Operational Planning and Control (ISO/IEC 27001 Clause 8.1): A Complete Guide for Lead Auditors
Introduction
Operational Planning and Control is the opening requirement of Clause 8 (Operation) in ISO/IEC 27001:2022. It turns the intentions set out in Clause 6 (Planning) into day-to-day practice. In the Plan-Do-Check-Act (PDCA) cycle, Clause 8.1 is the core of Do. Clauses 4 to 7 describe what the organization wants and what it has prepared. Clause 8.1 is where an auditor checks whether those plans are actually carried out, in a controlled and repeatable way.
Why Operational Planning and Control Is Important
1. It closes the gap between paper and practice. Many organizations have a well-written risk treatment plan and policies, yet controls are not applied consistently. Clause 8.1 requires processes to be planned, implemented and controlled against defined criteria, so the ISMS is lived rather than just documented.
2. It makes outcomes predictable. When there are clear criteria, such as procedures, acceptance thresholds, schedules and responsibilities, the results of security processes become consistent and measurable. This feeds monitoring and measurement in Clause 9.1.
3. It manages change risk. Many security incidents start with poorly controlled changes, for example a firewall rule altered without review or a system migrated without a risk assessment. Clause 8.1 requires planned changes to be controlled and unintended changes to be reviewed and mitigated.
4. It extends control beyond the organization. Cloud services, managed service providers and outsourced development all carry information security risk. Clause 8.1 requires externally provided processes, products or services relevant to the ISMS to be controlled. Outsourcing an activity does not outsource accountability.
5. It provides audit evidence. The requirement for documented information gives auditors objective evidence that processes were performed as planned. This evidence is central to Stage 2 and surveillance audits.
What It Is: The Requirement Explained
Clause 8.1 of ISO/IEC 27001:2022 requires the organization to:
• Plan, implement and control the processes needed to meet requirements and to implement the actions determined in Clause 6. These include actions to address risks and opportunities (6.1), information security objectives (6.2) and planning of changes (6.3).
• Establish criteria for those processes. Examples include procedures, standards, performance thresholds, approval rules, frequencies and roles.
• Implement control of the processes in accordance with the criteria. Processes must actually be run the way the criteria say they should be.
• Make documented information available to the extent necessary to have confidence that the processes have been carried out as planned. Examples include records, logs, tickets, checklists and reports.
• Control planned changes and review the consequences of unintended changes, taking action to mitigate any adverse effects as necessary.
• Ensure that externally provided processes, products or services that are relevant to the ISMS are controlled.
Key 2022 changes to remember: The 2013 wording referred to 'outsourced processes'. The 2022 version uses the broader term 'externally provided processes, products or services'. The 2022 version also adds the explicit requirement to establish criteria and to control processes against them, which aligns with the ISO Harmonized Structure. The 2013 reference to implementing plans to achieve objectives now sits more clearly in Clause 6.2, while Clause 8.1 still requires the actions from Clause 6 to be implemented.
Relationship with Other Clauses
• Clause 6.1 / 6.1.2 / 6.1.3: These clauses plan the risk assessment and risk treatment processes. Clause 8.1 requires them to be put into operation.
• Clause 6.2: Objectives are planned there. The operational processes in 8.1 deliver them.
• Clause 6.3: Changes to the ISMS must be planned. Clause 8.1 controls changes during operation.
• Clause 7.5: This clause sets the rules for documented information. Clause 8.1 specifies what evidence is needed.
• Clause 8.2: Information security risk assessments must be performed at planned intervals or when significant changes occur.
• Clause 8.3: The risk treatment plan must be implemented and the results retained.
• Clause 9.1: This clause monitors whether operational processes perform against their criteria.
• Annex A links: Common supporting controls include 5.19 to 5.23 (supplier relationships and cloud services), 5.37 (documented operating procedures), 8.32 (change management), 8.9 (configuration management) and 5.1 to 5.3 (policies and roles).
How It Works in Practice
Step 1: Identify the processes. The organization identifies which processes are needed to meet ISMS requirements and deliver the Clause 6 actions. Examples include access provisioning, backup, vulnerability management, incident management, supplier onboarding, change management and the risk assessment process itself.
Step 2: Define criteria. For each process the organization sets out how it should run and what a good result looks like. Examples include 'critical patches applied within 14 days', 'access requests approved by the asset owner' and 'backups tested quarterly'.
Step 3: Implement and control. Staff run the processes according to the criteria. Controls such as approvals, segregation of duties, automated checks and supervision keep execution on track.
Step 4: Keep evidence. The organization retains records that give confidence the processes ran as planned. Examples include change tickets, access approval logs, backup test reports and supplier review minutes.
Step 5: Manage change. Planned changes go through a defined process covering impact and risk assessment, approval, testing, rollback and communication. Unintended changes, such as an unauthorized configuration change or an emergency fix, are reviewed and their adverse effects are mitigated.
Step 6: Control external providers. The organization determines which external services are relevant to the ISMS and applies controls. These can include contractual security requirements, due diligence, SLAs, right-to-audit clauses, SOC 2 or ISO 27001 certificates, performance monitoring and periodic reviews. The type and extent of control should be proportionate to risk.
How an Auditor Assesses Clause 8.1
• Trace from plan to practice. The auditor selects risk treatment actions and objectives from Clause 6 and verifies that they are operating. For example, if the risk treatment plan says MFA will be deployed by Q2, the auditor checks the MFA configuration and its coverage.
• Ask for the criteria. Typical questions are 'How do you know this process is done correctly?' and 'What is the defined standard or threshold?'
• Sample records. Following ISO 19011 principles, the auditor takes samples. Examples include 10 changes from the last quarter, recent joiners and leavers, and backup restore tests. Each sample is compared against the criteria.
• Test change control. The auditor looks for changes that bypassed the process, emergency changes without retrospective review, and changes with no risk assessment.
• Check external providers. The auditor identifies outsourced or cloud services in scope, then reviews contracts, security requirements and evidence of monitoring.
• Interview and observe. The auditor confirms that staff understand and follow the procedures, not just that documents exist.
Typical Nonconformities
• The risk treatment plan is approved but several actions are not implemented, with no evidence of progress. This is often major if it is systemic.
• There are no defined criteria for key processes, so performance cannot be judged.
• Changes to production systems are made without approval or risk assessment.
• An unauthorized change caused an outage but was never reviewed or mitigated.
• A critical cloud provider hosts sensitive data, but there are no security requirements in the contract and no monitoring.
• Records are insufficient to show processes were performed as planned. For example, backup tests are claimed but not evidenced.
Exam Tips: Answering Questions on Operational Planning and Control
1. Know the clause number and its position. Clause 8.1 is the first requirement of Operation and represents the Do phase of PDCA. Do not confuse it with 6.1 (planning risk actions), 8.2 (performing risk assessments) or 8.3 (implementing risk treatment).
2. Memorize the five core elements. These are: (a) plan, implement and control processes, including the Clause 6 actions; (b) establish criteria and control against them; (c) documented information to the extent necessary for confidence; (d) control planned changes and review unintended changes; (e) control externally provided processes, products or services.
3. Watch the wording 'to the extent necessary'. The standard does not require a document for everything. If an answer option says 'a documented procedure is mandatory for every process', it is usually wrong.
4. Outsourcing does not remove responsibility. If a scenario says 'the supplier is certified, so we do nothing', look for the answer that requires the organization to determine and apply appropriate control. A certificate can be evidence, but it does not replace control.
5. Distinguish planned and unintended changes. Planned changes must be controlled before they happen. Unintended changes must be reviewed afterward, with action taken to mitigate adverse effects. Exam questions often test this difference.
6. In scenario questions, think like an auditor. Ask what the requirement is, what the evidence shows, and whether the gap is a nonconformity. Quote the clause precisely, for example 'Clause 8.1 requires the organization to control planned changes', and describe the objective evidence.
7. Grade nonconformities correctly. A single unapproved change in an otherwise effective process is typically minor. A complete absence of change control, or Clause 6 risk treatment actions that are systematically not implemented, suggests the process is failing to achieve its intended results and is likely major.
8. Link to Annex A where relevant, but cite the clause first. For example, a missing change process may involve control 8.32, but the management system requirement is Clause 8.1. Lead auditor exams reward recognizing both.
9. Use the 2022 terminology. Say 'externally provided processes, products or services' rather than only 'outsourced processes'. Mention the requirement to establish criteria for processes.
10. Structure essay answers clearly. A good structure is: (i) state what Clause 8.1 requires; (ii) explain why it matters, covering consistency, risk control, change and suppliers; (iii) describe the evidence an auditor would seek; (iv) give a practical example; (v) state the audit conclusion or finding.
11. Suggest relevant audit evidence. Typical evidence includes change tickets and CAB minutes, operating procedures, risk treatment plan status, supplier contracts and review records, backup and patch reports, and interview notes.
12. Avoid recommending solutions as an auditor. In lead auditor exams, the auditor identifies nonconformities and does not prescribe fixes. Choose answers that record findings objectively rather than tell the auditee how to correct them.
Example Exam Scenario
During a Stage 2 audit, you find that the IT team migrated the customer database to a new cloud provider last month. There was no risk assessment, and the provider contract has no security clauses. How would you report this?
Model answer: This is a nonconformity against Clause 8.1. The organization did not control a planned change, because no risk assessment or approval was performed, which also relates to Clause 8.2 (assessment when significant changes occur). It also did not ensure that an externally provided service relevant to the ISMS is controlled. The objective evidence is the migration record dated last month, the absence of a risk assessment, and contract reference X with no security requirements. Given the sensitivity of customer data and the absence of any control, the auditor may grade this as major if it indicates a systemic failure of change and supplier control. Otherwise, it may be graded as minor if change control is generally effective. Related Annex A controls are 8.32 and 5.19 to 5.23.
Summary
Clause 8.1 ensures the ISMS is executed in practice. Processes run against defined criteria, evidence shows they ran as planned, changes are managed, and external providers are controlled. For the exam, remember its five elements, its place in PDCA and its links to Clauses 6, 8.2 and 8.3. Apply an evidence-based auditor mindset to every scenario.
