ISO/IEC 42001:2023
Operation – ISO/IEC 42001:2023

ISO/IEC 42001:2023 8.1: Operational planning and control

Plan the processes required to meet requirements, run them and keep them under control, and carry out the clause 6 actions by setting process criteria and controlling the processes against them. Implement the controls chosen under 6.1.3 that relate to operation (for example AI life cycle controls), monitor their effectiveness and consider corrective action if results fall short. Keep enough documented information to show processes ran as planned, control planned changes, review unintended changes and mitigate adverse effects, and make sure externally provided processes, products or services relevant to the AIMS are controlled.

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 43 controls across 23 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 5 controls

PCI DSS 4.0 · 4 controls

  • 12.1.1 12.1.1 Overall information security policy established and disseminated
  • 12.4.2 12.4.2 Quarterly reviews that personnel follow security procedures
  • 2.1.1 2.1.1 Requirement 2 policies and procedures governed
  • 3.1.1 3.1.1 Requirement 3 policies and procedures maintained and in use

SOC 2 · 4 controls

  • SOC2-CC3.1 CC3.1 Objectives specified clearly enough to assess risk (COSO principle 6)
  • SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10)
  • SOC2-CC5.3 CC5.3 Deploying controls through policies and procedures (COSO principle 12)
  • SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure
  • ISO-22313-8.1 Operational planning and control
  • ISO22313-8.1 Guidance on operational planning and control

ISO 27002:2022 · 2 controls

  • 5.24 Information security incident management planning and preparation
  • 5.37 Documented operating procedures

ISO 27701:2019 · 2 controls

  • 5.6.1 Operational planning and control
  • 8.1 General

ISO 30401 · 2 controls

  • ISO30401-06 Operational planning and control
  • ISO30401-8.1 Operational planning and control
  • ISO-39001-8.1 Operational planning and control
  • ISO39001-8.1 Operational Planning and Control
  • ISO-41001-8.1 Operational planning and control
  • ISO41001-8.1 Operational Planning and Control
  • ISO-50001-8.1 Operational planning and control
  • 8.1 Operational planning and control

ISO 56002 · 2 controls

  • ISO-56002-8.1 Operational planning and control
  • ISO56002-8.1 Operational planning and control

ISO/IEC 27003:2017 · 2 controls

  • 27003-8.1 Operational Planning and Control
  • ISO27003-8.1 Operational planning and control
  • AS9100D-8.1 Operational Planning and Control

ISO 14001:2015 · 1 control

  • 8.1 Operational planning and control

ISO 14004:2016 · 1 control

  • 8.1 Operational planning and control

ISO 22000:2018 · 1 control

  • 8.1 Operational planning and control

ISO 22301:2019 · 1 control

  • 8.1 Operational planning and control

ISO 27001:2022 · 1 control

  • 5.37 Documented operating procedures

ISO 37001:2016 · 1 control

  • 8.1 8.1 Operational planning and control

ISO 37301:2021 · 1 control

  • 8.1 Operational planning and control

ISO 45001:2018 · 1 control

  • 8.1 Operational planning and control

ISO 55001:2014 · 1 control

  • 8.1 Operational planning and control

ISO 9001:2015 · 1 control

  • 8.1 Operational planning and control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Operation – ISO/IEC 42001:2023

You are reading one control. How much of ISO/IEC 42001:2023 have you already done?

ISO/IEC 42001:2023 8.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO/IEC 42001:2023 your existing evidence covers. Hold NIST AI Risk Management Framework (AI RMF 1.0) and 30 of 38 ISO/IEC 42001:2023 controls already carry evidence.

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST AI Risk Management Framework (AI RMF 1.0) pair alone.

Query this from an agent

The graph holds this control, the 43 it maps to, and the evidence behind each claim, over MCP and REST.