# Clause 8.1: Operational planning and control

Plan, carry out and control the processes needed to satisfy BCMS requirements and to take the actions decided on for risks and opportunities, by setting criteria for the processes, controlling them against those criteria and keeping enough documented information to be sure they were carried out as planned. Control planned changes, look at what unplanned changes have led to and act to limit any harm, and make sure that processes done by others and the supply chain are kept under control.

Cloud: Operational planning turns the strategy into runbooks a tired person can follow at two in the morning. For cloud services that means the console, the credentials, the export path and the order of restoration.

Evidence: Documented process criteria for BCMS operational processes; Records showing processes ran to those criteria; Change records covering planned changes and reviews of unintended change; Evidence of control over outsourced processes and the supply chain.

Test: Walk one critical service runbook and note every step that needs a provider console.

Citation: ISO 22301:2019, clause 8.1. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.