# Clause 8: Operation

Clause 8, Operation, has three parts to it:

- [Operational planning and control](../../../MoCs/ISO_27001_2022_8.1_MoC%20Operational%20planning%20and%20control.md)
- [Information security risk assessment](../../../MoCs/ISO_27001_2022_8.2_MoC%20Information%20security%20risk%20assessment.md)
- [Information security risk treatment](../../../MoCs/ISO_27001_2022_8.3_MoC%20Information%20security%20risk%20treatment.md)

## Clause 8.1: Operational Planning and Control

So let's have a look at [Clause 8.1](../../../MoCs/ISO_27001_2022_8.1_MoC%20Operational%20planning%20and%20control.md) Operational Planning and Control.

In Clause 6, part of the Plan phase,  we looked at information security assessment and risk treatment, and the outcomes where a risk assessment *process*, a risk treatment plan, and a list of the controls we'd implement in the form of a statement of applicability (clauses [6.1.2](../../../MoCs/ISO_27001_2022_6.1.2_MoC%20Information%20security%20risk%20assessment.md) and [6.1.3](../../../MoCs/ISO_27001_2022_6.1.3_MoC%20Information%20security%20risk%20treatment.md)).

Clause 8 is part of the Do phase, and describes how we will execute the actions from Clause 6, to confirm that the risk assessments are actually being carried out and that the risk treatment plans and controls are actually being implemented. This is the subject of Clause 8.1.

These controls and processes should be implemented effectively and be sustainable over time, which requires planning and clear criteria for success.

As an example, consider the decision of an organization to implement log management software to capture system logs and monitor for suspicious activity.
They would need to identify the functional requirements of the software, the kind of events and logs they want to process, necessary capacity, etc.
They would need to think about how they will fit it into the organization, like establishing a process for reviewing the logs, resource requirements, acquiring the necessary skills, how it will integrate with the incident management process of the organization, who to involve and how to communicate it to the rest of the organization, and so on.

Even if the organization decides to outsource the process, it still needs to be managed. We still need to make sure the solution meets certain requirements with regards to information security and service delivery[^1].

This is what's meant by operational planning and control.



[^1]: The ISO 37500 offers guidance on outsourcing.