The organization shall plan, implement, and control processes needed to meet ISMS requirements, including criteria for processes and control of changes.
In operational terms: Operate security by process, not improvisation—run defined workflows, control changes, and keep evidence that work follows plan.
Auditors will typically look for evidence that the organization:
a. Defines and operates ISMS processes with clear criteria (inputs/outputs, responsibilities, controls).
b. Controls planned changes and reviews unintended changes to mitigate adverse impacts.
c. Keeps sufficient documented information that processes are carried out as intended.
