ISO 27001/Chapter/8 Operation

This chapter ensures that the organization implements and controls planned processes, performs risk assessments, and applies treatment measures. It contains three sub-clauses:

8.1 Operational planning and control

The organization must implement and control the processes needed to meet ISMS requirements and keep evidence of their operation.

8.2 Information security risk assessment

Risk assessments must be performed at planned intervals and whenever significant changes occur.

8.3 Information security risk treatment

Risk treatment options must be implemented and documented in the Statement of Applicability (SoA).