Operational planning & control for ISO 27001 Requirement 8.1

ISO 27001 Clause 8.1 – Operational planning and control

This clause is very easy to demonstrate evidence against if the organisation has already ‘showed its workings.’  In developing the information security management system to comply with requirements 6.1, 6.2 and in particular 7.5 where the whole ISMS is well structured and documented, this also achieves 8.1 at the same time. It is about planning, implementation and control to ensure the outcomes of the information security management system are achieved.

Smart organisations going through their planning and early implementation of the information security management system with ISO 27001 certification in mind will also conduct management reviews in line with clause 9.3. We recommend these management reviews for information security happen weekly in the early stages to maintain momentum and build the habit, then stabilise to less frequent periods after the stage 1 audit.  Whilst not all the 9.3 standard agenda items can be demonstrated during implementation, administrators can note what has been achieved, what is planned next. It will give independent auditors confidence the organisation is planning well, showing consideration to its spirit of the standard as well as practicing management reviews too.

 

 

Ready to take action?

Discover how ISMS.online can help you achieve or improve on your ISMS objectives

Need ISO 27001 policies and controls for your ISMS?

ISMS.online includes practical policies and controls for your organisation to easily adopt, adapt and add to, giving you up to
77% head start with ISO 27001 documentation. 

Ready to take action?

Discover how ISMS.online can help you achieve or improve on your ISMS objectives

ISMS Online Rating: 5 out of 5
Share This