ISO 27001 operations security is where most day-to-day IT security work happens. It covers running systems safely: documented procedures, change control, malware protection, backups, logging, patching and more. If these basics fail, attackers rarely need anything clever.
In ISO 27001:2013, these controls formed Annex A.12. The 2022 edition moved most of them into the Technological controls theme (section 8) and added new ones for configuration management and monitoring. This guide explains how ISO 27001 operations security works today.
Free tool: How ready is your organization? Take our ISO 27001 self-assessment: 30 questions on clauses 4–10 and Annex A.
Mapping: A.12 (2013) to ISO 27001:2022
| ISO 27001:2013 | ISO 27001:2022 |
|---|---|
| A.12.1.1 Documented operating procedures | 5.37 Documented operating procedures |
| A.12.1.2 Change management | 8.32 Change management |
| A.12.1.3 Capacity management | 8.6 Capacity management |
| A.12.1.4 Separation of environments | 8.31 Separation of development, test and production environments |
| A.12.2.1 Controls against malware | 8.7 Protection against malware |
| A.12.3.1 Information backup | 8.13 Information backup |
| A.12.4.1 to A.12.4.3 Event, admin and log protection | 8.15 Logging |
| A.12.4.4 Clock synchronisation | 8.17 Clock synchronization |
| A.12.5.1, A.12.6.2 Software installation | 8.19 Installation of software on operational systems |
| A.12.6.1 Technical vulnerability management | 8.8 Management of technical vulnerabilities |
| A.12.7.1 Audit controls | 8.34 Protection of information systems during audit testing |
Running systems in a controlled way
5.37 Documented operating procedures
Write down how to do critical tasks: backups, restores, user onboarding, server builds and incident handling. As a result, work stays consistent when staff change or someone is on leave.
8.32 Change management
Next, control changes to systems. A good process records the change, assesses risk, gets approval, tests it and keeps a rollback plan. Emergency changes are allowed, but review them afterwards.
8.6 Capacity management
Monitor CPU, memory, storage and bandwidth, and plan ahead. Otherwise, a full disk or overloaded server can cause an outage, which is also a security incident.
8.31 Separation of environments
Keep development, test and production apart. Developers should not have routine write access to production, and test systems should not use real customer data without protection.
Protecting systems
8.7 Protection against malware
Use endpoint protection on all suitable devices, keep it updated and monitor alerts. In addition, block risky file types in email, restrict admin rights and train users to spot phishing.
8.8 Management of technical vulnerabilities
Then find and fix weaknesses quickly:
- Keep an asset inventory, so you know what to patch.
- Scan systems and subscribe to vendor advisories.
- Prioritise by severity and exposure; for example, fix internet-facing critical flaws first.
- Patch within defined timelines, such as 14 days for critical issues.
- Track exceptions and compensating controls.
8.19 Installation of software
Restrict who can install software on operational systems. Use approved software lists and controlled deployment tools.
Backups and logging
8.13 Information backup
Back up data, systems and configurations according to an agreed policy. Follow the 3-2-1 rule: three copies, two media types, one offsite. Importantly, keep at least one copy offline or immutable, so ransomware cannot encrypt it. Finally, test restores regularly.
8.15 Logging and 8.17 Clock synchronization
Log security events, admin actions and errors. Protect logs from tampering, and keep them for an agreed period. Also synchronise all clocks to a trusted time source, otherwise investigators cannot rebuild a timeline.
New 2022 controls in this area
- 8.9 Configuration management: define secure baselines, such as CIS Benchmarks, and detect drift.
- 8.16 Monitoring activities: watch networks and systems for abnormal behaviour, for example with a SIEM.
- 8.10 Information deletion and 8.12 Data leakage prevention also support daily operations.
Want a hands-on example? Our guide to building a SOC home lab with Wazuh shows logging and monitoring in practice.
8.34 Audit testing
Finally, plan technical audits so they do not disrupt operations. Agree on scope and timing, use read-only access where possible and remove test accounts afterwards.
What auditors check
- Change records with approvals and testing evidence.
- Patch reports and vulnerability scan results.
- Backup logs and recent restore tests.
- Log retention settings and evidence of log review.
- Endpoint protection coverage.
Related guides
- ISO 27001:2022 Annex A: all 93 controls and the 2013 mapping
- Free ISO 27001:2022 readiness checklist
- What is an ISMS? Concept, benefits and the PDCA cycle
Sources
- ISO/IEC 27001:2022, Information security management systems (ISO)
- ISO/IEC 27002:2022, Information security controls (ISO)
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. Doing it yourself? The ISO 27001:2022 Starter Kit (₹1,999) gives you the gap workbook, risk register, Statement of Applicability and 13 policy templates. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
