What it asks for. The organisation must plan, implement and control the processes needed to meet its security requirements, perform risk assessments at planned intervals or when significant changes occur, and implement the risk treatment plan.
In practice. Controls selected during planning are actually run, and the organisation keeps enough evidence to show processes were carried out as intended. Changes are controlled, and externally provided processes, products or services relevant to the system are controlled too. Risk assessments are repeated on a schedule and triggered by events such as acquisitions, new systems or incidents. Evidence includes operational records, change records, updated risk assessments and the status of treatment actions.
Common gaps. Treatment plans often stall after certification, with actions open for years. Outsourced services are frequently left out of operational control, and risk assessments are not repeated when significant changes occur.