ISO 27001 Clause 8: Keep ISMS Risk Treatment Working Through Operational Change
Clause 8 moves the ISMS from planned arrangements into operation. It requires the organisation to control relevant processes, carry out risk assessments when needed and implement risk treatment. This is where a security commitment in a proposal must become something that people actually do, including when suppliers, systems or working practices change.
What clause 8 requires in practice
Clause 8 is where the plans made earlier turn into day-to-day operation. It contains three requirements that work together.
- Operational planning and control: processes needed to meet requirements and carry out the actions from clause 6 are planned, run against set criteria and kept under control, including planned changes, unintended changes and externally provided processes, products or services.
- Risk assessment: information security risk assessments are carried out at planned intervals and whenever significant changes are proposed or happen, with results retained.
- Risk treatment: the treatment plan is actually implemented, and results are retained.
In practice the clause tests whether the ISMS is lived rather than described. The outputs are controlled operations, current assessments and treatments that have really been carried out. Specific techniques, tools and review intervals are not prescribed; the organisation chooses them to suit its context.
8.1: control the processes that deliver the plan
The organisation must plan, implement and control processes needed to meet requirements and carry out the actions determined in clause 6. It establishes process criteria and operates in accordance with them. Documented information must be available to the extent needed for confidence that work happened as planned. A policy describing intentions is therefore different from evidence of actual operation.
Suggested practice is to define what makes an activity ready to proceed and how an exception is handled. For a supplier connection, this might involve confirming the approved purpose, access conditions and responsible owner before activation. The criteria should come from the organisation's requirements and risk decisions, not from assuming that every business needs an identical approval checklist.
Planned changes must be controlled, and the consequences of unintended changes reviewed with action to reduce adverse effects where necessary. Relevant externally provided processes, products and services also require control. Outsourcing may alter how evidence is obtained, but it does not remove the organisation's need to understand and manage the dependency.
A hypothetical cloud migration
Consider a software provider moving customer reporting to a new hosted environment. The migration changes administration, logging and backup responsibilities. Before moving data, the team needs to establish which arrangements are necessary and whether the receiving environment can support them. A contract signature alone does not establish that access roles, recovery arrangements and change communications are operating as intended.
During the move, an unplanned integration creates another data transfer. A functioning operational process identifies the deviation and reviews its consequences, rather than treating the migration approval as permission for every later change. The response may involve pausing a particular activity, obtaining specialist review or changing controls. These are illustrative possibilities; the appropriate action depends on the actual situation and authority.
8.2: repeat risk assessment when the conditions require it
Risk assessments must take place at planned intervals and when significant changes are proposed or occur, using the established criteria. Retain their results. The timing therefore cannot be reduced to “once before certification”. Nor does clause 8.2 impose the same calendar interval on every organisation. The arrangements should make significant change visible to the people responsible for assessment.
In the migration example, reassessment should consider the changed responsibilities and information flows. Simply updating the provider's name in a register would miss the reason for reviewing risk. Compare assumptions with evidence: who can administer the environment, where information is processed and how recovery will be achieved? If those facts remain uncertain, record and resolve the uncertainty rather than assign reassuring scores without basis.
8.3: carry out treatment and retain the results
The information security risk treatment plan must be implemented, with documented information retained about treatment results. This connects the decisions in clause 6 with actual changes in processes and controls. An assigned task or purchase order is not necessarily evidence that treatment is complete. The relevant evidence depends on what the response was intended to achieve.
For a new recovery arrangement, evidence might include approved configuration information and a suitable recovery exercise. For a revised supplier handover, it might include an examined sample showing that the handover works. These examples are not universal record requirements. They illustrate how to select evidence that answers the question behind the treatment decision.
In a second illustrative case, a manufacturer introduces remote supplier maintenance during overnight shutdowns. Operational planning needs to connect engineering's work order with access approval, the supplier's activity and closure evidence. Reusing daytime arrangements without checking who is available could leave a control gap. The significant change also needs consideration through the established risk assessment process.
Why operation matters to the business
A security commitment made in a proposal or a policy only has value if it holds when systems change, suppliers are replaced and teams reorganise. Clause 8 is where that is tested, and it is also where most real incidents originate, usually through an unreviewed change or a dependency nobody watched. Customers and regulators judge an organisation on what it does during such moments. Strong operational control reduces surprises and the cost of emergency fixes, keeps risk decisions current as the business evolves and gives management confidence that the risk treatment it approved is genuinely in place. In audits, this clause usually separates organisations with a working ISMS from those with a well-written one.
How to implement clause 8
Begin with the changes and dependencies that matter most, then widen control. One practical route is set out here. Because operation touches many teams, agree early who owns each process, so that a change in one area does not surprise another.
- List the processes that deliver your risk treatment, such as access provisioning, change handling, backup and supplier onboarding.
- For each, state what must be true before work proceeds and how exceptions are approved.
- Bring change under a light but real routine that captures the reason, the risk and the sign-off, and add a quick review after unplanned change.
- Identify suppliers and outsourced services that support the ISMS and agree how each is controlled.
- Trigger a fresh risk assessment when major changes arrive, in addition to your regular cycle.
- Track treatment actions to completion with named owners, and report slipped items to management.
- Sample operations periodically to confirm what happens matches what was planned.
What an auditor may follow
A useful audit trail links a changed condition with risk assessment, treatment decisions, implementation and retained results. An auditor may sample a significant change, interview its owners and examine whether criteria were used. They may also investigate how externally provided activities are controlled. A supplier's certificate can be relevant information, but its scope and significance must be understood rather than treated as a complete answer.
Common mistakes include maintaining an impressive plan with overdue actions nobody reviews, accepting uncontrolled changes because the project is urgent, and retaining evidence that shows activity without its result. In a global programme, check whether local teams can apply the shared arrangements and whether supplier or location differences have been considered.
Explore each numbered part
8.1 · Operational planning and control
Turn the ISMS plan into controlled everyday work. Learn to establish process criteria, manage changes and maintain confidence in outsourced activities. This guide follows real transactions through approvals, execution and evidence, showing how operational controls remain effective when services, suppliers and business conditions change across the organisation.
8.2 · Performing security risk assessments
A sound risk method must be applied at the right times and leave usable results. Learn how clause 8.2 connects planned assessment intervals and significant changes to the criteria established under clause 6.1.2. Examples show how to preserve comparability, involve owners and avoid treating an annual spreadsheet refresh as the entire assessment process.
8.3 · Implementing risk treatment
Risk treatment is complete only when agreed actions have been implemented and their results can be demonstrated. Learn to translate treatment plans into accountable work, check actual control operation and keep status aligned with evidence. The guide explains delays, dependencies and residual-risk decisions without confusing purchased tools with effective treatment.
Common nonconformities with clause 8
Findings under clause 8 tend to show a gap between plan and practice. Typical examples follow.
- Risk assessment was last performed before a major system or supplier change, and nothing prompted a repeat.
- Treatment plan actions are shown as done with no evidence, or have no owner.
- Changes to systems were made without recorded assessment of security consequences.
- An outsourced service supporting the ISMS is not controlled, and nobody can say what assurance is obtained.
- Process criteria are undefined, so staff handle similar cases differently.
Illustrative example: operation
A hypothetical UK SaaS provider moves its customer reporting to a new hosted environment. Before the move, the security lead reviews who will administer the platform, how logs and backups will be handled and which supplier duties change. A short risk assessment is refreshed because the architecture is different, and two treatments are added: stricter administrator approval and a tested restore. During the migration, an unplanned integration is added by a developer to meet a deadline. The change control routine flags it, the team reviews its consequences afterwards and closes an exposed access path. At the next internal audit, the auditor follows the migration from risk assessment through treatment actions to records of the restore test, and finds that planned arrangements matched what actually happened.
Frequently asked questions
Must every minor change trigger a full assessment?
The clause refers to significant change. Establish a workable way to recognise significance and route uncertainty, using the organisation's context and criteria rather than an arbitrary rule invented for convenience.
Does monitoring belong only in clause 9?
Clause 9 evaluates performance, while operational processes still need appropriate control. The two connect: operating evidence supplies information for evaluation and subsequent decisions.
What if treatment cannot be completed on time?
Make the delay and its implications visible to the responsible people, reconsider the exposure and obtain appropriate decisions. An overdue task should not remain hidden behind a plan marked approved.
Make treatment operationally credible
Ask Sterling about ISMS operational implementation, including scoped supplier and change processes, evidence support and agreed workflows using Effivity ISO & GRC automation software. Authorised vulnerability scanning and findings review can be included within an agreed ISMS scope. 93 Annex A Controls training supports control understanding; independent certification remains a separate decision.
Previous: clause 7. See the requirements hub or continue to clause 9: evaluation.