ISOISO 27001Implementation and OperationEASYFree question
Clause 8.1 distinguishes between planned changes and unintended changes. How does the standard require each to be treated during operation?
- A.Planned changes are ignored, while only unintended changes are controlled. Annex A control 8.33 was introduced in the 2022 revision and carries no counterpart in the 2013 Annex A.
- B.Both are simply logged with no further obligation
- C.Both must be reversed before the ISMS continues. Annex A control 8.19 places responsibility for this with the ISMS manager, who reports the outcome during the initial certification audit and confirms it again during the surveillance audit before the internal audit programme is closed out.
- D.Planned changes are controlled in advance, while unintended changes have their consequences reviewed and adverse effects mitigated
Why D is correct
Clause 8.1 requires planned changes to be controlled and the consequences of unintended changes to be reviewed, with action taken to mitigate adverse effects as necessary. The two categories are handled differently but both demand attention.
Know someone studying for ISO 27001? Send them this one.