Academy learning group 3 · Academy module (not an ISO clause) M05 · Chapter 5 of 8
Operate controls across assets and suppliers
About 6 minutes · ISO/IEC 27001:2022 with Amd 1:2024 context
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: A control needs an owner, evidence and a working handoff.
Explore the anchors
Know information systems owners and dependencies.
Concept matching activity
Match this task or description to its concept:
Perform and record the required controls.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and distinctions
- Apply the process and collect evidence
- Support, document control and implementation evidence
Concepts and distinctions
Operational controls translate risk decisions into repeatable actions. Asset ownership, access reviews, secure configuration, change handling, supplier oversight and incident escalation are connected practices rather than isolated documents. A joiner process can grant appropriate access while an unmanaged role transfer quietly leaves obsolete privileges behind.
Outsourcing a service changes who performs work, but the organization still needs to understand its requirements and responsibilities. Define supplier duties, evidence, notification paths, change expectations and exit arrangements. A certificate or assurance report can inform due diligence only within its scope, period and limitations. It is not proof that every customer-specific configuration or subcontractor dependency is controlled.
Apply the process and collect evidence
Select evidence that matches the control claim. For an access review, identify the population, reviewer, decision records and removal verification. For a supplier, reconcile the contract with the actual service and interfaces. Test handoffs after staff changes and maintain exception handling when standard procedures cannot be followed. Avoid collecting unnecessary personal or confidential information merely to populate an audit folder.
Support, document control and implementation evidence
Resources, competence, awareness, communication and controlled documented information make operational controls repeatable. Distinguish attending training from demonstrating competence: a restore operator should show the authorized recovery procedure works. Maintain approved versions, access permissions, retention rules and change history for relevant documents. An obsolete procedure available to staff can undermine an otherwise correct control design.
A launch plan identifies accountable work, dependencies, milestones and acceptance evidence; management provides authority and resources while employees operate relevant procedures. During an audit, interview staff, observe work and inspect records rather than relying on one presentation. Remote audits need agreed secure access, identity checks, privacy protection and arrangements for activities that cannot be observed reliably. Screenshots and exports require context, dates and provenance. Penetration testing is a separate authorized assessment; an audit engagement does not automatically permit intrusive tests.
| Concept | What to remember |
|---|---|
| Assets | Know information systems owners and dependencies |
| Operations | Perform and record the required controls |
| Suppliers | Define shared duties and assurance |
Worked example
A hosted platform provides a security certificate, but the academy has never reviewed its own privileged accounts or tested the supplier’s incident contact route. Check the certificate’s scope and relevance, then perform customer-owned access and incident-readiness work. Supplier assurance does not establish the academy’s tenant configuration or communication capability. Assign owners and retain evidence for each side of the responsibility boundary.
Check your understanding
A supplier has a valid certificate. What remains necessary for the customer?
Show explanation
Assess scope and perform its own assigned configuration access and oversight duties. Supplier assurance has boundaries and does not discharge customer responsibilities.
Source and study boundary
Official standard overview. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.