Professional Documents
Culture Documents
Understanding THE UPDATED ISO 27001
Understanding THE UPDATED ISO 27001
PROBLEM STATEMENT
From October 2022, the new ISO/IEC 27001 standard will be published,
meaning that you will need to update your ISMS and revise your infosec
security posture. The ISO 27001:2022 is the third revision to the internationally
recognized information security standards. These standards indicate the
exponential growth of cyber security. Organizations need to review their
certifications, apply for re-certification if they are ISO 27001:2013 compliant or
acquire new certification under the ISO 27001:2022 version.
SCOPE
The new ISO/IEC 27001:2022, combined with ISO/IEC 27002:2022, are aligned
with the recent cyber security trends and technologies to deal with
corresponding threats and vulnerabilities. In addition, the new structure and
categorisation with matching attributes enable better interoperability and
cross-referencing with other well-known standards and frameworks, such as
the NIST Cyber Security Framework. These standards and frameworks are
beneficial for an organisation's security. As ISO states, cyber security
compliance is much more than a tick-box exercise for organisations, and it is a
roadmap towards excellence in information security.
OVERVIEW TO ISO 27001: 2022
ISO 27001 is the only auditable international standard that defines the
requirements of an Information Security Management System (ISMS). An
ISMS is a set of policies, procedures, processes and systems that manage
information security risks, such as cyber-attacks, hacks, data leaks or theft .
EDITORIAL CHANGES
Full alignment with new ISO Harmonized Structure
Re-arranging of some English to allow for easier translation
Minor numbering re-structure to align with the harmonized approach
Removal of reference to control objectives as they no longer exist either
in Annex A or ISO 27002
TRANSITION PERIOD
Organisations that are certified to ISO/IEC 27001:2013 have a three-year
transition period to make the necessary changes to their ISMS (information
security management system).
COMPARISON BETWEEEN 2022 & 2013 STANDARDS
Note: “Reference to
“business” in this document
5.1 Leadership
can be interpreted broadly to
and Nil.
mean those activities that are
commitment
core to the purposes of the
organization’s existence.”
c) Note 1: Annex A
6.1.3
c) Note 2: Annex A contains a contains a
Information
list of possible information comprehensive list of
security risk
security controls. control objectives and
treatment
controls.
COMPARISON BETWEEEN 2022 & 2013 STANDARDS
9.1 Monitoring,
measurement,
analysis and
evaluation All three (sub-) clauses 9.1 / The organization shall
9.2.2 Internal 9.2.2 / 9.3.3 Documented retain documented
audit information shall be available information as
programme as evidence of ... evidence of ...
9.3.3
Management
review results
NEW REQUIREMENTS IN THE 2022 STANDARDS
Organizational
roles, In the note ‘top management may also’ becomes
5.3
responsibilities ‘top management can also’.
and authorities
Information
security objectives Clause 6.2 d) be monitored; and, g) be available
6.2
and planning to as documented information added.
achieve them
NEW REQUIREMENTS IN THE 2022 STANDARDS
There are 1
now control has been The
93
split into two
seperate controls. majority
56
controls
instead of of controls are subject to
controls from ISO some form of text change
11 5
new controls:
1. Threat intelligence new control attributes
2. Information security for the use of to aid categorization:
cloud services Control type
3. ICT readiness for business continuity Information
4. Physical security monitoring security properties
5. Configuration management Cybersecurity
6. Information deletion concepts
7. Data masking Operational
8. Data leakage prevention capabilities
9. Monitoring activities Security domains
10. Web filtering
11. Secure coding
WHAT WILL ISO 27001:2022 CHANGES MEAN FOR
THE ORGANISATIONS?
ISO 27001 consists of two parts. The first part, which is the mandatory part,
consisting 11 clauses. The second part which is termed Annex A, provides a guideline
for 114 control objectives and controls. ISO 27002 provides guidelines on how to
establish an ISO 27001-certified ISMS. Hence while the revisions to the standard are
connected to enhanced controls in ISO 27002 and Annex A, the ISO 27001 standard
has not been amended or updated yet. Thus, organizations already certified to ISO
27001 will not be affected immediately.
Organizations for a
security tools to ensure the records you
are using to demonstrate compliance
support to the new requirements.
Smooth Transition
BIBLIOGRAPHY
https://www.iso.org/standard/82875.html
https://www.iso.org/isoiec-27001-information-security.html
https://www.itgovernance.co.uk/iso27001-and-iso27002-2022-updates
https://www.itgovernance.eu/blog/en/category/cyber-security/iso27001
https://www.itgovernanceusa.com/iso27001-benefits
WHY TSAARO?
At Tsaaro, we offer top-notch privacy and cybersecurity services to help organizations comply
with regulations and maintain a secure infrastructure.
Our team of expert privacy professionals recognized by IAPP provides industry-standard services
such as Data Protection Services, Information Security Services, Penetration Testing Services,
Security and Privacy Standards Audit Services, Security Operations Center Services, and Training
Services. Choose Tsaaro to ensure your organization meets its regulatory requirements while
keeping your security infrastructure robust.
Akarsh Singh
(CEO & Co-Founder, Tsaaro)
CONTACT US
Akarsh is a fellow in Information Privacy
[email protected]
by IAPP, the highest certification in the
You can assess risk with respect to
field of privacy. His expertise lies in Data
personal data and strengthen your data
Privacy and Information Security
security by contacting Tsaaro.
Compliance.
Tsaaro Netherlands Office
Krishna Srivastava Regus Schiphol Rijk
(Co-Founder & Head of Cyber
Beech Avenue 54-62,
Security, Het Poortgebouw,
Tsaaro) Amsterdam, 1119 PW,
Krishna is a xKPMG data security Netherlands
consultant. He has vast experience in P: +31-686053719
Information Security and Data Privacy