asks for
- Operational controlProcess criteria and operating procedures for ISMS processes and planned actions
- Operational controlRecords showing processes were carried out as planned
- Operational controlChange records for planned changes and reviews of unintended changes with mitigating action
- Operational controlControls over outsourced or externally provided processes, products and services relevant to the ISMS
The question an assessor will ask
An assessor will ask for process criteria and operating procedures for ISMS processes and planned actions. The test for 8.1 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.
Common gaps
- Criteria for processes are not defined
- Unintended changes are not reviewed for consequences
- Outsourced processes are not identified or controlled
- Records do not show processes ran as planned
Before the next audit
Before the next audit, test this against one live record: criteria for processes are not defined.