In this guide, I will show you exactly how to implement ISO 27001 Clause 8.1 and ensure you pass your audit. You will get a complete walkthrough of the control, practical implementation examples, and access to the ISO 27001 templates and toolkit that make compliance easy.
I am Stuart Barker, an ISO 27001 Lead Auditor with over 30 years of experience conducting hundreds of audits. I will cut through the jargon to show you exactly what changed in the 2022 update and provide you with plain-English advice to get you certified.
Key Takeaways: ISO 27001 Clause 8.1 Operational Planning and Control
ISO 27001 Clause 8.1 is the bridge between planning and action. It requires organizations to plan, implement, and control the processes needed to meet information security requirements and to address the risks identified in Clause 6. In simple terms, this is where you prove that your policies are not just paper documents; they are active, documented, and controlled operations. You must demonstrate that your processes (like change management, incident response, and access control) run consistently and produce predictable security outcomes.
Core requirements for compliance include:
- Documented Processes: You must have written procedures for your Information Security Management System (ISMS) and Annex A controls. This ensures consistency regardless of who performs the task.
- Criteria for Processes: You must define clear rules or criteria for how a process should function (e.g., “Access is only granted after Manager Approval”).
- Evidence of Operation: It is not enough to have a process document; you must retain evidence that the process was actually followed (e.g., tickets, logs, emails, or signed forms).
- Change Management: The organization must control planned changes to the system and review the consequences of unintended changes to mitigate adverse effects.
- Outsourced Processes: If you outsource any part of your ISMS or security operations (e.g., a Managed Security Service Provider), you must ensure these external processes are controlled and monitored.
- Performance Monitoring: You must regularly check that your operational processes are performing as intended and meeting their defined criteria.
Audit Focus: Auditors will look for “The Operational Reality”:
- Process Consistency: “I see your ‘User Access Procedure’ says you need HR confirmation. Show me the last 5 new user tickets. Do they all have this confirmation attached?”
- Change Control: “Show me the change request for the last firewall update. Was it approved before the change was made?”
- Outsourcing Oversight: “How do you ensure your external IT support team follows your password policy? Show me the contract or the audit report.”
Operational Control Implementation Checklist (Audit Prep):
| Step | Action Required | Evidence Example |
| 1. Define | Document the process steps. | “Operations Manual” or SOP. |
| 2. Criteria | Set rules for success/failure. | “Must be approved by Manager.” |
| 3. Execute | Perform the task as documented. | Ticket or Log entry. |
| 4. Control | Check against criteria (QA). | “Ticket Closed – Criteria Met.” |
| 5. Evidence | Retain proof for audit. | Archive of Ticket #12345. |
Table of contents
- What is ISO 27001 Clause 8.1?
- Watch the Tutorial
- How to implement ISO 27001 Clause 8.1
- ISO 27001 Clause 8.1 Implementation Checklist
- ISO 27001 Clause 8.1 Audit Checklist
- Example Records of Evidence
- Fast Track ISO 27001 Clause 8.1 Compliance with the ISO 27001 Toolkit
- Further Guidance on Operational Planning and Control
- ISO 27001 Clause 8.1 FAQ
What is ISO 27001 Clause 8.1?
ISO 27001 Clause 8.1 is the need to plan and control the processes necessary to meet the requirements of your objectives and the management of your risks.
Documented processes is going to fall into two categories.
- documented processes for the information security management system (the isms),
- documented processes that support the annex a controls.
By doing this you can:
- Ensure Consistency: the single biggest reason to implement operations and document everything is so that you have process maturity and are consistent in your approach.
- Evidence effective operation of information security: by implementing operations you will have evidence of the management of information security and the measures and monitors that show that it is effective.
- Reduce errors: by having operations you are able to reduce errors by being consistent and continually improve and adapt as things change.
ISO 27001 Operational Planning and Control includes change management and outsourced process management.
ISO 27001 Clause 8.1 Definition
ISO 27001 defines ISO 27001 clause 8.1 as:
The organisation shall plan, implement and control the processes needed to meet information security requirements, and to implement the actions determined in clause 6 by
ISO 27001:2022 Clause 8.1 Operational Planning and Control
– establishing criteria for processes
– implementing control of the processes in accordance with the criteria
Documented information shall be available to the extent necessary to have confidence that the processes have been carried out as planned.
The organisation shall control planned changes and review the consequences of unintended changes, taking action to mitigate any adverse effects, as necessary.
The organisation shall ensure that externally provided processes, products or services that are relevant to the information security management system are controlled
Watch the Tutorial
In the ISO 27001 tutorial How to implement ISO 27001 Clause 8.1 Operational Planning and Control I show you how to implement it and pass the audit.
How to implement ISO 27001 Clause 8.1
Key Principles
- Processes are documented: the information security management system (ISMS) and business operations are documented. This is about having business process maturity which means having documented processes and a standardised way of operating that is performed in the same way irrespective of who operates the process. The output of the process is also the same irrespective of who operates it.
- Documentation is available: documentation is available to those that needed it when they need it including the inputs and outputs such as management reports.
General Guidance
There are many ways to document and evidence operational control. Consider the best methods for you.
When documenting operational processes you can have all your operational processes documented in one document called the Operations Manual (Ops Manual). This approach is great for smaller businesses.
Alternatively you can have many documents spread out in, and embedded in, the business and the operational areas where the processes are executed. This is more suited to a large organisation with teams and more people.
Consider it as a centralised or decentralised approach with the associated pros and cons of those kinds of implementation.
Finally there is always a hybrid approach where some processes are in the business but the ops manual remains the ‘shop window’ or the main reference point for those processes for management and control.
Time needed: 1 hour and 30 minutes
How to implement ISO 27001 Clause 8.1 Operational Planning and Control
- Document all of your operational processes
In a document with appropriate mark up and version control document the operational processes of the business. Make sure you document what you do, not what you think an auditor wants to hear. You can only be audited against what you say you do so be sure you do it. Write clear and concise steps that anyone could follow to achieve the same process results and outcomes. Always include at least one exception step that covers what happens if a part of the process fails or does not operate as intended. You will need to document not only the information security processes but any process that covers the ISO 27001 in scope products and services. It is covered by the ISO 27001 scope statement then it needs documenting.
- Ensure your process documents are reviewed and approved
Process documents are part of the information security management system and they should be reviewed and approved and part of the review and approval cycle.
- Keep evidence of the process operating
When you come to the audit the auditor will want to see evidence of the operation of the process. This could be tickets in a ticket system, operational performance reports, copies of emails. What ever the artefacts referenced in the process are make sure that you can show copies of at least one of them.
- Audit your operational processes
You are required to audit your operational processes at least once annually and then based on need and business risk. Be sure that you have conducted the audit, documented and followed the continual improvement process.
ISO 27001 Clause 8.1 Implementation Checklist
Operational Planning and Control ISO 27001 Clause 8.1 Implementation Checklist
1. Define Operational Processes
Clearly define and document all operational processes related to information security. This includes processes for incident management, change management, vulnerability management, access control, etc.
Challenge
Difficulty in documenting complex processes in a clear and concise manner.
Solution
Use flowcharts, diagrams, and plain language to document processes. Involve process owners and subject matter experts in the documentation process.
2. Establish Acceptance Criteria
Define clear acceptance criteria for all operational activities. This ensures that activities are performed to a consistent standard and meet the organisation’s security requirements.
Challenge
Setting realistic and measurable acceptance criteria.
Solution
Base acceptance criteria on industry best practices, regulatory requirements, and the organisation’s risk assessment. Pilot test new criteria where possible.
3. Allocate Resources
Identify and allocate the necessary resources (personnel, equipment, software, budget) to support operational processes.
Challenge
Resource constraints and competing priorities.
Solution
Prioritise resource allocation based on risk assessment and business impact. Justify resource requests with clear business cases.
4. Implement Controls
Implement the information security controls identified in the risk assessment and ISO 27001 Statement of Applicability (SoA). This includes technical controls (e.g., firewalls, intrusion detection systems) and organisational controls (e.g., policies, procedures, training).
Challenge
Complexity of implementing and managing multiple controls.
Solution
Prioritise control implementation based on risk and feasibility. Use a phased approach and leverage automation where possible.
5. Establish Operating Procedures
Develop detailed operating procedures for performing security-related tasks. These procedures should be clear, concise, and easy to follow.
Challenge
Keeping procedures up-to-date and relevant.
Solution
Implement a version control system for procedures and establish a regular review cycle. Solicit feedback from staff who use the procedures.
6. Manage Changes
Implement a formal change management process to ensure that changes to systems, applications, and processes do not introduce new security risks.
Challenge
Balancing the need for change with the need to maintain security.
Solution
Establish a change approval process that includes security review. Conduct thorough testing before implementing changes.
7. Monitor Performance
Regularly monitor the performance of operational processes and controls. This helps to identify potential issues and ensure that controls are operating effectively.
Challenge
Defining meaningful metrics and collecting data effectively.
Solution
Establish key performance indicators (KPIs) for operational processes and use automated tools where possible to collect and analyse data.
8. Manage Incidents
Implement an incident management process to handle security incidents effectively. This includes procedures for reporting, analysing, and responding to incidents.
Challenge
Responding to incidents quickly and effectively while minimising disruption.
Solution
Develop incident response plans and conduct regular incident response exercises. Establish clear communication channels for reporting incidents.
9. Maintain Documentation
Maintain accurate and up-to-date documentation for all operational processes, controls, and procedures.
Challenge
Keeping documentation current and accessible.
Solution
Use a centralised document management system and establish a process for updating documentation regularly.
10. Continuously Improve
Regularly review and improve operational processes based on monitoring data, incident reports, and feedback from stakeholders.
Challenge
Identifying areas for improvement and implementing changes effectively.
Solution
Conduct regular management reviews of operational performance. Encourage feedback from staff and implement a process for continual improvement.
ISO 27001 Clause 8.1 Audit Checklist
How to audit ISO 27001 Clause 8.1 Operational Planning and Control
1. Verify the Existence of Documented Processes
Verify that documented information security processes exist for all planned and controlled operations related to the ISMS. This includes processes for incident management, change management, access control, and vulnerability management.
- Examine process documentation (flowcharts, procedures) for completeness, clarity, and alignment with the ISMS.
- Interview process owners to understand how processes are implemented in practice.
2. Check Acceptance Criteria
Confirm that clear acceptance criteria have been defined for operational activities and that these criteria are being used to evaluate performance.
- Review documented acceptance criteria and interview staff responsible for performing and reviewing operational tasks.
- Observe operational activities (where possible) to verify that acceptance criteria are applied.
3. Ensure There is Adequate Resource Allocation
Ensure that adequate resources (people, budget, technology) are allocated to support the operation and control of the ISMS.
- Review resource allocation plans, budget documents, and staffing schedules.
- Interview managers and staff to assess the adequacy of resources.
4. Inspect Control Implementation
Verify that the information security controls identified in the risk assessment and ISO 27001 Statement of Applicability (SoA) have been implemented effectively.
- Perform control testing (e.g., technical testing of firewalls, review of access control lists).
- Examine configuration settings, logs, and other evidence of control implementation.
5. Ensure There is Monitoring and Review of Controls
Ensure that the effectiveness of operational controls is regularly monitored and reviewed.
- Review monitoring logs, performance reports, and management review minutes.
- Interview management and operational staff regarding monitoring and review activities.
6. Evaluate Operating Procedures
Assess the clarity, completeness, and currency of operating procedures for security-related tasks.
- Review operating procedures for accuracy, completeness, and ease of understanding.
- Interview staff to confirm their familiarity with and adherence to procedures.
7. Confirm There is Change Management
Confirm that a formal change management process is in place to control changes to the ISMS, including infrastructure, software, and processes.
- Examine change requests, approvals, and implementation records.
- Interview IT staff and users about the change management process.
- Review emergency change procedures.
8. Check Performance Monitoring
Confirm that the performance of operational processes and controls is being monitored regularly.
- Review performance monitoring reports, key performance indicators (KPIs), and dashboards.
- Interview staff responsible for monitoring performance and how the data is used.
9. Confirm There is Incident Management
Verify the existence and effectiveness of an incident management process to detect, respond to, and recover from security incidents.
- Review incident logs, incident reports, and post-incident reviews.
- Interview incident response team members.
- Conduct simulated incident scenarios.
- Verify that documents are readily accessible to relevant personnel.
10. Assess Continuous Improvement
Verify that operational processes are being regularly reviewed and improved based on monitoring data, incident reports, and feedback from stakeholders.
- Review management review minutes, improvement plans, and records of corrective actions.
- Interview management and staff to assess the organisation’s commitment to continual improvement.
11. Check Outsourcing Controls
Where processes are outsourced, confirm that appropriate controls are in place to manage the security risks associated with third-party involvement. This includes contractual agreements and ongoing monitoring.
- Review contracts with third-party providers, examine service level agreements (SLAs), and conduct interviews with both internal and external personnel.
- Review audit reports of outsourced providers where available.
12. Review Capacity Management
Verify that capacity planning is performed to ensure that sufficient resources are available to meet current and future business needs without compromising security.
- Review capacity plans, trend analysis data, and performance monitoring reports.
- Interview IT staff regarding capacity management processes.
13. Confirm There is Vulnerability Management
Ensure that a vulnerability management process is in place to identify, assess, and remediate security vulnerabilities.
- Review vulnerability scan reports, penetration testing results, and remediation plans.
- Interview IT security staff. Observe vulnerability scanning activities.
14. Gain Evidence of Backup and Restoration
Confirm that appropriate backup and restoration procedures are in place to protect critical data and systems.
- Review backup and restoration procedures, backup logs, and restoration test results.
- Conduct spot checks of backup media.
Example Records of Evidence
Examples of records that processes can generate include
- internal audit reports
- external audit reports
- IT management reports
- antivirus status reports
- patching status reports
- asset inventory
- the number of new users
- help desk statistic reports
Fast Track ISO 27001 Clause 8.1 Compliance with the ISO 27001 Toolkit
For ISO 27001 Clause 8.1 (Operational planning and control), the requirement is to plan, implement, and control the processes needed to meet information security requirements and to implement the actions determined in Clause 6 (Risk Management). This is the “engine room” of your ISMS, ensuring that your security policies are actually translated into repeatable, documented business operations.
While SaaS compliance platforms often try to sell you “automated workflow tracking” or complex “API-driven process monitors,” they cannot actually be your Operations Manual or ensure your staff are following the “recipe” for a manual leaver process, those are human governance and operational leadership tasks. The High Table ISO 27001 Toolkit is the logical choice because it provides the operational framework you need without a recurring subscription fee.
1. Ownership: You Own Your Operations Manual Forever
SaaS platforms act as a middleman for your compliance evidence. If you define your operational processes and store your process logs inside their proprietary system, you are essentially renting your own business maturity history.
- The Toolkit Advantage: You receive the Operations Manual and Documented Operating Procedures in fully editable Word formats. These files are yours forever. You maintain permanent ownership of your standards (such as specific instructions for your unique hybrid cloud setup), ensuring you are always ready for an audit without an ongoing “rental” fee.
2. Simplicity: Governance for the Tools You Already Use
Clause 8.1 is about control and consistency. You don’t need a complex new software interface to manage what a well-documented process in Word or a structured task list in Jira already does perfectly.
- The Toolkit Advantage: Your team already runs the business. What they need is the governance layer to prove to an auditor that these operations are formal, reviewed, and approved by management. The Toolkit provides pre-written “Operational Planning Checklists” that formalize your existing work into an auditor-ready framework, without forcing your team to learn a new software platform just to log a completed task.
3. Cost: A One-Off Fee vs. The “Process” Tax
Many compliance SaaS platforms charge more based on the number of “active processes,” “workflows,” or “assigned tasks” you track. For a clause that requires you to document and control every security-related activity in your company, these monthly costs can scale aggressively.
- The Toolkit Advantage: You pay a single, one-off fee for the entire toolkit. Whether you document 5 operational processes or 50, the cost of your Operational Planning Documentation remains the same. You save your budget for actual security tools or staff resources rather than an expensive compliance dashboard.
4. Freedom: No Vendor Lock-In for Your Operational Strategy
SaaS tools often mandate specific ways to report on and monitor “operational controls.” If their system doesn’t match your unique agile business flow or specialized industry requirements, the tool becomes a bottleneck to efficiency.
- The Toolkit Advantage: The High Table Toolkit is 100% technology-agnostic. You can tailor the Operational Procedures to match exactly how you operate, whether you use a centralised Operations Manual or decentralised team-based documentation. You maintain total freedom to evolve your operational strategy without being constrained by the technical limitations of a rented SaaS platform.
Summary: For Clause 8.1, the auditor wants to see that you have documented “recipes” for your processes and evidence (like tickets or reports) that they were carried out as planned. The High Table ISO 27001 Toolkit provides the governance framework to satisfy this requirement immediately. It is the most direct, cost-effective way to achieve compliance using permanent documentation that you own and control.
Further Guidance on Operational Planning and Control
ISO 27001 provides further guidance in its Annex A controls, which were revised in 2022 in conjunction with changes to the ISO 27002 standard. Annex A specifically identifies required operational processes. Adhering to the principle that “if it isn’t documented, it doesn’t exist,” every control in Annex A necessitates a corresponding documented process. While we won’t cover every control, the following examples illustrate the type of processes required.
ISO 27001 Annex A 5.24 Response to information security incidents
The organisation should plan and prepare for managing information security incidents by defining, establishing and communicating information security incident management processes, roles and responsibilities
ISO 27001 Annex A 5.24 Information security incident management planning and preparation
ISO 27001 Annex A 5.26 Response to information security incidents
Information security incidents should be responded to in accordance with the documented procedures.
ISO 27001 Annex A 5.26 Response to information security incidents
ISO 27001 Annex A 5.37 Documented operating procedures
Operating procedures for information processing facilities should be documented and made available to personnel who need them.
ISO 27001 Annex A 5.37 Documented operating procedures
ISO 27001 Annex A 5.32 Intellectual property rights
The organisation should implement appropriate procedures to protect intellectual property rights.
ISO 27001 Annex A 5.32 Intellectual property rights
This is usually the function of the legal department and part of good legal practice. Legal will have many requirements of their own but we are interested for ISO 27001 certification in ensuring that they have handled intellectual property rights as well as the legal register.
ISO 27001 Annex A 8.32 Change Management
Changes to information processing facilities and information systems should be subject to change management procedures.
ISO 27001 Annex A 8.32 Change Management
How do you demonstrate compliance to ISO 27001 clause 8.1?
It is very simple and straightforward to demonstrate compliance with ISO 27001 clause 8.1 operational planning and control.
Document all of your processes, have plans in place that you can evidence and have evidence of the processes operating as you have documented that they should.
ISO 27001 Clause 8.1 FAQ
The organisation shall plan, implement and control operational processes and keep evidence of their effective operation. In addition the organisation shall implement change management and third party supplier management.
You evidence compliance to the ISO 27001 Clause 8.1 by having written and documented processes and procedures in place that say exactly what you do and cover the requirements of the ISO 27001 standard. In addition you have records and evidence of the operation of those processes and procedures so you can evidence that you actually do what you say you and that it works as intended.
You can download ISO 27001 Clause 8.1 templates in the ISO 27001 Toolkit.
An example of ISO 27001 Clause 8.1 can be found in the ISO 27001 Toolkit.
No. You can document them in what ever way makes sense for your organisation. As long as they have the appropriate document mark up and controls in place.
Yes. As long as they say what you do and you can evidence that you do it that is fine.
You review them when ever anything changes and at least annually. When it comes to audit make sure that you can evidence they were reviewed at some point in the preceding 12 months to the audit. Can
The standard does not care as long as they are documented so do what works best for you and your organisation. We recommend one document for small to mid sized organisations.
