Clause 8.1 Operational planning and control
Clause 8.1 in ISO 27001:2022 (ISO/IEC 27001:2022). All ISO 27001:2022 controls held. Open ISO 27001:2022 on the standards site.
The control as we hold it
Operational planning and control. The organization must plan, run and keep under control the processes that meeting its requirements depends on and to carry out the actions set in Clause 6, by setting criteria for those processes and controlling them according to the criteria. Documented information must be available to the extent needed to be confident the processes ran as planned. Planned changes are controlled, the consequences of unintended changes are reviewed with action taken to limit adverse effects, and externally provided processes, products or services relevant to the ISMS are controlled.
Reviewed and closest counterparts in the other frameworks
We hold no cross-framework row for Clause 8.1 yet. The reviewed pairs page lists the released pairs and their coverage.
What an auditor commonly asks for
General guidance for this control area (domain: Clause 8), in our words, not a statement of the standard and not binding on an assessor.
- Process criteria and operating procedures for ISMS processes and planned actions
- Records showing processes were carried out as planned
- Change records for planned changes and reviews of unintended changes with mitigating action
- Controls over outsourced or externally provided processes, products and services relevant to the ISMS