17 Mar 2023
Unpacking the Changes and Guiding Your Transformation Journey
The International Organization for Standardization (ISO) has recently updated its well-known information security management standard, ISO 27001. The new version, ISO 27001:2022, brings several changes that organizations need to understand and implement to maintain their compliance. This article aims to provide a comprehensive overview of these changes and offer guidance on how to navigate the transition smoothly.
The ISO 27001:2022 revision is a moderate update to the 2013 version, including updated clause language, a new grouping structure, and new controls within Annex A. While the changes are not drastic, they are significant enough to require careful attention and planning for a successful transition.
Key Changes in ISO 27001:2022
Terminology: The term "International Standard" has been replaced with "document" throughout the standard. This change is more of a semantic adjustment and does not impact the application of the standard.
Context of the Organization: The 2022 version emphasizes the need for organizations to determine the external and internal context relevant to information security. This includes understanding the needs and expectations of interested parties and the requirements that will be addressed through the information security management system (ISMS).
Risk Assessment: The new version has a more explicit focus on risk assessment and treatment. It emphasizes the need for organizations to establish, implement, maintain, and continually improve the processes needed to manage information security risks.
Information Security Objectives: The 2022 version has re-ordered the information security objective list and added new requirements for planning how to achieve these objectives.
Communication: The new version has reworded and re-ordered the communication list, emphasizing the need for effective internal and external communications relevant to the ISMS.
Documented Information: The 2022 version requires documented information to be available to the extent necessary to have confidence that the processes have been carried out as planned.
Audit Program: The 2022 version adds new subsections for the internal audit program, detailing the requirements for establishing, implementing, and maintaining the program.
Management Review: The new version has re-ordered the management review requirements and added new subsections for management review inputs and results.
Nonconformity and Corrective Action: The 2022 version has reworded the requirements for dealing with nonconformities and taking corrective action.
Annex A Changes
Annex A has been revised to align it with ISO 27002:2022. The Annex A controls are now grouped into 4 'themes' rather than 14 clauses. They are:
People (8 controls)
Organizational (37 controls)
Technological (34 controls)
Physical (14 controls)
Some controls have been merged or removed, and some have been added, resulting in a total of 93 controls in ISO 27001:2022, compared to 114 in ISO 27001:2013. The completely new controls include threat intelligence, information security for the use of Cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding.
Transitioning to ISO 27001:2022
Transitioning to the new version of ISO 27001 requires a systematic approach. Here are some steps to guide your transition process:
Understand the Changes: The first step is to understand the changes in the new version. This involves a detailed comparison of the 2013 and 2022 versions to identify the differences.
Gap Analysis: Conduct a gap analysis to identify the areas where your current ISMS does not meet the new requirements. This will help you understand what changes you need to make.
Plan the Transition: Based on the gap analysis, develop a transition plan. This should include the actions needed to address the gaps, the resources required, the timeline for implementation, and the criteria for evaluating the results.
Implement the Changes: Execute the transition plan, making the necessary changes to your ISMS. This could involve updating policies and procedures, implementing new controls, redefining roles and responsibilities, and enhancing communication processes.
Monitor and Review: Monitor the implementation of the changes and review their effectiveness. This will help you identify any areas that need further improvement.
Certification: Once you have implemented the changes and are confident that your ISMS meets the new requirements, you can apply for certification to ISO 27001:2022.
Remember, the transition to ISO 27001:2022 needs to be completed by October 31, 2025, according to the International Accreditation Forum. Certification bodies must start certifying companies against ISO 27001:2022 latest by October 31, 2023, but most of them will likely start with this new revision much sooner.
Key Takeaways
The transition from ISO 27001:2013 to ISO 27001:2022 is not a drastic one, but it does require careful planning and execution. The changes in the standard are moderate and mostly involve reordering and rewording of clauses, with the addition of some new controls. The number of controls has decreased from 114 to 93, and they are now grouped into four sections instead of the previous 14. The transition period extends until October 31, 2025, giving organizations ample time to make the necessary adjustments.