Operation (Clause 8)
Operation (Clause 8)
Clause 8 turns plans and risk decisions into controlled day-to-day activity. The exam tests operational planning and control, when risk assessment must be repeated, how treatment is implemented, and how outsourced or changed processes are kept inside the ISMS.
Core rules
- 8.1: plan, implement, and control the processes needed to meet ISMS requirements and implement the actions from 6.1. Establish criteria for those processes, implement control according to the criteria, keep documented information as evidence, control planned changes, review consequences of unintended changes, and ensure outsourced processes are controlled.
- 8.2: perform information security risk assessment at planned intervals or when significant changes are proposed or occur. Retain documented information of results.
- 8.3: implement the information security risk treatment plan and retain documented information of results.
- Annex A controls selected during 6.1.3 are operated through 8.1; the standard does not require every Annex A control to be implemented, only those determined necessary through risk treatment, with SoA justification.
Worked example
A company migrates its customer database to a new cloud region. The project team completes the migration and updates the asset list, but does not reassess risk because 'the annual assessment is not due'. Exam reasoning: 8.2 requires reassessment when significant changes occur. New jurisdiction, access paths, provider dependencies, and recovery arrangements can change likelihood and impact. The correct action is to trigger a reassessment, update treatment and the SoA if controls change, and retain evidence before accepting the migration.
Traps that cost marks
- Treating 8.2 as an annual calendar-only activity.
- Documenting procedures without operational criteria or evidence of execution.
- Assuming a supplier's certification transfers all control responsibility.
- Updating assets after a change but not risk assessment and treatment.