ISO 27001 Clause 8.1 Operational Planning and Control

Home / ISO 27001 Clauses / ISO 27001 Clause 8.1 Operational Planning and Control

ISO 27001 Operational Planning and Control

The ISO 27001 standard requires an organisation to plan, implement and control the processes needed to meet the requirements of Information Security.

What is ISO 27001 Clause 8.1?

Operations is about the need to plan and control the processes necessary to meet the requirements of your objectives and the management of your risks.

Documented processes is going to fall into two categories.

  • documented processes for the information security management system (the isms), 
  • documented processes that support the annex a controls.

By doing this you can:

  • Ensure Consistency: the single biggest reason to implement operations and document everything is so that you have process maturity and are consistent in your approach.
  • Evidence effective operation of information security: by implementing operations you will have evidence of the management of information security and the measures and monitors that show that it is effective.
  • Reduce errors: by having operations you are able to reduce errors by being consistent and continually improve and adapt as things change.

ISO 27001 Operational Planning and Control includes change management and outsourced process management.

Definition

ISO 27001 defines ISO 27001 clause 8.1 as:

The organisation shall plan, implement and control the processes needed to meet information security requirements, and to implement the actions determined in clause 6 by
– establishing criteria for processes
– implementing control of the processes in accordance with the criteria
Documented information shall be available to the extent necessary to have confidence that the processes have been carried out as planned.
The organisation shall control planned changes and review the consequences of unintended changes, taking action to mitigate any adverse effects, as necessary.
The organisation shall ensure that externally provided processes, products or services that are relevant to the information security management system are controlled

ISO 27001:2022 Clause 8.1 Operational Planning and Control

What are the ISO 27001:2022 Changes to Operational Planning and Control?

The changes to ISO 27001 Clause 8.1 in the 2022 update are clarification changes and nothing material.

The wording on planning and implementing and controlling processes is widened to the more general wording of ‘meet requirements’ rather than before which was ‘meet information security requirements’.

It now talks to establishing criteria for the processes and implementing control of processes in line with those criteria.

Rather than keep documented information it is changed to documented information shall be available.

Outsourced processes are determined and controlled is changed to externally provided processes, products or services that are relevant to the information security management system are controlled.

ISO 27001 Toolkit

Implementation Guide

Key Principles

  • Processes are documented: the information security management system (ISMS) and business operations are documented. This is about having business process maturity which means having documented processes and a standardised way of operating that is performed in the same way irrespective of who operates the process. The output of the process is also the same irrespective of who operates it.
  • Documentation is available: documentation is available to those that needed it when they need it including the inputs and outputs such as management reports.

General Guidance

There are many ways to document and evidence operational control. Consider the best methods for you.

When documenting operational processes you can have all your operational processes documented in one document called the Operations Manual (Ops Manual). This approach is great for smaller businesses.

Alternatively you can have many documents spread out in, and embedded in, the business and the operational areas where the processes are executed. This is more suited to a large organisation with teams and more people.

Consider it as a centralised or decentralised approach with the associated pros and cons of those kinds of implementation.

Finally there is always a hybrid approach where some processes are in the business but the ops manual remains the ‘shop window’ or the main reference point for those processes for management and control.

Document all of your operational processes

In a document with appropriate mark up and version control document the operational processes of the business. Make sure you document what you do, not what you think an auditor wants to hear. You can only be audited against what you say you do so be sure you do it. Write clear and concise steps that anyone could follow to achieve the same process results and outcomes. Always include at least one exception step that covers what happens if a part of the process fails or does not operate as intended. You will need to document not only the information security processes but any process that covers the ISO 27001 in scope products and services. It is covered by the ISO 27001 scope statement then it needs documenting.

Ensure your process documents are reviewed and approved

Process documents are part of the information security management system and they should be reviewed and approved and part of the review and approval cycle.

Keep evidence of the process operating

When you come to the audit the auditor will want to see evidence of the operation of the process. This could be tickets in a ticket system, operational performance reports, copies of emails. What ever the artefacts referenced in the process are make sure that you can show copies of at least one of them.

Audit your operation processes

You are required to audit your operational processes at least once annually and then based on need and business risk. Be sure that you have conducted the audit, documented and followed the continual improvement process.

On Ending Employment / Engagement

Ensure that at the end of employment or the end of engagement that you communicate the contractual obligations that are, and will remain, in play in regards to information security.

ISO 27001 Continual Improvement

Continually update your communication plan to respond to known threats, risks and issues.

Implement Change Management

In line with the Change Management Policy and best practice document and implement a change management process ensuring that changes go through the process and you can evidence the operation of the change process at audit time.

Implement Third Party Supplier Management

In line with the Third Party Supplier Policy and best practice document and implement a third party supplier process ensuring you have the controls and reporting mechanisms in place to the extent that you can evidence the operation of the supplier management process at audit time.

Implementation Checklist

Operational Planning and Control ISO 27001 Clause 8.1 Implementation Checklist

Define Operational Processes

Clearly define and document all operational processes related to information security. This includes processes for incident management, change management, vulnerability management, access control, etc.

Challenge:

Difficulty in documenting complex processes in a clear and concise manner.

Solution:

Use flowcharts, diagrams, and plain language to document processes. Involve process owners and subject matter experts in the documentation process.

Establish Acceptance Criteria

Define clear acceptance criteria for all operational activities. This ensures that activities are performed to a consistent standard and meet the organisation’s security requirements.

Challenge:

Setting realistic and measurable acceptance criteria.

Solution:

Base acceptance criteria on industry best practices, regulatory requirements, and the organisation’s risk assessment. Pilot test new criteria where possible.

Allocate Resources

Identify and allocate the necessary resources (personnel, equipment, software, budget) to support operational processes.

Challenge:

Resource constraints and competing priorities.

Solution:

Prioritise resource allocation based on risk assessment and business impact. Justify resource requests with clear business cases.

Implement Controls

Implement the information security controls identified in the risk assessment and ISO 27001 Statement of Applicability (SoA). This includes technical controls (e.g., firewalls, intrusion detection systems) and organisational controls (e.g., policies, procedures, training).

Challenge:

Complexity of implementing and managing multiple controls.

Solution:

Prioritise control implementation based on risk and feasibility. Use a phased approach and leverage automation where possible.

Establish Operating Procedures

Develop detailed operating procedures for performing security-related tasks. These procedures should be clear, concise, and easy to follow.

Challenge:

Keeping procedures up-to-date and relevant.

Solution:

Implement a version control system for procedures and establish a regular review cycle. Solicit feedback from staff who use the procedures.

Manage Changes

Implement a formal change management process to ensure that changes to systems, applications, and processes do not introduce new security risks.

Challenge:

Balancing the need for change with the need to maintain security.

Solution:

Establish a change approval process that includes security review. Conduct thorough testing before implementing changes.

Monitor Performance

Regularly monitor the performance of operational processes and controls. This helps to identify potential issues and ensure that controls are operating effectively.

Challenge:

Defining meaningful metrics and collecting data effectively.

Solution:

Establish key performance indicators (KPIs) for operational processes and use automated tools where possible to collect and analyse data.

Manage Incidents

Implement an incident management process to handle security incidents effectively. This includes procedures for reporting, analysing, and responding to incidents.

Challenge:

Responding to incidents quickly and effectively while minimising disruption.

Solution:

Develop incident response plans and conduct regular incident response exercises. Establish clear communication channels for reporting incidents.

Maintain Documentation

Maintain accurate and up-to-date documentation for all operational processes, controls, and procedures.

Challenge:

Keeping documentation current and accessible.

Solution:

Use a centralised document management system and establish a process for updating documentation regularly.

Continuously Improve

Regularly review and improve operational processes based on monitoring data, incident reports, and feedback from stakeholders.

Challenge:

Identifying areas for improvement and implementing changes effectively.

Solution:

Conduct regular management reviews of operational performance. Encourage feedback from staff and implement a process for continual improvement.

Audit Checklist

The following is a summary of the ISO 27001 Clause 8.1 Audit Checklist:

Review Operational Processes

Verify that documented operational processes exist for key information security activities (e.g., incident management, change management, vulnerability management).

Audit Technique: Examine process documentation (flowcharts, procedures) for completeness, clarity, and alignment with the ISMS. Interview process owners to understand how processes are implemented in practice.

Check Acceptance Criteria

Confirm that clear acceptance criteria have been defined for operational activities and that these criteria are being used to evaluate performance.

Audit Technique: Review documented acceptance criteria and interview staff responsible for performing and reviewing operational tasks. Observe operational activities (where possible) to verify that acceptance criteria are applied.

Verify Resource Allocation

Ensure that adequate resources (personnel, equipment, software, budget) have been allocated to support operational processes.

Audit Technique: Review resource allocation plans, budget documents, and staffing schedules. Interview managers and staff to assess the adequacy of resources.

Inspect Control Implementation

Verify that the information security controls identified in the risk assessment and ISO 27001 Statement of Applicability (SoA) have been implemented effectively.

Audit Technique: Perform control testing (e.g., technical testing of firewalls, review of access control lists). Examine configuration settings, logs, and other evidence of control implementation.

Evaluate Operating Procedures

Assess the clarity, completeness, and currency of operating procedures for security-related tasks.

Audit Technique: Review operating procedures for accuracy, completeness, and ease of understanding. Interview staff to confirm their familiarity with and adherence to procedures.

Examine Change Management

Verify that a formal change management process is in place and is being followed.

Audit Technique: Review change requests, approvals, and implementation records. Interview change managers and staff to assess the effectiveness of the change management process.

Check Performance Monitoring

Confirm that the performance of operational processes and controls is being monitored regularly.

Audit Technique: Review performance monitoring reports, key performance indicators (KPIs), and dashboards. Interview staff responsible for monitoring performance and how the data is used.

Evaluate Incident Management

Verify that an incident management process is in place and is being followed effectively.

Audit Technique: Review incident reports, incident response plans, and post-incident reviews. Interview incident response team members to assess their preparedness and effectiveness.

Inspect Documentation Maintenance

Ensure that documentation for operational processes, controls, and procedures is maintained accurately and up-to-date.

Audit Technique: Review document version control, approval processes, and document management systems. Verify that documents are readily accessible to relevant personnel.

Assess Continuous Improvement

Verify that operational processes are being regularly reviewed and improved based on monitoring data, incident reports, and feedback from stakeholders.

Audit Technique: Review management review minutes, improvement plans, and records of corrective actions. Interview management and staff to assess the organisation’s commitment to continual improvement.

Example Records of Evidence

Examples of records that processes can generate include

  • internal audit reports
  • external audit reports
  • IT management reports
  • antivirus status reports
  • patching status reports
  • asset inventory
  • the number of new users
  • help desk statistic reports

Further Guidance on Operational Planning and Control

ISO 27001 provides further guidance in its Annex A controls, which were revised in 2022 in conjunction with changes to the ISO 27002 standard. Annex A specifically identifies required operational processes. Adhering to the principle that “if it isn’t documented, it doesn’t exist,” every control in Annex A necessitates a corresponding documented process. While we won’t cover every control, the following examples illustrate the type of processes required.

ISO 27001 Annex A 5.24 Response to information security incidents

The organisation should plan and prepare for managing information security incidents by defining, establishing and communicating information security incident management processes, roles and responsibilities

ISO 27001 Annex A 5.24 Information security incident management planning and preparation

ISO 27001 Annex A 5.26 Response to information security incidents

Information security incidents should be responded to in accordance with the documented procedures.

ISO 27001 Annex A 5.26 Response to information security incidents

ISO 27001 Annex A 5.37 Documented operating procedures

Operating procedures for information processing facilities should be documented and made available to personnel who need them.

ISO 27001 Annex A 5.37 Documented operating procedures

ISO 27001 Annex A 5.32 Intellectual property rights

The organisation should implement appropriate procedures to protect intellectual property rights.

ISO 27001 Annex A 5.32 Intellectual property rights

This is usually the function of the legal department and part of good legal practice. Legal will have many requirements of their own but we are interested for ISO 27001 certification in ensuring that they have handled intellectual property rights as well as the legal register.

ISO 27001 Annex A 8.32 Change Management

Changes to information processing facilities and information systems should be subject to change management procedures.

ISO 27001 Annex A 8.32 Change Management

How do you demonstrate compliance to ISO 27001 clause 8.1?

It is very simple and straightforward to demonstrate compliance with ISO 27001 clause 8.1 operational planning and control.

Document all of your processes, have plans in place that you can evidence and have evidence of the processes operating as you have documented that they should.

Watch the Tutorial

Watch How to implement ISO 27001 Clause 8.1 Operational Planning and Control

ISO 27001 Templates

ISO 27001 templates are a great way to fast track your implementation and leverage industry best practice.

ISO 27001 Clause 8.1 FAQ

What is ISO 27001 Clause 8.1 Operational and Planning Control?

The organisation shall plan, implement and control operational processes and keep evidence of their effective operation. In addition the organisation shall implement change management and third party supplier management.

How do I evidence I meet the requirement of ISO 27001 Clause 8.1?

You evidence compliance to the ISO 27001 Clause 8.1 by having written and documented processes and procedures in place that say exactly what you do and cover the requirements of the ISO 27001 standard. In addition you have records and evidence of the operation of those processes and procedures so you can evidence that you actually do what you say you and that it works as intended.

Where can I download ISO 27001 Clause 8.1 templates?

You can download ISO 27001 Clause 8.1 templates in the ISO 27001 Toolkit.

ISO 27001 Clause 8.1 example?

An example of ISO 27001 Clause 8.1 can be found in the ISO 27001 Toolkit.

Do my ISO 27001 operational processes need to be documented in Microsoft Word?

No. You can document them in what ever way makes sense for your organisation. As long as they have the appropriate document mark up and controls in place.

My processes are in Monday / Jira / Other .. is that ok?

Yes. As long as they say what you do and you can evidence that you do it that is fine.

How often do I review ISO 27001 operational procedures and ISO 27001 operational processes?

You review them when ever anything changes and at least annually. When it comes to audit make sure that you can evidence they were reviewed at some point in the preceding 12 months to the audit. Can

Should I have one large document or many documents for ISO 27001 operational processes?

The standard does not care as long as they are documented so do what works best for you and your organisation. We recommend one document for small to mid sized organisations.

Further Reading

ISO 27001 Clause 8.1 Audit Checklist

ISO 27001 Toolkit

Stop Spanking £10,000s on consultants and ISMS online-tools

Share to...