🔒 Get ready for a new and improved version of the world’s leading information security standard! The ISO has just released ISO/IEC 27001:2022, which provides control requirements for creating an Information Security Management System (ISMS).💻👀
📈 While the update is moderate, it includes some significant changes and key differences compared to the previous version, ISO 27001:2013.💡
👉 So, what’s new in ISO 27001:2022? Most of the changes are related to the Annex controls, which now align with the updates to ISO/IEC 27002:2022 published earlier this year.💪
📝 In this blog post, I’ll highlight the most important changes and differences between the two versions of the standard so that you can stay up-to-date with the latest developments in information security. Let’s dive in!🌊
Changes to Clauses 4-10
While the number of clauses remains the same in ISO 27001:2022 compared to the 2013 version, the text has slightly changed to align the standard with other ISO management standards. Let’s take a closer look at the major changes to clauses 4-10:
- Clause 4.2: Analysis of interested party requirements to be addressed through the ISMS.
- Clause 4.4: Inclusion of processes underpinning the ISMS.
- Clause 6.2: Additional guidance on information security objectives.
- Clause 6.3: Standard for planning changes to the ISMS.
- Clause 5.3: Updates to language clarifying communication of relevant roles.
- Clause 7.4: Simplified subclauses.
- Clause 9.2.1 and 9.2.2: Combined into one section.
- Clause 9.3: Management review should consider changes to the needs and expectations of interested parties.
- Clause 10: Continual Improvement is now listed first, followed by Nonconformity and Corrective Action.
Annex Controls
Grouping, New Additions, Mergings, and Renamings
One of the significant changes in ISO 27001:2022 is the grouping of the Annex controls. They’ve been reorganised and updated to reflect modern information security practices better. Other key differences include the following:
- Addition of new Annex controls: Addressing emerging threats and risks in the digital landscape.
- Merging or renaming of some Annex controls: Providing greater clarity and specificity.
Implications for Organisations
It’s essential to understand the new requirements and ensure that your ISMS is up-to-date and aligned with the latest version of the standard. The changes to ISO 27001:2022 will impact organisations in the following ways:
- Introduction of 11 new controls: Emphasising continuous risk management and tracking.
- Merging of 57 controls, renaming of 23 controls, and removal of 3 controls: Easing the understanding and implementation of the standard.
- Reorganisation of controls: Grouping controls into four themes (people, organisational, technological, and physical controls) to better understand how they help secure information.
The New Controls and Their Importance 🌟
1️⃣ Threat Intelligence: Gather and analyse information about threats to mitigate risk, emphasising continuous risk management and tracking.
2️⃣ Cloud Services Security: Set security standards for cloud services and have specific processes and procedures for cloud services to ensure data security.
3️⃣ ICT Recovery: Ensure that information and communication technology can be recovered and used when disruptions occur, which is crucial for business continuity.
4️⃣ Monitoring of Sensitive Physical Areas: Prevent breaches and ensure awareness of potential security risks by allowing only authorised people to access sensitive areas.
5️⃣ Technology Configuration Management: Manage the technology configuration to ensure security and prevent unauthorised changes.
6️⃣ Data Deletion: Delete data when it’s no longer required to avoid leaks of sensitive information and comply with privacy requirements.
7️⃣ Data Masking: Use data masking to protect sensitive information, preventing unauthorised access to data.
8️⃣ Data Leakage Prevention: Implement measures to prevent data leakage and disclosure of sensitive information from systems, networks, and devices.
9️⃣ Unusual Activity Monitoring: Monitor systems for unusual activities and implement appropriate incident response procedures.
🔟 Web Access Management: Manage which websites users can access to protect IT systems and prevent attacks through unsecured websites.
1️⃣1️⃣ Secure Coding Principles: Establish secure coding principles in software development to reduce security vulnerabilities.
Transitioning to ISO 27001:2022
👉 First things first, it’s important to note that the new update does not impact your existing certification. Certification against ISO 27001:2013 is still allowed until October 31, 2023. But, companies should begin to update controls and processes to comply with the new standard as soon as possible. Here’s a suggested roadmap for a smooth transition to ISO 27001:2022:
- Get familiar with the changes: Understand the differences between ISO 27001:2013 and ISO 27001:2022. Review the updates to clauses, Annex controls, and control groupings. This will help you identify areas where your organisation needs to make adjustments.
- Gap analysis: Conduct a gap analysis to identify areas of your ISMS that require updates or improvements. This will help you determine the necessary actions to align your ISMS with the new standard.
- Update your ISMS: Make the necessary updates to your ISMS based on the results of the gap analysis. This includes updating policies, procedures, and documentation and implementing any new controls required by the updated standard.
- Train your staff: Ensure your team is aware of the changes and fully understands the new requirements. Provide training and guidance to help them adapt to the updated standard and implement the new controls effectively.
- Monitor and review: Continuously monitor and review your ISMS to ensure it remains effective and compliant with the new standard. This includes regular internal audits, management reviews, and ongoing risk assessments.
- Get certified: Once you have implemented the necessary updates and are confident that your ISMS complies with ISO 27001:2022, work with a certification body to obtain your new certification.
Let’s wrap it up
The updated ISO 27001:2022 standard brings several changes to better help organisations address today’s information security challenges. By understanding the key differences between the previous version and the new one, you can update your ISMS and continue to protect your organisation’s information assets effectively. Start planning your transition to the new standard now, and stay ahead in the evolving world of information security.
Don’t miss out on valuable insights and industry updates! Sign up for our newsletter today to stay informed about the latest trends and best practices in information security. Get regular updates, expert tips, and exclusive insights on ISO 27001 compliance and information security management. Elevate your organization’s security posture and stay ahead of cyber threats. Subscribe now! 👇
