ISO 27001 Clause 8 — Operation
Where the plans made in clause 6 become things that actually happen, repeatably, with evidence
Clause 8 is the shortest of the operational clauses and the one an auditor can test most directly. Clause 6 decided what should happen. Clause 8 is the requirement that it does.
Three sub-clauses, and a clean division of labour with clause 6: 6.1.2 defines the risk assessment process, 8.2 requires it to be run and the results kept; 6.1.3 defines the treatment process and produces the plan, 8.3 requires the plan to be implemented. 8.1 covers everything else the ISMS does operationally.
The sub-clauses
8.1 — Operational planning and control
Plan, implement and control the ISMS processes with established criteria; control planned changes and review unintended ones; control externally provided processes.
8.2 — Information security risk assessment
Perform risk assessments at planned intervals or when significant changes are proposed or occur, and retain the results.
8.3 — Information security risk treatment
Implement the risk treatment plan and retain documented information of the results.
The clause that separates a certified ISMS from a working one
An auditor testing clause 8 takes your risk treatment plan, picks a line, and asks to see it working. Everything else in the standard can be satisfied with documents; this cannot. A plan whose actions are repeatedly re-dated, or a Statement of Applicability that marks controls implemented when they are not, is found within minutes and casts doubt on everything else.
The second thing they look for is integration. If change management, joiner-mover-leaver and incident handling live entirely outside the ISMS, then clause 8.1 has no processes to control and the integration required by clause 5.1 is missing.
Unintended change — the part usually missing
Clause 8.1 requires the organisation to control planned changes and to review the consequences of unintended changes, taking action to mitigate adverse effects. Most change processes handle the first and nothing at all for the second.
Unintended change is where configuration drift lives: the firewall rule added out of process, the test environment that quietly acquired production data, the permission never revoked. It needs a named mechanism — monitoring, reconciliation, post-incident review — not just a policy saying changes should be controlled.
Define what “significant” means before you need it
Clause 8.2 triggers a risk assessment at planned intervals or when significant changes are proposed or occur. The word proposed puts the assessment before the change, while the design can still move.
Left undefined, “significant” becomes a judgement made under deadline pressure by whoever wants the change to proceed. Write the definition down in advance; it costs nothing and it is what keeps the trigger real.
Frequently asked questions
How much documentation does clause 8 require?
Enough to be confident the processes were carried out as planned — that is the standard’s own test, and it means the answer differs by process and by organisation. Results of risk assessment and of risk treatment must be retained specifically.
What counts as an externally provided process?
Anything relevant to the ISMS that someone else performs: managed hosting, outsourced IT support, a payroll provider handling personal data, a SOC service. Accountability does not transfer with the activity.
How often must the risk assessment be repeated?
At planned intervals — annual is the common baseline — and additionally whenever a significant change is proposed or occurs. Honouring the interval and ignoring the change trigger satisfies half the clause.
What if a treatment action cannot be completed?
Record why, reassess the risk, and have the risk owner decide: accept the higher residual risk, or resource the action. Silently re-dating it is the failure mode auditors look for.
Operational integration is what makes an ISMS survive contact with the business. The Practitioner course is aimed squarely at it. Contact us for advice on where yours stands.
Where this sits
This page explains the requirement in our own words, for study and orientation. It is not a substitute for the standard: the authoritative text is ISO/IEC 27001:2022, available from ISO and from national standards bodies.
