Designing an ISMS is one thing—running it, measuring it, and improving it is another. That’s why Clauses 8, 9, and 10 of ISO/IEC 27001 are so important. They cover the practical side of the standard: how to operate the ISMS day-to-day, how to evaluate whether it’s working, and how to keep it improving over time.

In my experience, this is where many organizations struggle. They get through planning and documentation (Clauses 4–7), but once it comes to execution, monitoring, and improvement, the ISMS loses momentum. The result? Security controls drift, audits turn stressful, and the ISMS becomes a paper exercise instead of a living system.

Clauses 8–10 exist to prevent that. They make sure your ISMS doesn’t just exist—it performs, adapts, and adds value to the business.

By the end of this article, you’ll know:

How to operate your ISMS effectively (Clause 8).
What to monitor and measure to prove ISMS performance (Clause 9).
How to handle nonconformities and drive continual improvement (Clause 10).

Now let’s break down Clause 8 and see what “operation” really means in practice.

ISO/IEC 27001 Clause 8 – Operation

Clause 8 is where the ISMS becomes part of everyday business. It’s about planning, controlling, and running the processes needed to achieve your information security objectives. If Clauses 4–7 are about setting the stage, Clause 8 is about putting the play into action.

Clause 8.1 – Operational Planning and Control

Organizations must plan, implement, and control the processes needed to meet ISMS requirements. That means making sure the procedures, resources, and responsibilities defined earlier are carried out consistently.

Requirement	What It Means in Practice	Evidence Auditors Look For
Plan operations	Define how processes will run	Documented procedures, workflows
Control operations	Monitor and guide daily ISMS activities	Records of monitoring, task logs
Maintain documented information	Keep evidence of operations	Version-controlled records, logs

Example: A SaaS provider documented its backup process and kept daily backup logs as evidence. During audit, this proved operational control was real, not theoretical.

Clause 8.2 – Information Security Risk Assessment

Risk assessments aren’t a one-time exercise. Clause 8.2 requires organizations to perform them at planned intervals and whenever significant changes occur.

Trigger for Assessment	Example
Planned intervals	Annual risk review across all business units
Significant changes	Migrating services to a new cloud provider
New threats identified	Emerging ransomware targeting your industry

Common Pitfall: Companies that only update risk assessments once every three years (at recertification) risk nonconformities. Auditors expect an ongoing process.

Clause 8.3 – Information Security Risk Treatment

Once risks are assessed, organizations must implement their risk treatment plans. This is where chosen controls (from Clause 6 and Annex A) are applied in practice.

Step	What It Involves	Evidence Auditors Expect
Select controls	Decide how each risk will be treated (avoid, transfer, mitigate, accept)	Risk treatment plan linked to risk register
Implement controls	Apply security measures	Records of implemented controls (MFA logs, training records, encryption evidence)
Track residual risk	Ensure remaining risk is acceptable	Updated risk register showing status

Example: A financial services company treated the risk of phishing by introducing MFA, strengthening email filters, and running mandatory awareness training. Their risk treatment plan clearly linked each control to the risk.

Clause 8 proves the ISMS isn’t just a strategy—it’s operating. Auditors will look for evidence of ongoing risk assessments and treatment in action, not just documents written years ago.

ISO/IEC 27001 Clause 9 – Performance Evaluation

Clause 9 ensures your ISMS isn’t just running—it’s being measured and evaluated. This clause covers monitoring, internal audits, and management reviews. Together, these steps prove whether the ISMS is effective and where it needs adjustment.

Clause 9.1 – Monitoring, Measurement, Analysis, and Evaluation

Organizations must decide what to monitor, how to measure it, and how to evaluate the results. The goal is to check whether ISMS objectives are being met and whether controls are effective.

What to Monitor	Examples of Metrics	Audit Expectation
Incident management	Number of incidents, average resolution time	Incident logs, trend reports
Control effectiveness	Patch compliance %, MFA adoption, access reviews	KPI dashboards, security reports
Training & awareness	% staff completing training, phishing simulation results	Training records, test results
Risk management	% of risks reassessed on time, % of treatment plans implemented	Risk register updates

Example: A financial firm tracked phishing incidents monthly. After introducing mandatory training, incidents dropped by 40%. This measurable improvement was documented and presented at management review.

Clause 9.2 – Internal Audit

Internal audits are required to ensure the ISMS conforms to ISO 27001 and is effectively implemented. They must be planned, objective, and documented.

Requirement	Practical Action	Evidence Auditors Expect
Audit program	Define frequency, scope, methods	Audit plan, schedule
Independence	Auditors must not audit their own work	Assigned audit roles, independence matrix
Documentation	Record results, findings, and actions	Audit reports, nonconformity logs
Follow-up	Verify corrective actions are completed	Evidence of resolved findings

Common Pitfall: Treating audits as box-ticking. Auditors notice when internal audits don’t lead to real improvements.

Clause 9.3 – Management Review

Top management must periodically review the ISMS to ensure it remains effective, aligned with strategy, and continually improving. Reviews must be planned and documented.

Inputs to Review	Outputs Expected
Status of objectives	Decisions on changes or actions
Results of audits	Updated ISMS priorities
Incident reports	Allocation of new resources if needed
Risk assessment results	Adjusted risk treatment strategies
Opportunities for improvement	Action plans, timelines

Example: A SaaS company held quarterly management reviews where leadership discussed incident trends, audit findings, and training results. Actions were logged and tracked, showing auditors a clear cycle of accountability.

Clause 9 demonstrates whether your ISMS is working in practice. Without measurement, audits, and reviews, organizations can’t prove effectiveness—or improve it.

ISO/IEC 27001 Clause 10 – Improvement

Clause 10 ensures the ISMS doesn’t stagnate. It requires organizations to deal with problems when they arise (nonconformities) and to proactively strengthen the ISMS over time (continual improvement).

Clause 10.1 – Nonconformity and Corrective Action

When something goes wrong—whether discovered in an internal audit, an incident, or a management review—the organization must respond with corrective action. The focus isn’t just fixing the issue, but finding and addressing the root cause so it doesn’t happen again.

Step	What It Means	Evidence Auditors Expect
Identify nonconformity	Spot a failure in a process, control, or requirement	Nonconformity logs, incident reports
Take action	Contain and correct the issue	Records of corrective actions taken
Root cause analysis	Find the underlying reason	RCA reports, meeting notes
Prevent recurrence	Update processes, training, or controls	Updated procedures, follow-up evidence
Verify effectiveness	Confirm the fix worked	Audit or review results showing no recurrence

Example: A manufacturing company found that supplier risk assessments were skipped. The corrective action wasn’t just to complete them—it was to update procedures, assign ownership, and train procurement staff to prevent it happening again.

Clause 10.2 – Continual Improvement

Clause 10.2 requires organizations to look beyond problems and actively improve their ISMS. This is about staying ahead of threats, technology changes, and business needs.

Improvement Area	Practical Example
Processes	Automating patch management to reduce delays
Risk management	Updating risk methodology to account for cloud services
Awareness	Adding phishing simulations alongside annual training
Technology	Introducing new monitoring tools or stronger encryption
Culture	Embedding security KPIs in staff performance reviews

Common Pitfall: Organizations focus only on corrective actions after audits and ignore proactive improvements. Auditors expect to see a mindset of continual growth, not just “fixes when things break.”

Example: A healthcare provider enhanced its ISMS by introducing continuous vulnerability scanning, even though no incident forced the change. This proactive step impressed auditors and reduced exposure to emerging threats.

Clause 10 ensures the ISMS is never static. By dealing with nonconformities systematically and seeking out opportunities for improvement, organizations build resilience and demonstrate maturity.

FAQs on ISO/IEC 27001 Clauses 8–10

Question	Answer
How often should risk assessments (Clause 8.2) be updated?	At least once a year, and also whenever significant changes occur (e.g., new systems, mergers, regulatory shifts).
What KPIs are most useful for Clause 9.1 monitoring?	Incident frequency and resolution times, % of staff completing training, % of risks reassessed on time, patch compliance rates, audit findings closed on time.
How do internal audits differ from external certification audits?	Internal audits are self-driven checks to find gaps and improvements; certification audits are independent assessments to confirm conformity with ISO/IEC 27001.
What’s the difference between corrective action (Clause 10.1) and continual improvement (Clause 10.2)?	Corrective actions fix specific problems to prevent recurrence. Continual improvement goes further—proactively enhancing processes, tools, and culture even when no issue has occurred.
How can leadership prove they’re engaged in Clauses 9 and 10?	By attending management reviews, approving resources for improvements, and tracking actions from audits or incidents.

Conclusion: From Operation to Continual Improvement

Clauses 8–10 are where an ISMS proves its value. Clauses 4–7 set the stage, but operation, performance, and improvement show whether the system is truly effective and sustainable.

To recap:

Clause 8 – Operation ensures risk assessments and treatments aren’t just planned but carried out.
Clause 9 – Performance Evaluation keeps the ISMS measurable, auditable, and transparent.
Clause 10 – Improvement ensures the system adapts, fixes root causes, and grows stronger over time.

In my experience, the organizations that excel in these areas don’t treat Clauses 8–10 as “end-of-process” requirements. They treat them as a cycle—operate, measure, improve—that keeps security aligned with business reality. That’s what auditors want to see, and it’s what keeps customers and regulators confident.

Next step: Review how your ISMS currently handles daily operations, performance metrics, and improvement actions. If these areas feel reactive or inconsistent, now is the time to strengthen them—before the next audit makes the gaps visible.

Melissa Lazaro

Melissa Lavaro is a seasoned ISO consultant and an enthusiastic advocate for quality management standards. With a rich experience in conducting audits and providing consultancy services, Melissa specializes in helping organizations implement and adapt to ISO standards. Her passion for quality management is evident in her hands-on approach and deep understanding of the regulatory frameworks. Melissa’s expertise and energetic commitment make her a sought-after consultant, dedicated to elevating organizational compliance and performance through practical, insightful guidance.

Share on social media

ISO/IEC 27001 Clause 8‑10 – Operation, Performance & Improvement

Introduction: ISO/IEC 27001 Clauses 8–10 – Operation, Performance & Improvement

ISO/IEC 27001 Clause 8 – Operation

Clause 8.1 – Operational Planning and Control

Clause 8.2 – Information Security Risk Assessment

Clause 8.3 – Information Security Risk Treatment

ISO/IEC 27001 Clause 9 – Performance Evaluation