Clause 8 : Operation

Requirement
The organisation must plan, implement, and control the processes needed to meet requirements and implement the actions from Clause 6, by establishing criteria for those processes and implementing control in line with those criteria. Documented information must be available to the extent necessary to have confidence the processes were carried out as planned. The organisation must also control planned changes, review the consequences of unintended changes, take action to mitigate adverse effects, and ensure externally provided (outsourced) processes relevant to the ISMS are controlled.

How to Implement
Operationalise your risk treatment plan by rolling out the technical and organisational controls you selected in 6.1.3, embedding them into standard operating procedures, and assigning owners to each. For outsourced functions, such as a hosted IT environment or an outsourced SOC, put information security requirements into supplier contracts and monitor their performance. Build a change management process that requires security review before significant IT or process changes go live, and keep a record when unplanned changes occur so their impact can be assessed afterward.

Mandatory Documents
Yes, this is conditionally mandatory. ISO/IEC 27001:2022 states that “documented information shall be available to the extent necessary to have confidence that the processes have been carried out as planned.” This means you need operational records sufficient to demonstrate your processes ran as intended, such as:

• Standard operating procedures
• Change logs
• Supplier control evidence

The exact volume depends on how complex your organisation is.

Requirement

Requirement
The organisation must perform information security risk assessments at planned intervals, or when significant changes are proposed or occur, applying the criteria established in 6.1.2 a). The results must be retained as documented information.

How to Implement
Set a recurring schedule for risk assessments, annually is common, and trigger an additional ad hoc assessment whenever something significant changes, such as a new system going live, a major incident, or a new regulatory requirement. Use the same methodology and criteria defined in 6.1.2, so results stay comparable year over year.

Mandatory Documents
Yes, this is explicitly mandatory. ISO/IEC 27001:2022 states the organisation “shall retain documented information of the results of the information security risk assessments.” You must keep:

• Updated risk assessment results each time the process is run

Requirement
The organisation must implement the information security risk treatment plan, and the results must be retained as documented information.

How to Implement
Track progress against your Risk Treatment Plan from 6.1.3, noting which controls have been implemented, which are in progress, and which are overdue. Then update the plan as controls are completed or as new risks emerge from the periodic assessments in 8.2.

Mandatory Documents
Yes, this is explicitly mandatory. ISO/IEC 27001:2022 states the organisation “shall retain documented information of the results of the information security risk treatment.” You must keep:

• An updated record of risk treatment implementation status, alongside the Risk Treatment Plan itself