8.1 Operational planning and control
Plan, run and control the processes needed to meet requirements, including outsourced ones, and manage changes.
What auditors look for
Processes operate as designed; changes controlled.
Typical evidence
Procedures, change records, supplier controls.
Playbook
8.1 Operation planning and controlEvidence you need to provide
- Your plans and procedures for running security processes day to day.
- Records showing processes ran as planned.
- Change records and checks on outsourced processes.
- Be able to explain how you know processes are working as planned.
Policies & documents
- Information Security Policy (ISMS policy)
- Management review procedure
- Information security objectives plan
- Risk Management Policy
- Third-Party Management Policy
View full guide: 8.1 Operation planning and control
8.2 Information security risk assessment
Perform risk assessments at planned intervals and when significant changes happen.
What auditors look for
Assessments actually repeated and recorded.
Typical evidence
Dated risk assessment results.
Playbook
8.2 Information security risk assessmentEvidence you need to provide
- Your risk assessment schedule and triggers for extra assessments (such as big changes).
- Your latest risk assessment results, recorded in the risk register.
- Records of assessments done after significant changes.
- Be able to explain when the last assessment was done and why.
Policies & documents
- Risk assessment and treatment methodology
- Risk Management Policy
View full guide: 8.2 Information security risk assessment
8.3 Information security risk treatment
Implement the risk treatment plan and keep results.
What auditors look for
Treatment actions completed or tracked.
Typical evidence
Updated risk treatment plan, implementation evidence.
Playbook
8.3 Information security risk treatmentEvidence you need to provide
- Your risk treatment plan with its current status.
- Proof treatment actions were completed.
- Records of risk owners accepting the remaining risk after treatment.
- Be able to explain how completed treatments are checked.
Policies & documents
- Risk assessment and treatment methodology
- Statement of Applicability (SoA)
View full guide: 8.3 Information security risk treatment
