Skip to content
d-centralize handbook

8. Operation

8.1 Operational planning and control

Section titled “8.1 Operational planning and control”
  • The processes of the ISMS run as the policies describe. Each periodic check is a recurring task; its issues are the evidence that the check happened.
  • Changes are planned and their security impact is checked as the change management policy describes.
  • Externally provided processes, products and services are controlled through the supplier management policy.

8.2 Information security risk assessment

Section titled “8.2 Information security risk assessment”

Risks are assessed as described in planning: in the risk identification sessions, and whenever an incident, audit finding or big change brings a new risk. The results are in the ISMS risk register.

8.3 Information security risk treatment

Section titled “8.3 Information security risk treatment”

Risk treatment actions are planned in the sprints of the product they concern, next to the other work. An action that is not finished in a sprint moves to the next one. When the same action moves sprint after sprint, the ISMS security meeting resets its priority. Progress is visible in the risk issues and their task lists.