Control 8.1Operational planning and control

Plan, implement and control the processes needed to meet requirements and to implement the actions determined in clause 6; and control planned changes and review the consequences of unintended changes, taking action to mitigate adverse effects as necessary. The organisation must ensure that externally provided processes, products or services relevant to the ISMS are controlled, and keep documented information to the extent necessary to have confidence that processes have been carried out as planned.

This is where planning becomes operation, and the phrase that does the work is “to the extent necessary to have confidence”. The standard asks for enough evidence to be confident, and leaves the amount to the organisation.

Reviewing the consequences of unintended changes is the clause’s sharpest edge. Planned change is managed by A.8.32; unintended change is what actually happens — a supplier alters a service, a cloud provider changes a default, a team adopts a tool. The requirement is to notice and to act, which presumes something is looking.

How to put this in place

Plans only count if the processes run as planned. This is the stage where controls start to produce records, and the records are the evidence.

Set the criteria and the way each process and control runs.
Run each process on its cycle and keep the records.
Control planned changes and review the effects of unplanned ones.
Make sure outsourced processes are controlled and you can see their records.
Check records exist for the full period.

Evidence an auditor usually looks for: records for the planned processes and controls over the audit period, including those of outsourced processes.

What is in the packs for this

From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.

ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 4 (Implement and operate) of the implementation plan, which sets out the work and the gate that closes the phase.
Mandatory ISMS Documentation ChecklistExcel
Required Documents sheet, item MD-10: the typical form, what auditors accept instead and the gaps they reliably find.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.