ISO 27001 clauses
Clause 8 is where the plan meets the calendar.
Clause 6 has you design a risk method and a treatment plan. Clause 8 asks whether you actually run them: on a schedule, when something changes, and through the suppliers who do part of the work for you. It is a short clause with a long evidence trail, and it is where many first-time ISMS teams discover that a plan on paper is not the same as a process in motion.
Back to ISO 27001 services01 · Three parts
What the three sub-clauses ask for
One about running processes under control, two about doing the risk work for real.
- 8.1 Operational planning and control
- Set criteria for the processes that deliver your security requirements, run them to those criteria, keep enough records to show they ran as intended, manage planned change, and keep control of anything outsourced.
- 8.2 Information security risk assessment
- Carry out the assessment you designed in clause 6, at planned intervals and whenever a significant change is proposed or happens, and keep the results.
- 8.3 Information security risk treatment
- Put the treatment plan into effect and keep the results, so an auditor can see risks moving from planned to treated.
The method itself, scales, criteria and owner sign-off, belongs on our risk assessment and treatment guide. The controls you implement have their own pages too. This page is about the operating rhythm that ties them together.
02 · Activity, trigger, record
What runs, what sets it off, and what it leaves behind
An illustrative operating calendar. Your intervals are your own choice; the auditor checks you kept them.
| Planned activity | Trigger | Record it leaves |
|---|---|---|
| Full risk assessment | Planned interval set in your method, commonly yearly | Dated risk register version with owners' scores |
| Targeted risk reassessment | New product, new hosting region, acquisition, major supplier change | Change-linked assessment entry and updated register rows |
| Risk treatment actions | Approved treatment plan | Tickets or tasks closed with owner and date |
| Residual risk acceptance | Treatment complete or deferred | Risk owner's documented approval |
| Statement of Applicability update | Control added, removed or changed in status | New SoA version with reason for change |
| Supplier security review | Onboarding, renewal or a supplier incident | Review record, contract clause, follow-up actions |
| Change to an in-scope system | Change request raised | Approved change record with security assessment |
| Unplanned change review | A change made outside process, such as an emergency fix | Post-change review and any corrective action |
Write your triggers into the risk method. If the method says a new hosting region prompts reassessment, the auditor will look for that reassessment when they see the new region.
03 · Outsourced work
Controlling the processes someone else runs
Outsourcing moves the work, not the accountability.
Clause 8.1 expects you to identify externally provided processes, products and services that matter to the ISMS and to keep them under control. Think of a managed security operations provider watching your alerts, a cloud provider running your infrastructure, or a payroll firm handling employee data. Their part of the process still has to meet your criteria.
- List which ISMS-relevant activities are outsourced and to whom.
- Decide what criteria each must meet, and put them in the contract or service schedule.
- Choose how you will check: their assurance report, a questionnaire, service reviews, or your own testing.
- Record the checks and what you did about anything that fell short.
The detailed supplier controls sit in Annex A and on our supplier security guide. Clause 8 simply makes sure the outsourced piece is inside your operating rhythm rather than outside it.
04 · Planned and unplanned change
Change, planned and otherwise
Planned change is controlled in advance. Unplanned change is reviewed afterwards.
Planned change
- Assessed for security impact before it happens
- Approved by the right owner
- May trigger a targeted risk reassessment
Unintended change
- Spotted through monitoring or review
- Consequences assessed after the event
- Action taken to limit harm, and recorded
An emergency hotfix pushed at midnight is not a failure of clause 8 in itself. A hotfix that nobody ever reviewed is.
05 · What auditors sample
The evidence of operation an auditor samples
Clause 8 findings almost always come from a gap between a schedule and a record.
- The last risk assessment. Its date against the interval in your method, and whether owners, not the ISMS lead alone, scored their risks.
- A change that should have triggered reassessment. The auditor picks a known change and looks for the matching risk entry.
- Treatment plan progress. A sample of actions, checked for owner, due date and closure evidence.
- Residual risk sign-off. Named owners accepting what is left, not a blanket approval.
- Outsourced processes. One or two suppliers, traced from contract criteria to the latest review.
- Process records. Runbooks or criteria for a security process, and records showing it ran to them.
06 · Mistakes
Where clause 8 goes wrong
The common failures are about rhythm, not method.
- One risk assessment, done for certification. Never repeated, so the register describes a company that no longer exists.
- No written triggers. Big changes happen with no reassessment, because nobody agreed what counts as significant.
- Treatment plan with no dates. Actions sit open for a year with nothing to show they are moving.
- Outsourcing treated as out of scope. The supplier runs a key process and the ISMS never checks it.
- SoA frozen at Stage 2. Controls change status in reality but the SoA still shows the old picture.
Sources: ISO/IEC 27001:2022, clause 8 (operation) and sub-clauses 8.1 to 8.3, with clauses 6.1.2 and 6.1.3 for the planned risk processes, described in our own words.
Questions about clause 8
How often must the risk assessment be repeated?
At intervals you plan, and on significant change.
The standard does not set a number. You choose the interval in your risk method and name the changes that trigger an extra assessment. A yearly cycle is common practice, and the auditor checks that you kept to what you chose.
Is clause 8 the same as implementing Annex A?
No. It is the operating discipline around the controls.
Annex A lists controls you may select. Clause 8 is about running the risk processes and the treatment plan that decide which controls you need and keeping those processes under control. The two meet in the treatment plan.
What counts as a significant change?
Whatever your method defines, written in advance.
Typical examples are a new product line, a new data type such as health or payment data, a new hosting region, a merger, or replacing a key supplier. Write the list into your method so the decision is not made after the change.
Do we need a separate operations manual for clause 8?
No. Records from your normal tools usually suffice.
Clause 8.1 asks for enough documented information to show processes ran as planned. Tickets, change records, the risk register history and supplier review notes normally cover it without a new manual.
Turn your risk plan into a running process.
An ISO 27001 gap analysis tests whether your risk work runs on schedule and leaves the records an auditor will sample.