8.1 Operational planning and control

The organization must plan, run and keep under control the processes that meeting its requirements depends on and to carry out the actions set in Clause 6, by setting criteria for those processes and controlling them according to the criteria. Documented information must be available to the extent needed to be confident the processes ran as planned. Planned changes are controlled, the consequences of unintended changes are reviewed with action taken to limit adverse effects, and externally provided processes, products or services relevant to the ISMS are controlled.

Source: ISO/IEC 27001:2022, 8.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27001:2022 in the compliance library.

Clauses 4 to 10 are the management-system requirements: none of them can be excluded when an organisation claims conformity. The 93 Annex A controls are a reference set: one may be excluded with a justification in the Statement of Applicability. Certification bodies assess conformity; the evidence lists here are what auditors commonly ask for, not a list the standard prescribes.