In this article we lay bare ISO27001 Clause 8.1 Operational Planning and Control. Exposing the insider trade secrets, giving you the templates that will save you hours of your life and showing you exactly what you need to do to satisfy it for ISO27001 certification. We show you exactly what changed in the ISO27001:2022 update. I am Stuart Barker the ISO27001 Ninja and this is ISO27001 Clause 8.1
Table of contents
- What is ISO27001 Clause 8.1?
- What are the ISO27001:2022 Changes to Clause 8.1?
- ISO27001 Clause 8.1 Definition
- ISO27001 Annex A / ISO27002 2022 Guidance on Operational Planning and Control
- How to comply with ISO27001 Clause 8.1
- ISO27001 Clause 8.1 Implementation Guide
- How do you demonstrate compliance to ISO27001 clause 8.1?
- ISO27001 Clause 8.1 Template
- ISO27001 Clause 8.1 FAQ
- ISO27001 Certification Requirements
- See Also
- Reference
What is ISO27001 Clause 8.1?
The ISO27001 standard requires an organisation to plan, implement and control the processes needed to meet the requirements of Information Security.
So ISO27001 Clause 8.1 Operational Planning and Control is all about processes. Document ISO27001 operational processes, implementing ISO27001 operational processes, running ISO27001operational processes and being able to evidence that they are affective. ISO27001 clause 8.1 also includes change management and outsourced process management.
What are the ISO27001:2022 Changes to Clause 8.1?
The changes to ISO27001 Clause 8.1 in the 2022 update are clarification changes and nothing material.
The wording on planning and implementing and controlling processes is widened to the more general wording of ‘meet requirements’ rather than before which was ‘meet information security requirements’.
It now talks to establishing cirtieria for the processes and implementing control of processes in line with those criteria.
Rather than keep documented information it is changed to documented information shall be available.
Outsourced processes are determined and controlled is changed to externally provided processes, products or services that are relevant to the information security management system are controlled.
ISO27001 Clause 8.1 Definition
The ISO27001 standard defines clause 8.1 as:
The organisation shall plan, implement and control the processes needed to meet information security requirements, and to implement the actions determined in clause 6 by
– establishing criteria for processes
– implementing control of the processes in accordance with the criteria
Documented information shall be available to the extent necessary to have confidence that the processes have been carried out as planned.
The organisation shall control planned changes and review the consequences of unintended changes, taking action to mitigate any adverse effects, as necessary.
The organisation shall ensure that externally provided processes, products or services that are relevant to the information security management system are controlled
ISO27001 Clause 8.1 Operational Planning and Control
ISO27001 Annex A / ISO27002 2022 Guidance on Operational Planning and Control
There is further guidance provided in the ISO27001 Annex A Controls that was revised in 2022 with changes to the ISO27002 standard and specifically calls out required operational processes. We are working to the principle that if it is not written down it does not exist so every process will need to be considered which in reality means that every control of the ISO27001 Annex A will require a process to be covered by a process. We will not cover the entirety but to get a flavour, let’s take a look at a sample of what Annex A says.
ISO27002 Clause 5.24 Response to information security incidents
The organization should plan and prepare for managing information security incidents by defining, establishing and communicating information security incident management processes, roles and responsibilities
ISO27002 Clause 5.24 Information security incident management planning and preparation
ISO27002 Clause 5.26 Response to information security incidents
Information security incidents should be responded to in accordance with the documented procedures.
ISO27002 Clause 5.26 Response to information security incidents
ISO27002 Clause 5.37 Documented operating procedures
Operating procedures for information processing facilities should be documented and made available to personnel who need them.
ISO27002 Clause 5.37 Documented operating procedures
ISO27002 Clause 5.32 Intellectual property rights
The organization should implement appropriate procedures to protect intellectual property rights.
ISO27002 Clause 5.32 Intellectual property rights
This is usually the function of the legal department and part of good legal practice. Legal will have many requirements of their own but we are interested for ISO27001 certification in ensuring that they have handled intellectual property rights as well as the legal register.
ISO27002 Clause 8.32 Change Management
Changes to information processing facilities and information systems should be subject to change management procedures.
ISO27002 Clause 8.32 Change Management
How to comply with ISO27001 Clause 8.1
Time needed: 1 day.
How to comply with ISO27001 Clause 8.1 Guide to Operational Planning and Control
- Document all of your operational processes
In a document with appropriate mark up and version control document the operational processes of the business. Make sure you document what you do, not what you think an auditor wants to hear. You can only be audited against what you say you do so be sure you do it. Write clear and concise steps that anyone could follow to achieve the same process results and outcomes. Always include at least one exception step that covers what happens if a part of the process fails or does not operate as intended. You will need to document not only the information security processes but any process that covers the ISO27001 in scope products and services. It is covered by the ISO27001 scope statement then it needs documenting.
- Ensure your process documents are reviewed and approved
Process documents are part of the information security management system and they should be reviewed and approved and part of the review and approval cycle.
- Keep evidence of the process operating
When you come to the audit the auditor will want to see evidence of the operation of the process. This could be tickets in a ticket system, operational performance reports, copies of emails. What ever the artefacts referenced in the process are make sure that you can show copies of at least one of them.
- Audit your operation processes
You are required to audit your operational processes at least once annually and then based on need and business risk. Be sure that you have conducted the audit, documented and followed the continual improvement process.
- On Ending Employment / Engagement
Ensure that at the end of employment or the end of engagement that you communicate the contractual obligations that are, and will remain, in play in regards to information security.
- ISO27001 Continual Improvement
Continually update your communication plan to respond to known threats, risks and issues.
- Implement Change Management
In line with the Change Management Policy and best practice document and implement a change management process ensuring that changes go through the process and you can evidence the operation of the change process at audit time.
- Implement Third Party Supplier Management
In line with the Third Party Supplier Policy and best practice document and implement a third party supplier process ensuring you have the controls and reporting mechanisms in place to the extent that you can evidence the operation of the supplier management process at audit time.
ISO27001 Clause 8.1 Implementation Guide
There are many ways to document and evidence operational control. Consider the best methods for you.
When documenting operational processes you can have all your operational processes documented in one document called the Operations Manual (Ops Manual). This approach is great for smaller businesses.
Alternatively you can have many documents spread out in, and embedded in, the business and the operational areas where the processes are executed. This is more suited to a large organisation with teams and more people.
Consider it as a centralised or decentralised approach with the associated pros and cons of those kinds of implementation.
Finally there is always a hybrid approach where some processes are in the business but the ops manual remains the ‘shop window’ or the main reference point for those processes for management and control.
How do you demonstrate compliance to ISO27001 clause 8.1?
It is very simple and straightforward to demonstrate compliance with ISO27001 clause 8.1 operational planning and control.
Document all of your processes, have plans in place that you can evidence and have evidence of the processes operating as you have documented that they should.
ISO27001 Clause 8.1 Template
ISO27001 templates are a great way to implement your information security management system. Whilst an ISO27001 toolkit can save you up to 30x in consulting fees and allow you to deliver up to 10x faster these individual templates help meet the specific requirements of ISO27001 clause 8.1
ISO27001 Clause 8.1 FAQ
The organisation shall plan, implement and control operational processes and keep evidence of their effective operation. In addition the organisation shall implement change management and third party supplier management.
You evidence compliance to the ISO27001 Clause 8.1 by having written and documented processes and procedures in place that say exactly what you do and cover the requirements of the ISO27001 standard. In addition you have records and evidence of the operation of those processes and procedures so you can evidence that you actually do what you say you and that it works as intended.
You can download ISO27001 Clause 8.1 templates here: https://hightable.io/product/iso-27001-templates-toolkit/
An example of ISO27001 Clause 8.1 can be found here: https://hightable.io/product/iso-27001-templates-toolkit/
No. You can document them in what ever way makes sense for your organisation. As long as they have the appropriate document mark up and controls in place.
Yes. As long as they say what you do and you can evidence that you do it that is fine.
You review them when ever anything changes and at least annually. When it comes to audit make sure that you can evidence they were reviewed at some point in the preceding 12 months to the audit. Can
The standard does not care as long as they are documented so do what works best for you and your organisation. We recommend one document for small to mid sized organisations.
ISO27001 Certification Requirements
ISO27001 Certification Requirements set out clause by clause with these complete beginner’s guides that include everything you need to know, what to do and ISO27001 templates.
- ISO 27001 Clause 4.1 Understanding The Organisation And Its Context
- ISO 27001 Clause 4.2 Understanding The Needs And Expectations Of Interested Parties
- ISO 27001 Clause 4.3 Determining The Scope Of The Information Security Management System
- ISO 27001 Clause 4.4 Information Security Management System (ISMS)
- ISO 27001 Clause 5.1 Leadership And Commitment
- ISO 27001 Clause 5.2 Information Security Policy
- ISO 27001 Clause 5.3 Organisational Roles, Responsibilities And Authorities
- ISO 27001 Clause 6 Planning
- ISO 27001 Clause 6.1.1 Planning General
- ISO 27001 Clause 6.1.2 Information Security Risk Assessment
- ISO 27001 Clause 6.1.3 Information Security Risk Treatment
- ISO 27001 Clause 6.2.1 Information Security Objectives And Planning To Achieve Them
- ISO 27001 Clause 7.1 Resources
- ISO 27001 Clause 7.2 Competence
- ISO 27001 Clause 7.3 Awareness
- ISO 27001 Clause 7.4 Communication
- ISO 27001 Clause 7.5.1 Documented Information
- ISO 27001 Clause 7.5.2 Creating And Updating Documented Information
- ISO 27001 Clause 7.5.3 Control Of Documented Information
- ISO 27001 Clause 8.1 Operational Planning And Control
- ISO 27001 Clause 8.2 Information Security Risk Assessment
- ISO 27001 Clause 8.3 Information Security Risk Treatment
- ISO 27001 Clause 9.1 Monitoring, Measurement, Analysis, Evaluation
- ISO 27001 Clause 9.2 Internal Audit
- ISO 27001 Clause 9.3 Management Reviews
- ISO 27001 Clause 10.1 Nonconformity And Corrective Action
- ISO 27001 Clause 10.2 Continual Improvement
See Also
- Guaranteed ISO 27001 Certification up to 10x Faster and 30x Cheaper
- The Ultimate ISO 27001 TOOLKIT so you can do it yourself
- ISO 27001 Exposed: The facts you must know (Not knowing these could cost you $10,000s!)
- 25 Things You Must Know Before Going for ISO 27001 Certification (Number 3 will blow your mind!)
- The Ultimate Reference Guide to ISO 27001 Controls
Reference
ISO/IEC 27001 Information Security Management
