The organization shall plan actions to address risks and opportunities, including information security risks, and integrate these actions into the ISMS processes and evaluate their effectiveness.
In other words: You must identify what could help or harm your ISMS (especially security risks), decide what to do about it, embed it into daily processes, and later check whether it worked.
Elaborated guidance highlights that the organization must ensure:
a. A method exists to identify ISMS-related risks/opportunities (including information security risks) and determine what needs to be addressed.
b. Planned actions are implemented within ISMS processes (not treated as an “extra project”).
c. The organization evaluates whether the actions taken are effective (e. g., via KPIs, reviews, audits, risk re-assessments).
