About this chapterThis chapter ensures that the organization implements and controls planned processes, performs risk assessments, and applies treatment measures. It contains three sub-clauses.
8.1 Operational planning and control
The organization must implement and control the processes needed to meet ISMS requirements and keep evidence of their operation.
8.2 Information security risk assessment
Risk assessments must be performed at planned intervals and whenever significant changes occur.
8.3 Information security risk treatment
Risk treatment options must be implemented and documented in the Statement of Applicability (SoA).
