Professional Documents
Culture Documents
ISO 27001 Germany 1695602942
ISO 27001 Germany 1695602942
Implementation Guide
ISO/IEC 27001:2022
Practical guide for the implementation of an information
security management system (ISMS) according to ISO/IEC
27001:2022
Machine translation
Publisher
ISACA Germany Chapter e. V.
Storkower Str. 158
10407 Berlin
www.isaca.de
[email protected]
Table of contents
1 Introduction 7
5 Glossary 45
6 References 47
7 List of figures/tables 49
8 Plants 50
8.1 Mapping Annex ISO/IEC 27001:2022 vs.
Annex ISO/IEC 27001:2013 ........................................................................50
8.2 Version comparison ISO/IEC 27001/2:2022 vs.
ISO/IEC 27001/2:2013 .................................................................................57
8.3 Holistic protection of the value chain .............................................................60
8.4 Internal ISMS audits - Mapping to ISO/IEC 19011
and ISO/IEC 27007.......................................................................................62
8.5 Implementation of internal ISMS audits (process diagram) ........................62
1 Introduction
This protection is not an end in itself, but serves to support ISO/IEC 27001:2022 and the requirements and measures
business processes, achieve corporate goals and preserve systematically and comprehensively set out therein, which -
corporate values through the trouble-free provision and in varying degrees and quality - are part of the operation of
processing of information. In practice, an ISMS uses the every ISMS, support the achievement of the objectives listed
following three perspectives for this purpose: at the beginning from all three perspectives (see Fig. 1):
◗ G - Governance view ◗ The governance view refers to the control aspects of the
– IT goals and information security objectives derived ISMS, such as close involvement of the management.
from the The following aspects must be taken into account: the
are derived from higher-level corporate goals (e.g. commitment of top management (see section 3.2
supported by or derived from COSO or COBIT) Leadership and Commitment), consistency between
business and information security objectives (see section
◗ R - Risk view
3.3 IS Objectives), the definition of strategies and
– Protection needs and risk exposure of the corporate
guidelines (see section 3.4 IS Policy), an effective
values and IT systems
communication strategy tailored to the target group (see
– Risk appetite of the company
section 3.9 Communication), appropriate responsibilities
– Opportunities and risks
and organizational structures (see section 3.5 Roles,
◗ C - Compliance view Responsibilities, and Competencies), and targeted
– External requirements due to laws, regulations and monitoring of performance (see section 3.7 IS Objectives).
Standards Chapter 3.9 Communication), appropriate responsibilities
– Internal specifications and guidelines and organizational structures (see Chapter 3.5 Roles,
– Contractual obligations Responsibilities, and Competencies), and targeted
performance monitoring (see Chapter 3.7
These views determine which protective measures are Performance/Risk/Compliance Monitoring). ISO/IEC
appropriate and effective for 27014:2020 provides further information on the
governance of information security.
◗ the organization's capabilities and business processes,
◗ The risk view, which serves among other things as a basis
◗ the need for protection depending on the criticality of the for comprehensible decision-making and prioritization of
respective company assets as well as risks, is a key element of the risk management process.
It is represented by IS risk management (cf. Section 3.6
◗ compliance with applicable laws and regulations.
Risk Management) and includes specifications and
methods for identifying, analyzing and assessing risks in
the context of information security, i.e. risks that represent
a potential threat to the confidentiality, integrity and/or
availability of IT systems and information and ultimately
the business processes that depend on them.
◗ The compliance view is firmly anchored in the entire monitoring) and by internal audits (cf. chapters 3.12
standard. On the one hand, it includes the definition of Internal Audit and 3.14 Continual Improvement).
required Appropriate documentation (see chapter 3.8
(security) requirements, which is supported by the Documentation) and the existing security awareness of
measures from Annex A. On the other hand, it refers to employees and managers (see chapter 3.10 Awareness)
the concrete fulfillment of precisely these requirements, are also essential for the compliance view.
which is supported by regular monitoring on the part of
management and those responsible for information
security (cf. Section 3.7 Performance/Risk/Compliance
Management
Legal and contractual
Company goals Corporate risks
requirements
Compliance
Information Security Management System (ISMS)
Compliance Reports
and legal requirements
Targ
ets Risks Rules,
protection
Targ
Risk Management goals
Rules
ets Information Security
Risks
Roles, Performance/
Leadership and Responsibilities, Risk Risk/
IS Objectives IS Policy
Commitment and management Compliance
Competencies Monitoring
Confidentiality
ISMS
Context of the According Incident
Organization to Management
ISO/IEC
27001
Supplier Continual
Documentation Communication Awareness Internal Audit
Relationships Improvement
In the following chapters, the key success factors for 2.3 Conventions
standard-compliant and proven implementation are outlined
for all components. For better readability, the gene- rical masculine is used in
these guidelines. Unless otherwise indicated, the personal
Since this guideline is also intended to provide practical terms used refer to all genders.
assistance, the explanations of the building blocks go beyond
the purely normative content of ISO/IEC 27001:2022 (or Where the terms "standard" or "norm" are used without
ISO/IEC 27002:2022). Conversely, this also means that not further specification, they always refer to the ISO/IEC
every reference in this document is equally "suitable" for 27001:2022 standard.
every ISMS or for every organization.
The term "chapter" is used when referring within this guide,
The establishment of an ISMS, whether for self-commitment the term "section" is used when referring to the standard.
or with the intention of certification, is an ambitious project
that - like any other project - requires "smart "1 goals, The term "Annex" is used when referring to Annexes of this
sufficient and expert resources, a suitable project manager, Guide, and the terms "Annex" or "Annex A" are used when
and a motivated and qualified team. In addition, the constant referring to Annex A of the standard.
and visible support of top management is crucial for
successful project completion and the subsequent transition to The terms "organization" and "company" each refer to the
ISMS operation. institution or the area within which the ISMS is implemented.
The terms are used synonymously in the guide.
In addition to assistance, the implementation guide also
includes references to further norms, standards or other Abbreviations used in the document and further definitions of
helpful sources, whereby these are then identified as such. terms can be found in the glossary in Chapter 5.
3 Building blocks of an
ISMS according to
ISO/IEC 27001:2022
3.1 Context of the Organization of Applicability, SoA). The SoA documents the justified
decisions on the implementation of the measures
One of the first tasks in implementing an ISMS is to define
(controls) from Annex A, i.e., whether the respective
the specific scope of the management system and to perform
measure is applied within the ISMS or not, including the
a requirements and environment analysis with respect to the
respective justification for the application or non-
organization and its stakeholders. By considering the context
application.
of the organization, an organization can ensure that its
information security measures are adapted to its specific ◗ It is customary for the information security policy to
needs and circumstances and are therefore effective. ISO/IEC define the scope, at least roughly, of the information.
27001 therefore requires organizations to carefully analyze is outlined. In contrast to the scope document, the security
and incorporate the organization's context into their policy and the SoA are generally internal documents and
information security planning and implementation. are not intended to be passed on to external parties.
However, attention should be paid to the exact scope
Determination of the scope definition and the contents of the SoA in the context of
According to the standard, the scope must be documented and service provider relationships and, if necessary, service
describes the scope of the ISMS within a company, i.e., it provider audits.
defines the boundaries and defines which assets (processes, Environment analysis
business units, locations, applications, etc.) are within and
which are outside the scope. The environment analysis serves to integrate the ISMS into
the overall environment for the scope in question. In addition
The identification of the scope is usually performed with the to the organizational and technical interfaces relevant for the
help of an environment and requirements analysis. ISMS, it should also describe the conditions typical for the
industry or location. The internal environment, e.g. other
◗ The scope document is essentially a document for the management systems (ISO 9001:2015, ISO 22301:2019, etc.),
stakeholders of the management system and should be interfaces with other important departments such as risk
be made available to them upon request, as this is the only management, human resources, data protection, facility
way for stakeholders, e.g. customers, to check whether the management, auditing and legal, if not part of the present
processes, infrastructures, topics or requirements relevant scope, as well as the external environment, e.g. important
to them are covered by the ISMS. suppliers and service providers, strategic partners and, if
applicable, other organizations, must be considered.
◗ In practice, organizations often refer to any existing
ISO/IEC 27001 certificates when making inquiries, which Requirements analysis
are
then - on closer inspection - are often not relevant or The persons responsible for the management system need a
sufficient for the request, since the requested process is clear overview of which stakeholders exist and what
not or only partially covered by the ISMS. To avoid requirements they have for the organization and the
unpleasant surprises, the scope document or a precise management system.
description of the scope should therefore always be
requested in addition to a certificate. The requirements of interested parties may include legal and
official requirements (e.g., EU GDPR, UWG, TMG,
◗ Another relevant document for illustrating the scope and regulatory authorities), but also contractual obligations, for
extent of an ISMS is the normatively ge-
example. The organization itself (or possibly a higher-ranking
Statement on the applicability of the standard (Statement
organization in the hierarchy) may also have decision-making
and/or directive powers, which must be taken into account
accordingly.
mation Security Guideline (cf. Information Security Policy ◗ Consistently address and respond to nonconformances,
in chapter 3.4 IS Policy) as well as via a user policy.
◗ Self-commitment to continuous improvement.
The central tasks of top management in the context of ISMS
◗ Under the heading of (IT) governance and in connection
with the responsibility of the executive board are:
For strategies, the demonstrable assumption of overall
responsibility, particularly in regulated areas, is also ◗ Assumption of overall responsibility for information
increasingly required by the relevant supervisory authorities1. security
Definition "Top Management ◗ Definition of decision criteria and principles for risk
assessment and treatment and introduction of ent-
Top management" refers to the management level that is processes (see chapter 3.6 Risk management).
responsible for controlling the organization to be protected by
the ISMS and decides on the deployment of resources. ◗ Integration of information security requirements into
business processes and project management models (see
Chapter 3.6 Risk Management)
◗ In the case of large companies, the standard does not
necessarily define "top management "2 as the highest
level of management. ◗ Conducting regular ISMS (top) management reviews (see
chapter 3.14 Continual Improvement)
level of the entire corporate group (e.g., group
management board). It can also be a local management or ◗ Provision of the necessary human and financial resources
division management that is responsible for the ISMS. for setting up the ISMS and for implementation
The concrete scope of the respective ISMS is always the information security strategy
decisive. ◗ Be visible in awareness events or measures (e.g.,lead video
message).
◗ In the case of external certification audits, it is possible
that the certification body nevertheless requires the
inclusion of the Documentation requirements
The certification body should therefore clarify this point
in advance with the certification body when certification According to ISO/IEC 27001:2022, the following minimum
is sought. For this reason, it makes sense to clarify this documentation requirements exist:
point with the certification body in advance if certification
is being sought. ◗ Section 9.3 "Management Review" requires
documentation of the review of the ISMS by the top
Tasks/responsibilities "Top management management.
management, including decisions regarding changes and
ISO/IEC 27001:2022 requires top management to set a clear improvements to the ISMS. These can be recorded as
example with regard to information security. In practice, this measures in the risk treatment plan.
includes not only a visible commitment to information
security, but also the ◗ In the management review, results, such as decisions on
opportunities for continuous improvement, must be
The data is stored as documented information.
◗ exemplary compliance with information security
requirements, In addition, the following documents have proven to be useful
in practice:
◗ sufficient and traceable provision of resources,
◗ Demanding a role model function from the other ◗ Derivation and assessment of current risks from identified
management levels, deviations between strategic IS objectives
and degree of target achievement, ideally as a risk
management plan.
1 Circular 10/2021 (BA) - Minimum Requirements for Risk Management - ◗ Evidence to report to senior management,
MaRisk (https://www.bafin.de/SharedDocs/Veroeffentlichungen/DE/ z. e.g. in the form of presentations, protocols or re
Rundschreiben/2021/rs_1021_MaRisk_BA.html). ports
2 See chapter 3.1 Context of the Organization and ISO/IEC 27000:2018,
Clause 3.75.
◗ Reporting on the implementation status including its ◗ When planning IS goals, it should be determined how
effectiveness control for defined measures (esp. these goals are to be achieved. This also includes the de
when these are overdue) from audits, risk treatment, definition of the prerequisites for realization. In addition
incidents or continuous improvement to the essential activities for achieving the goals, the
necessary resources and responsibilities as well as a time
Note: In the context of management responsibility, there are frame and a procedure for evaluating the realization must
various possibilities for documentation. The examples listed be defined. In practice, this is often done by direct
above are suggestions for possible records that help to ensure reference to planned and ongoing projects. It is crucial
the traceability of reporting and decision making. Each that non-functional requirements - and security
organization must find the form and frequency of requirements are non-functional in t h e majority of cases
documentation that is right for it. - are taken into account from the outset and integrated
both in the planning of projects, products and systems and
References
in the further training of employees ("awareness
ISO/IEC 27001:2022 - Sections 5.1, 9.1 and 9.3, 5.36 training").
ISACA Chapter Germany e.V., Practice Guide "Assessing the ◗ Within the framework of employee sensitization, it must
be ensured that all employees concerned within the
Performance of an ISMS through Key Indicators".
know the IS guideline. It must be communicated to the
3.4 IS P olicy employees concerned and, if necessary, also be made
available to the stakeholders (see chapter 3.10
The (top) management responsible for the organization must Competence).
define an information security policy that documents the
organization's strategic decision to implement an ISMS and, ◗ In order to achieve the goals in practice, it is important
that the individual employees are aware of their individual
in particular, includes a commitment to comply with ver-
information security requirements and a commitment to The employees are aware of their responsibility and
continuously improve the ISMS. personal involvement in processes in the context of
information security and are familiar with the associated
The guideline must be suitable for the organization's purpose concrete requirements (which are derived from the IS
and must encompass the intended principles and objectives of Guideline and are reflected, for example, in topic-specific
the ISMS as well as the organization's information security guidelines and work instructions).
goals in general.
◗ The IS guideline should not be mixed with more extensive
documentation and implementation requirements.
Success factors from practice such as the contents of security concepts or manuals.
However, the guideline (or other relevant high-level
The guideline represents an important tool for the organization,
documents of the ISMS) may very well be referred to in
through which the responsible management can communicate
such "downstream" documents in order to achieve
the importance of both an effective ISMS and compliance
consistency in the "chain of requirements".
with the ISMS requirements. In addition, the guideline sets
out the key strategic and tactical objectives to be achieved ◗ Depending on the approach chosen for the ISMS and the
with the help of the ISMS. Ideally, the implications and existing structure and work organization within an
organization, the ISMS may be
requirements for the respective personnel and business units
ganization, it may b e useful to use the IS guideline as an
within the scope are also outlined.
The IS strategy should be designed as a "powerful", i.e.
comprehensive, overall document on the topic of
information security or, if necessary, as a specific
"anchor" or "starting point" for the topic, which in turn is
completed by further detailed documents. In both cases, it
is important to use wording and scope appropriate to the
goals of the IS strategy.
It can also be useful to divide responsibility in favor of and any conflicts of interest a r e avoided (e.g., with the aid of a
flexible change management. For example, the IS guideline RACI4 or SoD5 matrix).
is the responsibility of top management, while the detailed
documents can be answered by the information security Success factors from practice
officer or the responsible departments.
Concretization of the roles within the ISMS organization
◗ Although a large number of templates and text modules At a minimum, the role of an information security officer
can be accessed in the appropriate search
it is recommended to create the IS guideline as a new/own (ISO) or chief information security officer (CISO) should be
document that covers the individual requirements of the established, although the requirement described in the
organization in the best possible way. Templates can standard refers to all responsibilities and authorities relevant
provide ideas and suggestions for structuring and possible to information security (see Section 7.2 a). Furthermore, the
content. However, it is crucial for the success of the roles of risk owner and asset owner must be defined and
implementation and the identification of the employees established within the ISMS.6
with the topic of information security that the guideline is
visibly oriented to the company's and subordinate In the context of information security, other roles such as
specialist objectives and that the core statements allow the security administrators, internal auditors, etc. must of course
reader to recognize a reference to the organization be defined and described.
concerned.
◗ The role description of the CISO/ISB must also include
the necessary competencies (experience, training,
Documentation requirements schooling, etc.).
According to ISO/IEC 27001:2022, the following minimum The job description or a letter of appointment listing the
documentation requirements exist: tasks assigned should be used for this purpose. For this
purpose, it is advisable to refer to a job description or a
◗ Information security guideline (see section 5.2 e) letter of appointment listing the assigned tasks.
In addition, the following documents have proven to be ◗ Conflicts of interest that should be avoided in practice at
all costs:
useful in practice:
– Information Security Officer (ISB or CISO7) and IT
◗ Topic-specific information security guidelines (see Manager/CIO8
Annex 5.1) – Data Protection Officer (DPO) and IT Manager/CIO
– Internal ISMS auditor and IT administrator
◗ Accompanying documents and organizational charts, for
example to clarify the organizational structure in the
◗ The two roles of ISB/CISO and DPO can, under certain
Context Information security (if not included in the conditions, also be used in practice in perso
guideline) nal union are exercised by one employee. However, this
combination is also associated with certain (unavoidable)
References
potential conflicts. For example, the DPO is protected by
ISO/IEC 27001:2022 - Section 5.2 law with regard to his actions and is subject to a duty of
confidentiality. However, he cannot automatically transfer
3.5 Roles, Responsibilities and Competencies this protection or this duty to the role of the CISO. There
is also a legal discussion regarding the guarantor
According to section 5.3 of ISO/IEC 27001:2022, the
obligation of the CISO or the compliance officer, etc. This
organization must define the roles required for an effective
does not apply to the DPO. This does not apply to the
ISMS and their responsibilities for establishing, maintaining
DPO. A personal union of these tasks can therefore, in the
and continuously improving the ISMS. In particular, the
worst case, result in a substantial conflict of interests.
necessary resources must be identified and made available
(see ISO/IEC 27001:2022, section 7.1).
4 RACI: Responsible (responsibility for implementation), Accountable (overall
responsibility), Consulted (professional expertise), to be Informed (right to
In this context, management must also assign and information), see also glossary.
communicate the responsibilities and authorities for tasks 5 SoD: Segregation of Duties, see also glossary.
relevant to information security. Care should be taken to 6 See section 6.1.2 c and Control A.5.9 "Ownership of assets".
ensure that the responsibilities of the roles are clearly 7 CISO: Chief Information Security Officer.
regulated and defined. 8 CIO: Chief Information Officer.
conflict and should therefore be analyzed and weighed up The consequences of the measures, including those that
in detail. are unpleasant or unpopular, cannot otherwise be
satisfactorily resolved.
◗ Depending on the size and business activities of the
organization as well as the concretely chosen scope of the ◗ In addition, one of the most important characteristics of a
ISMS CISO/ISB is the ability to distinguish between business
The combination of the roles of DPO and CISO can also objectives and business processes.
result in synergies that would not exist if the roles were and compliance requirements on the one hand and
separated (e.g., with regard to information flow, overview information security risks and measures on the other.
and design of measures). However, on the one hand, it to be able to "translate".
must always be carefully checked whether the candidate
in question has the necessary professional and personal ◗ The role of the CISO/ISB requires leadership
competencies and should be equivalent in the company to
competencies and can actually fulfill the workload in the status of management.
t h e two areas. On the other hand, as already explained, be on an equal footing with other employees.
it must be checked in detail whether the conflicts of
interest that may arise are "manageable" and would not ◗ Examples of organizational structures with regard to
information security can be found, among others, in "
lead to any serious disadvantages in the performance of COBIT 2019
(one of) the two functions. Focus Area: Information Security" and the BSI Standard
200-2 - IT-Grundschutz-Methodik. This describes, among
◗ Another example of possible conflicts of interest between
the DPO and the CISO relates to the collection and other things, the roles and responsibilities of the CISO, the
training of DPOs. control committee, the information security manager, the
evaluation of traffic and log data. While the DPO will roles in the risk management process, and the functional
usually only permit the collection and analysis of personal data owners.
or related data under very specific conditions and for a
specific purpose, the CISO would like to make the best Documentation requirements
possible use of technical measures to increase the level of
security (preventive protection) and to detect and evaluate According to ISO/IEC 27001:2022, the following minimum
potential damage events (detective protection). documentation requirements exist:
The organization must ensure that all persons have the ◗ Proof of competence (section 7.2 d)
required competencies through appropriate education, In addition, the following documents have established
training or experience. The organization must be able to themselves in practice as target-oriented:
provide evidence of the achievement of competencies, e.g. by
means of corresponding further training certificates in the
◗ Role descriptions, including the necessary re- porting to
personnel file (training histo- ry) of the respective employee top management (see section 5.3 b)
(cf. Section 7.2 d).
◗ Job profiles/appointment letters
◗ ISO/IEC 27001:2022 provides a rough framework for the ◗ Design of the strategic and operational cooperation
security organization of companies (e.g., top- between the DPO, QMB and CISO.
management, risk owner, auditor), but does not describe References
in detail how roles and responsibilities should be
distributed in practice. ISO/IEC 27001:2022 - Sections 5.3, 7.1 and 7.2 COBIT
2019 Focus Area: Information Security
◗ It has proven advantageous to select exactly the right
employees to fill the required roles within the ISMS. BSI Standard 200-2 - IT-Grundschutz Methodology
The CISO/ISB must select employees who already have
an "innate" affinity for the topic of information security or
who have sufficient intrinsic motivation. In addition to 3.6 Risk Management9
specialist knowledge, the CISO/ISB in particular requires
An IS risk describes the possibility that a specific threat
social skills, goal-oriented communication, integrity, the
exploits vulnerabilities of an information system, an
ability to convince others and successful conflict
application system, or (parts of) the IT infrastructure, which
management. Many of the tasks that arise in connection
constitutes a breach of information security (confidentiality,
with the implementation of the information security
integrity, or availability) and thus leads to a negative impact
strategy and (sometimes
on, among other things, business operations.
The Group's financial performance, financial targets, Basics of IT risk management and procedure
reputation, or goodwill are all affected by this.
How do risks arise?
IS risk can generally arise from various sources, such as Risks in the context of information security arise
errors in the configuration or maintenance of systems, human inherent in the use of IT systems and (emerging)
error, cyber attacks, natural disasters, or other unforeseeable technologies, among other things. Since information security
events. must always be viewed holistically according to ISO/IEC
27001, there are other sources of risk that (can) affect an
IS risk management is an important aspect of corporate organization's information/data and arise, for example, from
governance in general and IS management in particular. IS the following influencing factors:
risk management is an overarching process within a
management system which, in the case of an ISMS, ◗ Data exchange within and outside the organization
contributes to the systematic recording, assessment and
transparent presentation of risks in the context of information ◗ Adaptation of internal organization and cooperation
(especially in larger companies)
security and is intended to ensure an acceptable level of
security or a sustainable improvement in the existing level of ◗ (Existing) systems and applications that cannot be updated
security within the scope of the ISMS. or replaced
◗ Cooperation with external partners/service providers
The aim is to reduce the identified risks and avert intolerable
◗ Remote access to the corporate network (e.g. from partner
damage to the organization under consideration or to reduce companies and manufacturers)
them to such an extent that an acceptable level is reached for
the company. What is considered to be acceptable must be ◗ Natural phenomena/natural disasters
decided by the respective persons in charge in the respective ◗ Sabotage and white-collar crime
context, sometimes also in the respective situation. In ◗ "Human risk factor" (e.g., social engineering)
addition, there is the decision on how to deal with the ◗ Use of new types of systems and technologies (e.g. cloud
identified and assessed risks. and mobile devices)
◗ Entering new markets (geographically and product-wise)
In summary: Intolerable damage to the organization in
question must be averted or reduced to a level acceptable to
the company. Although all sources and influencing factors must be
considered, each organization must define its own risk
The specific objectives of risk management in the context of management priorities based on its business activities and the
information security are: resulting internal and external requirements.
Detection and assessment of risks the scope of the project (impact in the event of availability
restrictions or data leakage) and therefore requires a
Before the concrete identification and treatment of risks can penetration test before going live.
begin, both the ge- nerally formulated risk assessment process
and the company-wide or ISMS-wide risk acceptance criteria ◗ This example is not taken from a textbook. However, it
must be defined in coordination with the highest management shows that a risk analysis can also be carried out with the
level (top management) (insofar as these cannot or must not direct for-
already be adopted from a higher-level risk management mulation of (counter)measures can go hand in hand.
system).11 ◗ If the risk management process is highly dynamic, the
direct formulation of (counter-) measures can be a
The risk assessment process includes the following: The risk management process can also be used to initiate
risk management activities in a timely manner. If, on the
◗ Methods for risk identification other hand, the risk management process is implemented
◗ Criteria for the assessment of risks with a low dynamic, this can also be deliberately avoided
◗ Risk Acceptance Criteria in order to first complete the analysis
completely/comprehensively and then define further
Apply methods for risk identification activities "at leisure".
Identifying relevant risks usually requires that the views of ◗ With a "compact" or "dynamic" risk management process,
which can be swiftly brought to the discussion and
multiple stakeholders or departments be considered and If the treatment options are not selected, there is a risk that
brought together. Various techniques and methods can be the process as a whole will tend to be reactive and
used as tools, such as:12 measure-centered, and that the analysis of risks may be
neglected as a result.
◗ Interviews
◗ Scenario analyses/what-if analyses ◗ Therefore, depending on the size and scope of an
organization or a specific project, the most suitable
◗ Brainstorming nete approach to choose!
◗ Business Impact Analyses (BIA)
◗ Checklists Define criteria for assessing risks
◗ Delphi method
The criteria for assessing risks must be formulated in such a
◗ STRIDE Threat Model (Microsoft) way that they can be used for the greatest possible variation
Example of risk types or risk categories. Whether a point model or a
During the risk analysis of a new e-commerce web catalog of qualitative parameters is used is left to the specific
application, the people involved bring up different risk design of the risk management process.
aspects for discussion. The software developer sees some
weaknesses in the selected programming language, which ◗ From a practical point of view, it is advisable, in addition
to classical criteria (such as protection requirements for
can, for example, be countered by (automatic) code reviews. confidentiality/
The IT administrator expresses his concerns about the integrity/availability, supported business processes,
planned maintenance of the application by external service number of users) to provide a set of questions tailored to
providers and the access rights to the company network the organization's business, which can be individually
required for this. The data protection officer raises the supplemented per use case.
question of the appropriate protection of personal data and
requests a list of the technical and organizational measures to ◗ The assessment of the probability of occurrence (see step
2 "Risk analysis" below) is in practice
meet the requirements of Article 32 (1) EU GDPR. The
quite challenging. Here it is important that, in addition to the
information security officer in turn recognizes
In addition to the "look back" (empirical values,
comparable events in other organizations, key figures,
statistics, etc.), it is essential to also "look forward" in
order to be able to take into account previously
"unknown" findings and developments that may already
be on the horizon (e.g., the emergence of new
technologies).
In other words: "In risk management, success depends on ◗ A truly comprehensive risk management system that
the preparations made. covers all risks in the con- solidation at any time
In practice, the detailed identification and analysis of the
information security text in all areas of the company and
Set risk acceptance criteria
in all processes is a major challenge.
The definition of risk acceptance criteria is a central task in
the risk management process, because this is the only way to Orientation to an established risk management process
achieve the full benefit for the organization of not having to
treat all identified and assessed risks "equally" in terms of Once the risk assessment has been defined, the steps of the
costs and resources. risk management process follow, each of which is to be
carried out iteratively. Following an established process
◗ Risk acceptance criteria can take the form of acceptability serves transparency and traceability and makes the results of
levels depending on the qualitative and/or the entire process more reliable. ISO 31000 focuses on the
quantitative damage potential (e.g. non-compliance, following steps (see Figure 3):
financial damage, damage to reputation, impairment of
task fulfillment). 1. Risk identification
The identification of specific risks can be derived from the ◗ Standardized evaluation matrices can be used for risk
following scenarios, for example: analysis, although depending on the organiza-
It may make sense to use matrices with an even number of
◗ Risk analyses columns (e.g. 4x4). When using matrices with an uneven
– For business-critical processes, applications and number of columns/rows (e.g. 3x3 or 5x5), there is a basic
Explicit risk analyses and evaluations are carried out risk that the decision often falls on "the middle".
for the processes and systems concerned, with the help Step 3: Risk evaluation/assessment
of which clear statements can be made about the risk
situation and risk exposure of the processes or The (final) decision on the treatment of identified risks should
applications/systems concerned. lie with the risk owner of the respective risk, since he can
– Within project management, risk ana- lyses (with an assess the impact of the occurrence of the risk and bears final
adapted scope in each case) should be included as a responsibility for the business process(es) affected by the
mandatory element. risk. As a rule, the risk owner also decides on the provision of
resources (e.g., financial resources).
◗ Audits
– Audits carried out show that safety statuses are being
◗ At this point, it becomes clear how important the
The risk that standards and known best practices are identification and definition of the risk owner is for the
not or not sufficiently fulfilled by the responsible ge-
parties or in systems. process of risk management.
– The prerequisite for this is, of course, that audits are
also carried out (cf. chapter 3.12 Internal Audit) and ◗ In practice, the role of risk owner should be performed by
the appropriately designated responsible parties or
that the audit process includes a clear procedure for managers of the company (e.g. board of directors,
handling audit findings (documentation of findings, managing director, business manager, division manager,
transfer of findings to the auditee, etc.). department manager or group manager). In projects, the
◗ Operational project manager usually fills the role of risk owner, at
– Through findings in the context of the "normal" ope- least for project-specific risks.
During the course of the ongoing operation, new,
previously unknown risks may come to light, which Step 4: Risk treatment
should/must be reported (promptly) to the risk Risks are handled according to the risk map of the respective
management team or employee, depending on the risk organization. In the context of information security, the
management process selected. ISO/IEC 2700517 models are particularly suitable as a starting
◗ Security Incidents point for modeling risk treatment options (see Figure 4).
– Through safety incidents (however the defi-
nition for "security incident") can, on the one hand,
identify previously unknown risks that become visible
as a result of the incident. On the other hand, risks that RISK TREATMENT OPTIONS
are already known but have not been adequately dealt
with or have been accepted so far may actually occur
(for example, through active exploitation of an already
RISK RISK RISK RISK
known vulnerability by an attacker or through failure REDUCTION RETENTION AVOIDANCE TRANSFER
of a system due to insufficient technical
dimensioning).
◗ Measures for risk treatment can i n principle be taken ◗ Since the risk register usually contains sensitive and
from all sources, but must be (strictly) confidential information, an adapted
be aligned with Annex A of the standard and the SoA of rights and roles concept for data access must be created
the ISMS. and implemented.
References
Another method is the use of questionnaires/self-
assessments. Depending on the approach chosen, these ISO/IEC 27001:2022 - Sections 6.1, 8.2, 8.3
self-assessments can then be additionally evaluated by a
ISO/IEC 27005:2022
"second set of eyes". It is crucial that there is a formal and
pragmatic process that optimally supports the departments ISO 31000:2018
and project managers in their work and at the same time
COBIT 2019 Focus Area: Information Security
ensures that risks are identified at an early stage and dealt
with appropriately. BSI Standards 200-2 and 200-3
This ensures that these goals are described accurately, clearly and implements the information security processes. A
and in a way that everyone can understand. situation that exceeds the company's risk appetite is brought
back into the acceptable risk range by taking
The information security officer is now in a position to countermeasures.
evaluate and control information security on the basis of the
various key figures, e.g., with the help of a dashboard view. KCI - Key Control Indicators
From the large number of metrics, we focus on the following A key control indicator is a value (target/actual comparison)
metric classes w i t h regard to information security: that shows how effectively a company implements the
relevant measures and information security processes in
Key Performance/Risk/Control Indicators (KxIs) relation to target achievement. A measure is effective if the
control objectives are reliably achieved within the desired
KPI - Key Performance Indicators tolerance limits.
A key performance indicator is a value (target/actual
comparison) that shows how successfully a company In order to continuously monitor the effectiveness and
implements the relevant measures and the information efficiency of the ISMS processes and the established
security processes in relation to achieving the information measures, these indicators should be used in practice (see Fig.
security objectives. A measure is successful if the desired 5). They provide information about the performance status of
level of performance is achieved within the specified time the entire ISMS and serve as triggers for necessary
and with as little effort as possible. management intervention.
KRI - Key Risk Indicators This means recording the actual situation in relation to the
A key risk indicator is a value (target/actual comparison) that target situation described by the specifications and, if
shows whether changes in the risk profile potentially exceed necessary, intervening in a controlling manner. These
the d e s i r e d tolerance limits and thus jeopardize the performance indicators are summarized in relation to the
achievement of objectives. It is therefore a measure of how corporate goals to be achieved, legal requirements and
risk-oriented a company is in implementing the relevant protection needs.
measures.
The added value of KxIs lies in their ability to provide basic
statements about the protection system. They serve the
ISMS- Targets
Information
security risks
Risk
properties
Appropriately Effectively
Quality /
designed operated
Cost / Time
management as a comprehensible and understandable basis Relevant KxIs for the ISMS
for well-founded decisions on the management of information
security. In addition to the classic performance analyses, KxIs There are many sources of information security performance
can be used to reveal indications of (new) risks or changes metrics that offer a huge selection, such as COBIT 2019 for
within the risk landscape as well as non-conformities with Information Security19, The CIS Security Metrics20, or Performance
regard to the implementation of security requirements and Measurement Guide for Information Secu- rity21, to name a
guidelines. few.
Success factors from practice Of course, we would also like to take this opportunity to refer
to the ISACA practice guide "Assessing the performance of
Key indicators can only be used meaningfully to represent the an ISMS using key performance indicators (for a goal-
current situation and control if they meet certain oriented IS key performance indicator system according to
requirements: ISO/IEC 27004:2016)".
◗ Each key indicator must be measurable, repeatable and The specific selection of KxIs should be based on the
comparable, both along the timeline and circumstances of the respective organization, fulfill the
across industries or at least organizations. quality criteria already described and be continuously
optimized.
◗ Indicators should be systematically structured and based
on sound and appropriate statistical-mathematical
fundamentals with reliable measurements based on a Below are some examples of such key indicators from the
sufficient scope. ISACA Practice Guide for Assessing the Performance of an
ISMS by Key Indicators:
◗ The indicators should be timely and reflect current in-
formation. The frequency of data collection
Key Performance Indicators
The processing and the duration of the processing until the
– Time required compared to the planned time at the
p r e s e n t a t i o n to the management should enable the
given implementation rate (e.g. 80% of employees) of
control, similar to the displays on the dashboard of a car,
an awareness campaign.
which tell the "steering" of the system whether all
– Required budget compared to the planned budget for
"important" parameters are in the desired, orderly range.
the implementation of an awareness campaign
◗ Performance indicators must be relevant to the goals of
information security management, have a controlling Key risk indicators
effect on the
– Percentage of employees clicking a prepared phishing
and provide practical support for decision-making.
link during an awareness campaign
◗ The selection of indicators should be risk-based and the – Percentage of IT systems with vulnerabilities that were
cost-effectiveness of data collection should be taken into not closed in the designated time window
account. – Percentage of productive IT systems for which there is
The results must be compared with the informative value no longer manufacturer support
and usability for decision-making.
◗ The selection of KxIs should enable an evaluation of the Key Control Indicators
ISMS as a whole. That is, it is not sufficient, – Ratio of employees trained to date compared to the
only individual sub-aspects and indicators. Rather, they planned number of employees to be trained in an
must be combined into a meaningful whole and capture awareness campaign.
the performance of the entire ISMS. – Number of employees who passed the learning check
at the end of the awareness campaign, compared to the
◗ Performance indicators can also be used to evaluate and number of employees already trained during an
manage service provider relationships
and be included, for example, as part of a contract or in a awareness campaign.
(security) SLA.
◗ See also Annex 8.3 Holistic safeguarding of the
Value chain, page 66 19 ISACA, COBIT 2019 for Information Security, 2019.
20 The Center for Internet Security, "The CIS Security Metrics."
21 "Performance Measurement Guide for Information Security," NIST Special
Publication SP 800-55.
Documentation requirements The contents and the level of detail of the documents required
by the standard are influenced by the selected scope of the
According to ISO/IEC 27001:2022, the following minimum ISMS, the size of the organization, the technologies used
documentation requirements exist: and the organizational structure, among other factors, and
therefore differ from organization to organization.
◗ Documentation of the measurement structure for all
KxIs. It answers the following questions: The number and type of documents also vary. From a
– What was measured and evaluated? practical perspective, it may make sense for one organization
– Which methods were used for measurement, analysis to create a set of (many) individual documents and maintain
and evaluation and do they lead to reproducible them granu- lar. For another organization, on the other hand,
results? it may be more appropriate to use a central storage medium
– When was it measured by whom? that is accessible throughout the organization. In practice, this
– When was it analyzed and evaluated by whom? can also mean using a wiki or another online system as a
documentation basis.
◗ Results of the measurements and the management reports If no specific documents are required, the ISO/IEC
derived from them for escalation 27001:2022 standard uses the term "docu- mented
information" in connection with documentation and records.
In addition, the following documents have proven to be In this case, the company is free to decide in which associated
useful in practice: documents this information is kept, whereby the term
"document" includes any format.
◗ All records and evidence that provide information relevant
to the context of effectiveness monitoring
The documentation required within the ISMS shall be
as the organization must maintain documented evidence
continuously monitored to ensure the following:
of monitoring and measured results.
References ◗ Availability and suitability for use, irrespective of place
and time
ISO/IEC 27001:2022 - Section 9.1
◗ Adequate protection, e.g. against loss of confidentiality,
ISO/IEC 27004:2009 - Sections 5, 6, 7, 8, 9, 10 and Annex improper use or unauthorized access.
A Manipulation/loss of integrity
COBIT 2019 Focus Area: Information Security
Success factors from practice
3.8 Documentation In practice, the fulfillment of the requirement for document
control can generally be supported by a document guideline.
In the context of documentation, it must be ensured as a However, the decisive factor for successful implementation is
central requirement within the management system that (at not the quantity of documentation, but its quality, acceptance
least) the following aspects are regulated for the ISMS and availability as well as its efficient control (keyword:
documentation: document control).
◗ The creation and updating, as well as the approval and, if Practical aspects for the assessment of documentation quality
necessary, communication of documents must be and document control result from the following questions:
run according to a defined procedure (workflow).
◗ The documents must be clearly identified, e.g. title, date, ◗ How are contents and changes to the documentation
author, version, version number, version number, version communicated to the affected employees or ge-
number, version number, version number, version trains?
number, version number, version number, version
number, version number, version number, version ◗ How well are employees familiar with the content and
number. how are the requirements of the documents met by
and an appropriate suitability and fitness for purpose test the affected persons "lived" in everyday life?
(QA) and final release.
◗ Who knows the filing locations and filing media where
◗ Classification of documents or their contents with regard the current documents can be found?
to confidentiality
◗ Is the content prepared in a target group-oriented manner ◗ Evidence of the results of management reviews (Ab-
and formulated clearly? section 9.3)
◗ How easy is it for new employees to grasp the contents of ◗ Identified deviations from ISMS requirements and
the documents and implement them in their own working measures to correct them (Evidence of the nature of the
environment?
nonconformities and any subsequent actions taken,
set? What kind of demands are there?
S e c t i o n 10.1 f)
◗ Are the documents updated regularly or as required? How
well do the updates work? ◗ Evidence of the results of any corrective action (Ab-
and the release of the documents? section 10.1 g)
◗ Are there dedicated document owners per document? Furthermore, the organization must determine for itself what
documentation and records are necessary in addition to what
Documentation requirements is required by the normative in order to have "sufficient
According to ISO/IEC 27001:2022, the following minimum confidence that the processes have been carried out as
documentation requirements exist (sections 4-10): planned" (see Section 8.1).
◗ Statement of Applicability (Section 6.1.3 d) In addition, there are the documents and records from Annex
◗ Information security risk treat- ment plan (Section 6.1.3 A, provided that these measures are applied in accordance
e) with the "Statement of Applicability".
◗ Security objectives (Information security objectives and References
plan- ning to achieve them, Section 6.2)
ISO/IEC 27001:2022
◗ Monitoring to achieve the security objectives (informa-
tion security objectives and planning to achieve them, Ab-
sections 6.2 d, 6.2 g) 3.9 Communication
◗ Evidence of competence (section 7.2 d) When operating an ISMS, cooperation with other
organizations and departments is required (e.g., suppliers, HR
◗ Evidence of correct execution as well as changes to ISMS
processes22
(Operational planning and control, department, legal department, auditing). The main task of the
Section 8.1 d; Planning of changes, Section 6.3) "Communication" module is to determine and describe the
need for internal and external communication.
◗ Results of the Informa- tion security risk assessment
(Section 8.2)
External communication refers to communication with
◗ Results of the risk treatment (Results of the Infor- mation (external) stakeholders and other organizations (see also
security treatment, Section 8.3)
environment analysis in chapter 3.1 Context of the
◗ Evidence of the monitoring and measurement results of organization). Internal communication refers to the need
the ISMS, for communication within the management system and
Section 9.1) within the organization, e.g., with internal stakeholders
◗ Evidence of the implementation of audits and their such as the executive board, managers and employees.
results (Evidence of the audit program(s) and the
audit results, section 9.2) An analysis should determine what information needs to be
communicated in the context of the ISMS (Section 7.4 a of
22 In this context, the standard speaks of "documented information to the extent the standard), by whom (Section 7.4 d), and to whom
necessary".
(Section 7.4 c). In addition, it should be determined when
communication is to take place (Section 7.4 b), and
via which communication channels/processes (section 7.4 e) ◗ Process and communication interfaces should be clearly
this is to be done. defined in terms of efficiency and integrated into the or-
The information must be integrated into the organizational
Ideally, the results of the analysis are summarized in a and operational processes. It must be clearly defined
communication plan. This is usually formally developed in which information must be delivered to whom and by
five concrete steps (see Figure 6): whom at what point in time, for example as part of change
or incident management.
1. define communication goals
◗ The standard requires that the organization determine
internal and external communication in the context of the
ISMS.
2. conduct target group analysis and identify suitable media It does not explicitly require that this be done as part of
an analysis. However, the practical benefit of an
analysis is that it can be used to clearly identify which
3. identify the most important communication messages
requirements exist for a precisely fitting
communication structure.
4. assign roles and tasks
Success factors from practice
5. prepare a detailed communication plan A communication plan, also known as a communication
matrix, can look like tables 1 and 2.
Figure 6: Development of a communication plan
Internal communication
Communication reason Initiator Receiver Frequency Medium
Management review CISO Top Management annual Management report
according to template by
mail + presentation
IS Newsletter CISO All employees in the scope on a quarterly basis and on a E-mail
case-by-case basis in the
event of an acute threat
Risk Management CISO Top Management quarterly, case-related in Balanced scorecard report,
case of acute threat, via email if applicable.
project-related
Security Incident Support CISO case-related Escalation according to SIRP
(if necessary further according (Security Incident Response
to SIRP) Process)
Security Incident CISO Top Management case-related E-mail, if necessary verbally
Security incident CISO Data Protection Officer case-related E-mail, if necessary by
with personal data telephone or verbally
External communication
Communication reason Initiator Receiver Frequency Medium
Report Operating Service Operating service CISO quarterly SLA report according
Provider provider to template via e-mail
◗ Once the communication matrix has been worked out, it of safety-relevant events and safety incidents in operations
has been shown in practice that various interfaces betwi- falls into the categories of "lack of sense of responsibility,"
already exist between communication partners and/or "lack of or immature processes," and "inadequate employee
departments. Identifying these is an important success training and/or sensitivity."
factor for efficiently designing communication in the
context of the ISMS in the organization. It may make The creation of a "healthy" risk awareness is therefore an
sense to integrate the IS communication plan into an essential component of a practical ISMS that generates
overall communication plan. benefits for the organization by identifying threats at an early
stage, avoiding security incidents and "saving" the effort that
◗ In order to be able to communicate with all levels of the
organization, a platform should be provided that- would be required to deal with them.
with which the comprehensive security information of the
ISMS is accessible to different target groups. Security awareness is not a matter of course, but must be
Collaboration platforms for better communication or actively promoted and demanded by the company through
reporting could be e.g. intranet, Confluence, Wiki or appropriate awareness campaigns, including the following
similar. important aspects (see Section 7.3):
In addition, the following documents have proven to be useful ◗ The contribution of each employee within the scope of the
ISMS should be aligned with the requirements set out in
in practice: the user guide.
The materials used for awareness measures ideally
◗ Procedures for internal and external communication support the communication of this content. The materials
◗ Communication matrix used for awareness measures ideally support the
◗ Communication plan communication of this content. It is recommended to
References prove successful communication by means of tests.
ISO/IEC 27001:2022 - Section 7.4 ◗ Effects and, if applicable, sanctions for non-compliance
with safety regulations should be derived from the
materia-
3.10 Awareness The information must be provided in the form of the data
used in the context of an awareness measure. At the same
"Information security is the operation of firewalls and time, a user's report of a security breach (e.g.,
antivirus" - this is one of the frequent and major whistleblower) due to his or her own misconduct should
misconceptions that jeopardize the security of information not generally lead to sanctions.
and IT systems of a company, because a large number of
Before starting to define and plan awareness measures, a As an alternative to such campaigns, the "confrontation" can
company should therefore think about its individual potential also take place passively, for example at the beginning of a
dangers (risks) in relation to the users. It is not very helpful to classroom training. Demonstrations could include live
confront users with hazards and situations that do not apply to hacking sessions, anonymous testing of password strengths,
their area. or role plays.
to establish. Despite all confrontation, the basic direction In addition, particularly vulnerable target groups (e.g., IT
must always be to "pick up" the employees where they are administrators, employees and managers with far-reaching
at the moment (What IS requirements already exist? How access and information rights, mobile employees, but also call
have these been communicated so far? What incidents center employees or other groups with external contact) must be
have already occurred? etc.), and to actively involve them. taken into account in order to weigh up whether they need
special training.
◗ It is also important to be clear about the framework and to
identify any information gaps that may exist.
cken to know. The scope of the activities performed and Awareness materials should be created and distributed as
information provided must be consistent with the needed to support the training. These can be, for example, one-
The campaign must be balanced against the "absorption page or multi-page brochures or newsletters with training
capacity" of the addressees. Only in this way can the content, but also posters, stickers or other media with a high
campaign develop its full effect and be perceived neither recognition effect (posters, flyers, videos, etc.).
as too banal nor as too excessive/overloaded.
◗ Optimally, awareness materials are created by the
company's own employees as part of the
Phase 3: Sensitization
IS campaign. Additional motivation to cooperate can be
The actual sensitization is at best a mix of knowledge achieved through an incentive system23.
transfer, demonstration and active participation of the ◗ A guiding video from top management can emphasize the
employees. Various methods can be used to impart importance of
knowledge (pre-service training, e-learning, etc.). of the topic with a corresponding request to the co-
The aim is to emphasize the importance of employees
The categorization of awareness-raising activities into handling information in a mindful manner.
thematic areas or measures has proven effective, in particular
the following: Phase 4: Create sustainability
One-off awareness measures are not sufficient to bring about
◗ Physical safety/workplace safety a sustainable change in behavior among employees. Although
– What must be considered when entering the it is necessary to carry out extensive initial sensitization, only
buildings and regular repetition of the topics on the basis of a training plan
premises be respected? and regular communication of the key messages in everyday
– How can unauthorized persons be prevented from life can ensure lasting awareness. Ways to create a
gaining access, e.g. incorrect deliveries or an unknown subconscious presence of the topic in everyday life include:
person attaching himself to a group of employees and
entering the building unnoticed ("piggybacking")?
◗ Regular sending of simulated phishing e-mails (e.g. to
reveal access data)
◗ Privacy
- The data protection section should comply with the legal ◗ Publication of current news (e.g. via intranet, employee
requirements. newspaper)
The data must be kept secret, deletion procedures must
be in place, and employees must be obligated to ◗ Integration of an online quiz on the topic of IS on the
intranet or via an app (possibly with incentives)
comply with them.
◗ Use of a screensaver with appealing safety messages
◗ IT Security
- What is important when dealing with IT systems and ◗ Annual implementation of a cyber security month with
compu-. e.g. internal or external presentations, live hackings
tern, e.g. handling e-mails, surfing the Internet,
handling removable media (CDs, USB sticks),
protection and tools against malware?
◗ Telephony
- What can happen when information worthy of protection
is
tions or processes are disclosed over the phone?
◗ Reporting and handling of security incidents
– What (central) points of contact are there?
– What are relevant initial actions?
part of customer contracts. This standard also specifies Components should be part of IT operations or software
requirements for information security (e.g., physical security, development.
personnel security, IT security).
Right to audit
Success factors from practice The right to audit should be included in every contract.
the. Furthermore, potential deviations should be evaluated ◗ Topic-specific guideline for the use of cloud services (cf.
by the client according to his own risk appetite. ISO/IEC 27001:2022, section 5.23)
◗ In the case of personal data, the use of service providers, ◗ Industry-specific safety requirements, such asthe BDEW
in particular those that are outside the white paper from the energy sector
German legal area or outside the EEA24 should be examined
very critically. References
◗ This context also includes the topic of commissioned data ISO/IEC 27001:2022 - Sections 4.3 and 8.1
processing according to Art. 28 EU GDPR25 independently. and 5.19 - 5.23
of where the service provider is located.
ISO/IEC 27036-1:2021
Key figures
BDEW white paper "Requirements for secure control and
The following key figures26 can be used, for example, to evaluate telecommunication systems".
information security in relation to service providers:
3.12 Internal Audit
◗ Number of service provider reports delivered on time in
relation to the total number of agreed reports The primary objectives of internal ISMS audits are to check the
extent to which the ISMS meets the organization's own
◗ Average time from detection to reporting of security
incidents by service providers requirements and the requirements of ISO/IEC 27001:2022
(compliance check) and to check the implementation and
◗ Number of service providers contractually assuring IS effectiveness of measures taken (implementation and
measures in relation to all service providers.
effectiveness check).
◗ Number of security incidents at service providers in the
past reporting period For this purpose, an audit program must be planned and
implemented that regulates aspects such as frequency,
Documentation requirements procedures, competencies and responsibilities, planning
According to ISO/IEC 27001:2022, the following minimum requirements, follow-up and reporting. Furthermore, it must
documentation requirements exist: be defined how corrective and preventive actions (i.e., actions
directly derived from the audits) are handled and where they
are "kept" for further processing.
◗ Definition of the scope, taking into account the
dependencies on external partners and service providers.
leisters (section 4.3) The audit program is intended to ensure that all business
processes covered by the ISMS (according to the scope) are
In addition, the following documents have established audited at least once every three years with regard to the
themselves in practice as target-oriented: information security requirements and guidelines applicable
at the time of the audit and with regard to conformity with the
ISMS. Evidence of this must be provided.
◗ Processes and procedures for service provider
relationships (cf. ISO/IEC 27001:2022, sections 5.19-
5.22). There shall- Internal audits within the meaning of the standard do not refer
The requirements resulting from the procurement strategy to the activities of the internal audit function in the narrower
and any service provider relationship should be defined. sense, although this can also be a body that carries out
In addition, information security risks should be addressed internal audits. In practice, internal ISMS audits are a central
within the ICT service and product supply chain. task of the ISMS manager/CISO, who plans and manages
audits - possibly together with an internal audit team or with
◗ Agreements on information security requirements with
suppliers. Here, the different the help of external support and taking ISO 19011:2018 into
categories of suppliers are taken into account. account.
Planning
Assignment
Communication and
Review and control
improvement Determination
Start meeting
Roles and
responsibilities
Monitoring Implementation Information collection
and verification
Document viewing
Results
Audit criteria and scope Audit activities
Conclusion
Figure 9: Structure for internal ISMS audits (audit program vs. audit activities)
The ISMS serves to monitor all activities in the context of of the affected processes (core processes, damage impact,
internal au- dits and forms the interface to other processes business criticality) and IT systems as well as the results
in the ISMS. of previous audits are taken into account.
◗ The specific "audit activities", which involve the planning ◗ The audit program must define t h e general criteria for
and practical implementation of individual internal audits. Depending on the size of the organization,
Audits include. Depending on the number of audits performed and the
desired level of detail of the audit program, the specific
scope of individual audits can also be defined directly
The audit activities serve the operational implementation of
here.
the audit program, so coordination with the organization's
internal auditing function makes sense. ◗ Audits that have been carried out must be documented and
the corresponding information (e.g. in the form of audit
In larger organizations, it makes sense to divide these areas The audit report must be available as proof of the
organizationally, with an audit team leader responsible for the implementation of the audit program.
audit program and a team of auditors carrying out the internal
◗ Regular management reports are to be prepared with
audits in practice. It must be ensured that both the overall information on the performance of the audit program and
design and the operational management of the audit program on the
work optimally towards achieving the IS objectives. This on the audit activities and their results.
gives the organization the best possible return on investment
(ROI) for the resources used in the audit area. Planning" sub-process
The audit program The audit program should be based on the individual
requirements of the respective organization (see sections
The audit program consists of a cycle with the sub-processes
4.2 and 4.3 of the standard and chapter 3.1 Context of the
planning, definition, implementation, monitoring, and review
Orga- nization of this guide). Furthermore, the defined
and improvement of the audit program itself (see Figure 10).
objectives of the audit program should indicate that
◗ In the audit program and in the risk-based planning of ◗ the audits are oriented to the risks identified,
specific audit activities, both the significance
◗ the importance of the individual business processes is
taken into account and
Audit program
Reporting
(9.2 f)
The employee responsible for the audit program must For the implementation and execution of the audit program,
perform the following duties, among others: the decisions made during the definition are to be
implemented.
◗ Definition and implementation of the entire audit program
Whether objectives and the scope of individual audits are
◗ Identify, assess, and address risks directly impacting the already defined here depends on the respective design or the
audit program (e.g.,too scarce
resources, gaps in auditor qualifications, areas of level of detail of the audit program. The objectives and scope
consideration too large for individual audits). of audits generally result from the individual requirements
and the protection needs of the IT systems concerned.
◗ Establishment of processes for the implementation of au-
dits It is highly recommended to select the areas to be audited in
◗ Determination and procurement of the necessary resources such a way that they can be audited individually and with
manageable effort. Further factors for the selection of the
◗ Determination of the audits and definition of the areas and
criteria for the individual audits areas to be audited are the criticality of the business or service
processes and the tolerable period between two audits. The
◗ Determination of the methods and tools to be used total number of audited areas (within three years) must, of
◗ Selection of auditors with ensuring their qualification and course, correspond to the scope of the ISMS.
experience
Monitoring" sub-process
◗ Ensure that audit program records are kept current at all
times In the "monitoring" sub-process, the audit program itself must
be continuously monitored with regard to quality and
◗ Ongoing monitoring and improvement of the audit
program itself efficiency. Among other things, it must be questioned
whether
◗ the "right" processes/areas/applications/systems/data are ◗ The necessary competencies of an internal auditor should
audited and be described (e.g. in a role or position description).
len description).
◗ the depth of testing as well as the type of testing are
suitable to optimally support the objectives.
Planning and execution of audits
It is helpful to document the effort per audit. Since the effort Audits are used to identify both non-conformities to existing
required can vary depending on the characteristics of the IT specifications and potential previously unknown weaknesses
system and/or the organizational unit concerned, data is and hazards.
collected in this way so that the effort required for future
audits can be better estimated. ◗ When it comes to audit planning, the following applies:
no audit without a dedicated audit assignment. This means
When monitoring the performance of the audit team that the actual work is
members, it is important to pay attention to the quality, for The audit should not begin until the assignment has been
example the objectivity, clarity and comprehensibility, of the secured and formally communicated. In addition, the area
audit results. Among other things, it is relevant here whether to be audited should be actively involved in audit
the department responsible for an IT system has received planning, for example, to coordinate the scope (what will
comprehensible, suitable and complete recommendations for be audited against), scheduling and the availability of
action in response to identified deficiencies. If contact persons during the audit.
recommendations for action are not understood because, for
◗ If possible, (immediate) measures for the appropriate
example, information is missing or recommendations for treatment of hazards should already be taken in the audit.
action are not appropriate, this indicates that the members of to be derived. However, implementation must be formally
the audit team need additional technical or methodological coordinated with t h e respective service, system and/or
support. risk owners.
This sub-process also includes the collection and evaluation ◗ If previously unknown deficiencies or risks inherent in the
process are identified, the treatment of which in the short
of feedback from management, the audited areas or term is
organizational units, the auditors and other stakeholders. is not possible, these are to be included in the central risk
Review and improvement" sub-process
inventory.
In the "Review and Improvement" sub-process, the persons ◗ Audit results must be regularly reported to the ISMS
management level (at least in consolidated form).
responsible for t h e audit program regularly check whether
be
the expectations of the stakeholders are still being met. The
starting point is the information gathered in the subprocess ◗ Audit reports must clearly state which systems and
"Monitoring" have been collected. Furthermore, the documents have been audited or reviewed and used as the
continuous professional and methodological development of basis for the audit.
were used for the audits.
the auditors must be determined and controlled.28
◗ Open communication that is maintained throughout the
The status of the audit program must be reported to the entire duration of an audit makes a significant
responsible management. It is also useful to introduce KPIs to contribution to
make the quality level of the audit program and the internal This helps to reduce reservations on the part of the audited
audits as a whole measurable and comparable. Quality area and thus lowers the risk that information is withheld
statements such as "Proportion of measures accepted by or not presented in a realistic manner.29
departments and initiated for implementation" are more ◗ To determine the suitability, completeness and
important than purely time-based statements such as "Quality effectiveness of the implemented measures, the re
of the internal audit program" or "Quality of the internal In the course of the audit, the auditor directly questions
audit". the employees primarily responsible for the operation and
z. e.g. "working time spent per audit" to be preferred. monitoring of these measures, examines the
documentation and/or arranges and assesses practical
Competence and selection of auditors demonstrations. The auditors are required to have
extensive technical knowledge and methodological skills.
◗ ISMS auditors should be selected to ensure the necessary It is therefore appropriate to select the auditors on the
objectivity, expertise and impartiality. basis of the objectives and contents of the audit in
The auditors are responsible for ensuring the quality and question.
reliability of the audit process.
28 See also section 7 of ISO/IEC 19011:2018. 29 See also "Communication - The Missing Piece," ISACA Journal 3/2012
(https://www.isaca.org/-/media/files/isacadp/project/isaca/articles/journal/archi-
Implementation Guide ISO/IEC 27001:2022
ves/journal-volume-3-2012.pdf).
38 3 building blocks of an ISMS according to ISO/IEC
27001:2022
◗ In the context of planning individual audits, i.e. before the Differentiation of internal ISMS audits from the internal
start of implementation, the responsible lei- control system (ICS)
The assumption of the costs incurred must be clarified at
all levels of management. A company's internal control system (ICS) represents an
essential control and monitoring instrument. Aspects of the
◗ At the latest in the final meeting of an audit, the results are
to be reviewed together with the audited area. ISMS can be a component of the internal control system, but
The audit report should be formally accepted by the the ICS generally goes far beyond the ISMS and also
auditor, who should understand and accept the findings includes, above all, specialist process controls.
and recommendations for action. Formal acceptance of
the audit report should be sought. Disagreements that In an ICS, a distinction is made between process-integrated
cannot be resolved should be documented in the report. and process-independent control activities. The former are
usually control measures that result from risk analysis, good
◗ Ensure that relevant information and audit reports are kept management practices or internal and external requirements
confidential and protected from unauthorized access.
(e.g. dual control principle for booking approval, multifactor
The data must be stored and archived in such a way that it
is protected from unauthorized access. authentication for critical users, etc.) and can therefore have
the recommendations of ISO/IEC 2700x as their origin. This
◗ The requirements from section 9.2 for internal audits can is the so-called "first line of distribution", which is intended to
be met by implementing the recommendations from ensure the regularity of processes and activities in the
Section 6.4 of ISO/IEC 19011:2018 and ISO/IEC company and is performed by the direct management level.
27007:2020 (see Chapter 8.5 Implementation of internal
ISMS audits (process diagram), page 62), although it The effectiveness of the control measures can also be checked
should be noted that the normative requirements of independently of the process, for example by an ISMS outside
ISO/IEC 27001:2022 are by no means as extensive as IT or by a compliance function. In practice, this is often
those described in current best practices. referred to as the "second line of defense". This review does
◗ Further information on internal audits can be found, for not replace the activities of the internal audit department,
example, in ISACA's QAR IT Guide. This guide which in turn should review the effectiveness of the entire
is geared towards internal IT auditing, but can also be ICS as the so-called "third line of defense".
applied mutatis mutandis to internal ISMS audits.30
◗ If an ICS has already been established or is in the process
Differentiation of internal ISMS audits from certification of being established or changed, it is worth checking
whether
audits
and to what extent the control and audit requirements of
the ISMS can be taken into account or even partially
Internal (ISMS) audits are an essential instrument in the
integrated there. Complete integration will not be possible
continuous improvement process of the management system.
in practice, as the objectives of the two systems differ
They are used to check whether the management system
substantially. However, organizational interfaces to the
meets the organization's own requirements and where there is
ICS and the internal audit are recommended in any case.
potential for improvement. The audit program ensures that all
areas of the scope are effectively controlled by the ◗ In practice, COSO or COBIT, for example, are used to
management system. model an ICS.
Certification audits are always external audits. They are Documentation requirements
performed by qualified external auditors on behalf of a According to ISO/IEC 27001:2022, the following minimum
certification body. External auditors usually work on the basis documentation requirements exist:
of the two standards ISO/IEC 27006:2015 "Requirements for
bodies providing audit and certification of information
◗ Documentation of the audit program(s) (section 9.2 g)
security management systems" and ISO/IEC 17021-1:2015
"Conformity assessment - Requirements for bodies providing ◗ Documentation of audit results (section 9.2 g)
audit and certification of management systems".
30 See https://www.isaca.de/sites/default/files/attachements/isaca_leitfaden_ii_
2016_overall_screen.pdf.
– who are the employees in charge of the processing, if Organizations are therefore called upon to analyze existing
any, best practices and apply them in a manner that is constantly
– which measures are (currently) planned to solve the adapted to their needs. In particular, they are called upon to
problem, derive improvement potential from their non-conformities
– when the implementation of the required measures is and thus continuously improve their ISMS. This process is
planned. called continuous improvement process (CIP).
◗ All documented safety incidents must (after processing) An organization that wants to operate a standard-compliant
b e subjected to an examination as to whether by
Optimization of the Incident Response Plan or changes to ISMS must therefore define organizational measures on the
the organizational structure and processes (including the basis of which continuous improvement takes place in a
creation or adaptation of instructions for action) can targeted and planned manner. The implementation of these
improve the handling of similar incidents in the future. measures and the respective results must be monitored and
appropriately documented. In addition, the organization must
◗ When processing security incidents, it must always be demonstrate how it ensures that any deficiencies identified
documented a t the conclusion how such
are not repeated.
incidents are to be avoided in the future or their impact is
to be minimized. If necessary, further measures can be PDCA (Plan-Do-Check-Act) cycle
derived from this, which are to be transferred to regular
The recommended approach to sustainably ensure the
operation.
continuous improvement of the ISMS can still follow the
PDCA cycle, which is the basis of many management
Documentation requirements systems.
Integration of existing management systems Inquiries of the following type are now commonplace in
ISMS departments:
The previous guideline focuses on the
i m p l e m e n t a t i o n of an ISMS, but only ◗ Please check if we are compliant with "China's Cyber Se-
marginally considers the integration of the management curity Law".
system into existing governance structures, which is often
◗ Which security measures are relevant for OT security?2
useful in this context, together with the associated
opportunities and challenges, such as the use of synergy ◗ A stakeholder/major customer would like a safety self-
assessment according to
effects by bundling measures or control sets. ISO/NIST/BSI/VDA-ISA/EU-
Have DSGVO carried out.
In practice, it is usually not possible, or rather not necessary,
to introduce an ISMS in isolation as an island. In addition to
other management systems already established in the A new challenge is therefore the need to respond promptly to
organization, including their measures and processes, other a growing number of compliance requirements, which often
operational or organizational circumstances must also be involve essentially the same or at least similar measures as the
taken into account. standards we are familiar with.
All management systems have large overlaps in structure, As a result - as a kind of bow wave of compliance
internal and external requirements, and thus also requirement lists - mapping tables are also growing in which
opportunities to use synergies. By harmonizing the the respective controls, benchmarks, etc. are correlated with
requirements of the management systems, individual each other in order to be able to use already assessed
measures can be implemented across management systems, implementations in other management systems, such as the
such as document control or the integrative use of risk ICS or the data protection management system.
assessments. This reduces the effort and risk involved in
introducing, operating and verifying the management In the meantime, some risk management/compliance/ISMS
system.1 tool providers have adapted their solutions so that their own
control objectives can be defined and linked to the control
In this chapter, some of the challenges frequently encountered objectives of the various standards.
in companies and the associated approaches are outlined. It
explicitly addresses not only new management systems to be This makes it possible to check the degree of maturity or
introduced, but also potential improvements for established fulfillment of a standard at any time and to immediately
systems. Due to the immense increase in cyber security recognize which con- troles of the selected standard still have
threats in recent years and the rapidly growing compliance open points or ri- sibilities.
requirements, especially for internationally active
organizations, established systems must also ask themselves
whether the current regulations/processes are still up to date
in order to meet the growing tasks not only effectively but
also efficiently.
2 See https://www.isaca.de/sites/default/files/isaca_leitfaden_
1 See Annex SL. cyber-sicherheits-check_ot.pdf, page 17 ff.
Operationalization through establishment of a new compliance requirements. At the same time, this enables
"Corporate Control Database" users to compile the requirements on an individualized basis
in terms of industry, product and performance, and to monitor
Based on the approach from the previous chapter, the compliance with them.
introduction of a centrally maintained "corporate control
database" represents an area of action in terms of continuous In addition, they contain corresponding workflows and
improvement of all existing management systems. interfaces so that changes can be integrated automatically. In
this way, governance requirements are consolidated and
In most organizations, the managers responsible for a integrated into a holistic risk and compliance management
management system have currently still defined their own system. T h e quality of the database grows with each new
measures, which leads to the fact that many control measures, evaluation of a standard or norm.
e.g. secure deletion of i n f o r m a t i o n , a r e maintained
twice - if not three times - in different places in the Operationalization through alignment of "Central
organization, including all follow-up measures, such as e.g. Corporate Controls" with domains
ascertaining the implementation status, auditing, checking the
effectiveness, etc. This undoubtedly leads to additional effort In practice, it has proven useful to group and align the aspects
and, in particular, to a lack of understanding on the part of the to be managed in the organization into domains in order to
person technically responsible for the subject. This inevitably create a thematically clear assignment and responsibility.
leads to additional work and, in particular, to a lack of These domains should be integrated into the higher-level
understanding on the part of those technically responsible for model of the organization in relation to its management
the topic, since the same questions are asked by various systems, with COBIT being a suitable orientation.
reviewers/auditors.
Underlying domains from the area of information security
Those responsible are also affected by industry-, product- and could, for example, be taken from ISO/IEC 27002. With the
service-specific norms, standards and best practices, which new version, for example, grouping could take place
often conflict with each other. Meeting these requirements is according to the new property "Cybersecurity Con- cepts".
made particularly difficult by a large number of different, Alternatively, grouping according to the BSI IT-Grundschutz-
manual and isolated processes. Kompendium or NIST Special Publication 800-53 would be
conceivable. It is important that all areas in focus are covered.
The harmonized structure of management systems (according
to Annex SL) has made many ISO management systems The choice of control frameworks is of secondary importance
suitable for integration. Prominent examples are ISO/IEC and should be selected appropriately by the organization for
27001, ISO/IEC 27701, and ISO 22301. Other management its purposes, which may ultimately also vary due to external
systems not directly relevant to IT, such as quality requirements or the business model. An automotive
management, occupational health and safety, and manufacturer is more likely to use TISAX, while the Cloud
environmental protection, also follow the new structure and Security Alliance's (CSA) Cloud Control Matrix (CCM) is
thus enable an organization-wide integrated management more suitable for a SaaS provider, for example, whereas the
system in the context of GRC. BSI Compendium will be primarily useful in the regulatory
environment.
A corporate control database harmonizes rules across
different specifications and guidelines for the user on the Whatever the organization decides, with appropriate software
basis of a common framework. This is also accompanied by a support or manual diligence, the ultimately selected standard
changed approach in which the control measures are no can be maintained via a meta-level, so that many standards
longer aligned with standards but with topics. Alignment with can be taken into account to a large extent. In this approach,
domains (see below) is useful for this purpose. the domain manager is responsible for resolving innovations,
requirement conflicts or ambiguities at a central point. The
The standards are assigned and maintained with the help of a quality of the database thus grows increasingly with each new
meta-level. This meta-level thus enables measures that are evaluation of a standard or norm.
consolidated for the entire organization3. This has the advantage
that the answers to other "standards/laws/best practices" not
previously considered become apparent, even if one has never
previously been involved with the
3 See, for example, the controls from the standards IDW PS 951, EU-DSGVO (ISO/
IEC 27701:2019), ISMS (ISO/IEC 27002:2022), BCMS (ISO 22301:2019), QMS (ISO
9001:2015) to IT/OT Operations Controls.
5 Glossary
ADV Commissioned data processing - the processing of COSO Committee of Sponsoring Organizations of the Tread-
personal data by service providers (externally or internally way Commission - a U.S. organization that, among other
by legally independent entities of a group of companies) in things, developed the recognized standard for internal
accordance with Art. 28 EU-DSGVO. controls known as the COSO model.
Asset Anything that has value to the organization, also called DPO Data Protection Officer
an infor- mation asset or information asset. There are many
DSGVO see EU-DSGVO
asset types, such as: Information, software, hardware,
services, people and their qualifications, skills and EU European Union
experience, and intangible assets such as re- putation and
image. ISO/IEC 27005:2022 distinguishes between primary EU-DSGVO EU General Data Protection Regulation
and secondary assets, where pri- mary assets include
business processes and business activities as well as EEA European Economic Area
information. Secondary assets support the primary assets,
GRC Governance, Risk and Compliance
such as facilities, rooms, hardware, software, network,
personnel, and websites. ICT Information and Communications Technology
BCMS Business Continuity Management System IEC International Electrotechnical Commission - an inter-
national standardization organization which, among
BCS Business Criticality Scorecard
other things, developed the ISO/IEC 2700x standard
BDEW German Association of Energy and Water Industries together with ISO.
BSI Federal Office for Information Security IRT Incident Response Team
CERT Computer Emergency Response Team ISAE International Standard on Assurance Engagements
CIS Center for Internet Security ISMS Information Security Management System - Part of the
overarching management system, based on a business risk
CISO Chief Information Security Officer approach, to establish, implement, operate, monitor, review,
maintain and improve information security. The
COBIT Control Objectives for Information and Related Tech-
management system includes the organizational structure,
nology - an internationally recognized framework for IT poli- cies, planning activities, responsibilities, practices,
governance with a focus on IT processes and control processes and resources.
objectives.
ISO International Organization for Standardization - publisher of ◗ Consulted - consulted (professional expertise). A person
international standards, including the ISO/IEC 2700x whose advice should or must be sought. Also referred to
as
family.
Responsibility interpreted from a professional point of view.
ISO Information Security Officer, synonymous with ISB
◗ to be Informed - to be informed (right to information). A
person who receives information about the course or the
KCI Key Control Indicator The person receives the result of the activity or h a s the
right to receive information.
KPI Key performance indicator - a performance indicator
As a rule, only one person (role) should be accountable per
KRI Key Risk Indicator activity. However, several people can be responsible,
consulted or informed for an activity. It is also possible that
CIP Continuous improvement process one person is accountable and responsible for an activity at
MaRisk Minimum Requirements for Risk Management - an the same time.
administrative instruction on the design of risk Risk Effect of uncertainty on objectives (definition according to
management in German credit institutions from the German ISO 31000:2018)
Financial Supervisory Authority (BaFin)
RPO Recovery Point Objective
NIST National Institute of Standards and Technology
RTO Recovery Time Objective
NPS (Net Promoter Score) Indicator that measures the extent
to which consumers would recommend a product or service SaaS Software as a Service
to others.
Scope Scope
OT Operational Technology
SDLC Software Development Life Cycle
OWASP Open Web Application Security Project
SIRP Security Incident Response Process
PDCA Plan-Do-Check-Act cycle - a continuous improvement
process SLA Service Level Agreement - Agreement between customer
and service provider
QAR-IT ISACA Guide to Conducting a Quality As- surance
Review of Internal IT Auditing (QAR-IT) SMART Specific, measurable, accepted, realistic, scheduled
6 References
7 List of figures/tables
Images
Figure 1:
Integration of the ISMS into corporate management 8
Figure 2:
Building blocks of an ISMS according to ISO/IEC 27001:2022 9
Figure 3:
Risk management process according to ISO 31000 20
Figure 4:
Risk treatment options according to ISO/IEC 27005 21
Figure 5:
Structure and relationship of KPI, KRI and KCI 24
Figure 6:
Elaboration of a communication plan 28
Figure 7:
Phase model for security awareness campaigns 30
Figure 8:
IS standards overview on supplier relationships 33
Figure 9:
Structure for internal ISMS audits (audit program vs. audit activities) 35
Figure 10:
Requirements for the audit program 36
Figure 11:
Incident Response Management - Phase model based on ISO/IEC 27035-1:2023 39
Figure 12:
Scenario-based determination of the risk level. 60
Tables
Table 1:
Communication plan - internal communication 28
Table 2:
Communication plan - external communication 29
Table 3:
Effort safety analysis 61
8 Attachments
The following table shows the consistency of the measures from ISO/IEC 27001:2022 with ISO/IEC 27001:2013.
The following table shows the consistency of the measures from ISO/IEC 27001:2013 with ISO/IEC 27001:2022.
A.18 Compliance
A.18.1.1 Identification of applicable legislation and contractual requirements 5.31
A.18.1.2 Intellectual Property Rights 5.32
A.18.1.3 Protection Of Records 5.33
A.18.1.4 Privacy And Protection Of Personally Identifiable Information 5.34
A.18.1.5 Regulation Of Cryptographic Controls 5.31
A.18.2.1 Independent Review Of Information Security 5.35
A.18.2.2 Compliance With Security Policies And Standards 5.36
A.18.2.3 Technical Compliance Review 5.36, 8.8
8.2 Version comparison ISO/IEC 27001/2:2022 ISMS are relevant (section 9.3.2.
vs. ISO/IEC 27001/2:2013 "Management review inputs," (c).
Below you will find a brief description of the main changes to ◗ Continuous Improvement: Chapter 10 has been
reorganized so that the statement, suitability,
the content of ISO/IEC 27001:2022 and ISO/IEC 27002:2022 appropriateness
compared to the previous versions from 2013. and effectiveness of the ISMS on an ongoing basis,
precedes the nonconformity section, with the goal of
ISO/IEC 27001:2022 vs. ISO/IEC 27001:2013 encouraging improvement rather than corrective action.
In October 2022, the third edition of ISO/IEC 27001 was
published. Like other ISO/IEC standards that describe ◗ The new version of ISO/IEC 27001:2022 contains in
essence a complete replacement of Annex A, which is
requirements for a management system (e.g., ISO 9001, ISO reflects the controls of ISO/IEC 27002:2022. The only
14001, ISO 22301), the ISO/IEC difference between the information in the annex of
27001 follows a uniform structure, the so-called "Har- ISO/IEC 27001 and the controls from ISO/IEC 27002 lies
monized Structure" from Annex SL of the ISO/IEC in the wording of the requirements: The annex to ISO/IEC
Directives, Part 1. Since this structure has changed in 27001:2022 uses the word "shall", which means that the
2021, the main chapters of ISO/IEC 27001:2022 have been controls are mandatory, whereas ISO/IEC 27002 uses the
adapted accordingly. This has resulted in the following word "should", which means that the requirements are to
changes in the main chapters1: be understood as recommendations.
◗ The organization (Chapter 4 "Context of the organiza- ◗ The controls listed in the annex still do not claim to b e
tion") has now, in addition to defining relevant an- complete, and there may be
requirements of interested parties, it is also necessary to additional measures may be required. Companies are also
define which of these requirements are addressed within free, as before, to use the measures from other sources
the framework of the ISMS (Section 4.2 c). (e.g., NIST Cybersecurity Framework, BSI IT-
Grundschutz, ISF Standard of Good Practice, etc.) to
◗ Management of change (Chapter 6 "Planning") has mitigate their information security risks. In this case, all
been added to Section 6.2 "Information security
objectives that is required is an applicability statement that includes a
and planning to achieve them" to include the aspect that, mapping from the selected measures to the controls from
in addition to the requirements for defining and the Annex of ISO/IEC 27001:2022, as well as the required
implementing information security objectives, these must rationale for the selection. This confirms that no
also be monitored. The chapter was further expanded with requirements have been neglected that are actually
section 6.3 "Planning of changes" for the implementation applicable and necessary to mitigate existing risks (cf.
of planned changes to the ISMS. The circumstances ISO/IEC 27001:2022, clause 6.1.3.
requiring a change to the ISMS may be planned or "Information security risk treatment," (b) and Note 2 of
unplanned (as described in Section 6.1 "Actions to address Section 6.1.3; (c) has been slightly modified to further
risks and opportunities"), but the changes themselves clarify this aspect).
must be planned.
ISO/IEC 27002:2022 vs. ISO/IEC 27002:2013
◗ In chapter 8 "Operation", the new version adds that
explicit criteria for the implementation of the processes In the new version of ISO/IEC 27002:2022, t h e change in
from Chapter 6 "Planning" must be established and the title from "Information technology - Security techniques -
implementation must be carried out in accordance with Code of practice for information security controls" to
these criteria. "Information security, cybersecurity and privacy protection -
Information security controls" is already noticeable. The term
◗ In Chapter 9 "Performance evaluation", sections 9.2 "Code of Practice" was removed to better reflect its purpose
"Internal Audit" and 9.3 "Management Re-
view" are divided into further subsections, but their as a tone-setting reference for information security measures.
contents remain identical. In addition to the word
"Information Security", the terms "Cyber Securi- ty" and
◗ Section 9.3 "Management Review" has been divided "Privacy Protection" are emphasized. As a result, the new
into three subsections. Here it was added that ma-
version explicitly addresses cyber security measures as a
management reviews, the changes in the needs and
subset of information security measures and privacy
expectations of interested parties that are necessary for the
protection measures.
1 In the following, the term "chapter" is also used for ISO/IEC 27001:2013.
The content of ISO/IEC 27002:2013 has been significantly ◗ "Control types (possible values: preventive, detective,
expanded: The 2013 standard consists of a total of 80 pages corrective),
(plus 10 pages of table of contents and foreword), whereas the
◗ "Information security properties" (possible values: confi-
updated version comprises 131 pages (plus 10 pages of table dentiality, integrity, availability),
of contents and foreword as well as 17 pages of annex). The
2013 standard contains references to 27 other ISO standards, ◗ "Cybersecurity concepts" (possible values: identify, pro-
tect, detect, respond, recover),
while the new version contains more than twice as many. In
total, 56 other sources are referenced. ◗ "Operational capabilities (possible values: e.g. physical
security, governance) and
A chapter/glossary for terms, definitions and abbreviations
◗ "Security domains" (possible values: e.g. protection, de-
has also been added, instead of an exclusive reference to fence).
ISO/IEC 27000, as was the case in the old version.
With the help of these new attributes, the focus on certain
The structure of the new ISO/IEC 27002:2022 has been aspects can be set much better, e.g. different views can be
completely revised. As a thematic structure, the new version created for different target groups, requirements can be
now contains 4 topics instead of 14 chapters/domains categorized and the measures can be filtered easily.
("Security Control Clauses") (see below in more detail).
Directly downstream of these are the 93 measures The restructuring at the measure level has the following effect:
("Controls"). Thus, the original integration into "Control In the new version, 11 new controls have been added, one
objectives" is omitted for the time being. In the future, this control has been split, 57 controls h a v e been merged into
will be presented as a purpose for each measure. All in all, 24 controls, and 58 controls have been reworded.
measures in the new version comprise the following contents:
The new version thus contains 93 measures/controls in 4
◗ a short description of the measure ("Control title"), topics compared to 114 measures/controls in 14 Security
◗ additional attributes ("Attribute table"), Control Clauses in the old version.
◗ a description of the control,
New measures
◗ a description of the purpose of the control ("Purpose"),
As mentioned above, there are 11 new measures in the new
◗ an implementation guide for the control ("Gui- dance") as
well as standard:
◗ explanatory text or references to other related ◗ "Threat intelligence" (Section 5.7) is definitely new in this
documents ("Other Information"). form. This involves, among other things, the collection
and
As mentioned above, measures in the new version are
Evaluation of information on the specific threat
divided into 4 topics:
environment of the organization in order to be able to take
appropriate reactive measures: A distinction is made
◗ "People controls," chapter 6, for measures that focus o n between strategic, tactical and operational threat
people, such as "screening"
or "Remote working"; intelligence.
◗ "Physical controls", Chapter 7, when physical items are ◗ "Information security for use of cloud services" (sec.
involved, such as access control; 5.23), this measure was not available in the 2013 version.
implicitly anchored in supplier relationships. The measure
◗ "Technological controls," chapter 8, when technology is covers the information security of cloud services from the
involved; and customer's point of view. For example, a guideline on
◗ all other measures are assigned to "Organizational cloud computing in the company is required.
controls", chapter 5.
◗ "ICT readiness for business continuity" (section 5.30); ICT
here stands for "Information and Communications
A helpful addition in the new version are the at- tributes Technologies" and the measure goes beyond the old
("Attribute table"), which can be assigned to five different information security aspects of business continuity
categories: management (old version, Clause 17): for example, the
performance of business impact analyses (BIA) is
described as a basis.
◗ "Data masking" (Section 8.11) deals not only with the ◗ "User endpoint devices" (Section 8.1) was also created
topic of masking of (person-related) from 2 original Domains/Security Control Clauses to-.
The study also discusses the properties of merged. On the one hand, the content of the measure
pseudonymization and anonymization of data, and "Mobile device policy" (old version, Security Control
addresses legal aspects. Clause 6.2.1), and on the other hand, the content of
"Unattended user equipment" (old version, Security
◗ "Data leakage prevention" (Section 8.12) expands on the Control Clause 11.2.8) have been incorporated. This
original requirement for information classifica-
and offers a wide range of measures to protect against brings together all aspects that need to be taken into
data leakage, including the aspects of monitoring and its account in the protection of end user devices.
technical implementation. Evaluation
The new version represents a significant further development
The other new measures are: and an update with regard to recognized information security
measures, as promised by the standard in its introduction.
◗ "Physical security monitoring" (section 7.4) Important best practices and trends in the information security
◗ "Configuration management" (section 8.9) industry have been taken into account in the new version,
◗ "Information deletion" (section 8.10) although no massive thematic expansions have been made
◗ "Monitoring activities" (Section 8.16) with 11 new measures.
◗ "Web filtering" (Section 8.23)
The division into organizational, personal, physical and
◗ "Secure coding" (section 8.28)
technical measures offers a significant improvement in the
Split measure structure from the point of view of the authors. Compared to
the 2013 version, extensive additional information is listed
One measure has been split into two separate measures in the and more detailed help is provided. Texts and definitions
new standard: have been sharpened and the attributes provide consistency in
interpretation. The attributes of the "Cybersecurity concepts"
The measure "Technical compliance review" (old version, category, for example, correspond to the functions of the
Security Control Clause 18.2.3) is divided into two parts: NIST Cybersecurity Frame- work, thus creating a direct link
firstly, the organizational part "Compliance with policies and to another management framework.
standards for information security" (Section 5.36), with
explanations of how to check compliance with the guidelines, With these and other formal additions, a variety of views of
and secondly, the technical part "Management of technical different sub-aspects can be created. These options and the
vulnerabilities" (Section 8.8), which has been greatly higher level of detail can simplify the creation of company-
expanded and is described in detail. For example, the specific guidelines.
identification and evaluation of technical vulnerabilities is
discussed in detail, and the performance of pentests is Outlook
explicitly recommended. The update of other existing standards and stan- dards of the
Measures summarized ISO/IEC 27000 series, which have adopted the structure of
ISO/ IEC 27002:2013, will follow and is expected to be
A total of 57 measures were combined into 24 measures, completed by 2024.
which represents a significant compression. At this point, we
will limit ourselves to two selected examples: Organizations already have the option of using the new
measures from Annex A as measures. With the mapping
◗ "Information security in project management" (Section tables available, declarations of applicability can also be
5.8) was developed from 2 original domains/security con-.
created for certified companies, which still correspond to the
trol Clauses have been merged. On the one hand, the
previous 2013 version if required. With the publication of the
content of the measure "Information security in project
ISO/IEC 27001:2022 version, this step should only be
management" (old version, Security Control Clause
necessary for obtaining certification if certification is still to
6.1.5), and on the other hand, the content of "Information
be carried out explicitly according to the 2013 version. This
security requirements analysis and specification" (old
could be necessary, for example, if the certification body has
version, Security Control Clause 14.1.1) have been
not yet been accredited for certification according to the 2022
included.
version.
has. The document "Transition Requirements for ISO/IEC These are used, for example, to document a scenario-based
27001:2022" of the International Accreditation Forum2 regulates classification of the basic risk level of the process or the
the transition from version 2013 to version 2022. Existing applications used in it.
measures of a certified ISMS can thus be adapted to the new
ISO/IEC 27002:2022 and thus to the new annex within the For end-to-end protection, it is useful that the organization
framework of a three-year transition period (by 31.10.2025 at assesses the criticality of the process and the need for
the latest). Due to the provided mappings, the effort for such protection of the information processed in it on the basis of a
an adaptation should essentially be able to focus on the new policy for at least each main process and for each application
measures as well as on improvements of existing measures of operated for the process by the respective process owner in
the standard. such a scorecard.
Certification bodies must begin certifying to the new In addition, it is important that an organization's project
standard no later than Oct. 31, 2023. methodology ensures that such a scorecard is created for new
projects (analogous to the data protection and/or works
8.3 Holistic protection of the value council notification) so that information security requirements
chain can be coordinated at an early stage.
Scenario-based prioritization of the business processes to be
One of the central aspects of introducing or adapting the
protected
ISMS/cyber security strategy should be the introduction of a
process for securing the value chain of the organization to be The scorecard for business criticality is used to perform a
protected by the ISMS. This measure can be used to lay the high-level identification of the information security risks
foundation for end-to-end security management, which resulting from the process or the applications in order to
ensures basic protection throughout the entire company and determine the effort required to protect the asset under
determines further activities on the basis of risk. consideration. Here, identification based on organization-
specific fundamental questions and scenarios in the context of
In practice, a "Business Criticality Scorecard (BCS)" has information security objectives, which are illustrated below as
become established for this purpose, examples (see Figure 12), is a suitable approach.
In addition to the criticality and risk assessment, other facts must be conducted if the initial assessment of the cri- ticality
can also be collected, e.g., on the RTO/RPO or on processes identifies a corresponding need, but the methodology
relevant to operations. A scorecard must include at least a nevertheless ensures that each process is subjected to at least
description of the main process under consideration or the a high-level analysis and that an appropriate basic assurance
applications operated for it, as well as a unique identifier. is ensured, which automatically leads to a systematically
ensured "weakest link" assurance.
Based on the information collected, e.g., maturity level
implementation of the baseline requirements and Another advantage of a scorecard solution is that it can also
documentation requirements, and in particular based on the be used to query other aspects - for the processes to be
criticality and risk assessment collected, the information controlled operationally - e.g., compliance requirements,
security officer (ISO) in BCS decides what effort needs to checks for documented operating processes, responsibilities
be invested in further security analysis (of the process) in for patch and vulnerability management, log evaluation, data
order to achieve an adequate security level for the backup, authorization concept and others. This can include
organization. aspects outside of information security that are necessary
from other management systems, e.g., from data protection,
For less critical systems, for example, a standard safeguard compliance or quality management.
to be defined can be applied, and for processes with higher
risk potential, specific safety concepts or technical checks,
such as
z. e.g., the performance of a penetration test. The possible
decision stages could be defined as exemplified in Table 3.
8.4 Internal ISMS audits - mapping to ISO/IEC 19011 and ISO/IEC 27007
Requirements for internal ISMS audits from ISO/IEC 27001:2022 vs. ISO/IEC 19011:2018 & ISO/IEC 27007:2020
Determination of the audit program 9.2 c A.5.4 Establishing the audit program
Implementation of the audit program 9.2 c A.5.5 Implementing the audit program
Monitoring of the audit program 9.2 c A.5.6 Monitoring the audit program
Review and improvement of the audit 9.2 c A.5.7 Reviewing and Improving the audit program
program
Documentation and evidence 9.2 g A.5.5.7 Managing and maintaining audit program records
Define audit criteria and scope per 9.2 d A.5.5.2 Defining the objectives, scope and criteria for an
audit individual audit
Information collection
Results Conclusions
and verification
ISO/IEC 27007:2020, 6.4.8 ISO/IEC 27007:2020, 6.4.9
ISO/IEC 27007:2020, 6.4.7
To support you, we offer a thematically broad certificate program based on the COBIT 2019
framework.
You can find our complete range of courses on our website www.isaca.de/seminare
view. In addition to classroom seminars, we also offer all courses as online seminars.
For all courses you will receive a recognized professional development certificate (so-called CPE
hours).
E- L
EAST NA
UFRIC IO
FRITZI ESS
CE ROF
Cyber IT IT
Security Governance Compliance
VE ER
Manager Manager
LE AG
Expert
L
N
MA
Information
Security IT Governance
ER
Practitioner IT IT Risk
L N
& Compliance
VE TIO
Assurance Practitioner
Practitioner
LE CTI
Cyber Practitioner
A
Security
PR
Practitioner / OT
IT Basic
LE ND
U
FO