Operational planning and control

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

The organization must plan, run and keep under control the processes that meeting its requirements depends on and to carry out the actions set in Clause 6, by setting criteria for those processes and controlling them according to the criteria. Documented information must be available to the extent needed to be confident the processes ran as planned. Planned changes are controlled, the consequences of unintended changes are reviewed with action taken to limit adverse effects, and externally provided processes, products or services relevant to the ISMS are controlled.

How the 2020 guidance taught the audit

Auditors confirm that the organization plans, implements and controls the processes needed to meet ISO/IEC 27001 and its information security requirements within its operations and to deal with its priority risks and opportunities, and that operational controls include methods and information security controls that keep business operations, activities or equipment within set conditions, performance standards or regulatory limits. Such controls fix the technical specifications, operating parameters or prescribed methods a process needs; they are required wherever their absence could cause deviation from policy and objectives or unacceptable risk, whether in operations, production, installation, service, maintenance or work by contractors, suppliers or vendors, and their degree varies with the function, its importance and complexity, the consequences of deviation and available skills. Auditors confirm that the actions from 6.1 and the plans for the objectives from 6.2 are carried out, that documentation is kept so the organization can be confident processes and controls ran as planned, that planned changes are controlled and the effects of unintended ones reviewed and mitigated, that action is taken against adverse effects when an operational control fails, and that processes handed to outside providers are identified and kept under control, with control possibly limited to partial control or influence and without changing the legal relationship with the outside provider.

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

The 2022 clause adds criteria for the processes and control of the processes against those criteria, and makes the control of planned changes and the review of unintended changes explicit.

Evidence an auditor asks for

• OperationOperating procedures, technical specifications or parameters for security-relevant processes
• OperationRecords showing processes and controls ran as planned
• OperationChange management records with review of unintended change
• OperationDetermination and control records for outsourced processes, including contracts and monitoring

The questions an auditor will ask

Pick a process and ask for its criteria, its control evidence and a change that was reviewed after it took effect.

Common gaps

• Planned actions from 6.1 and 6.2 never implemented in operations
• No retained evidence that processes ran as planned
• Changes made without assessing their security effect
• Outsourced processes neither listed nor controlled

Prepare before the next audit

Document the criteria for the processes that carry information security risk, and test one change end to end.

Cross-references