The new ISO/IEC 27001:2022 has been published in Oct 2022. Some of the main new updates of ISO/IEC 27001:2022 include a major change of Annex A, minor updates of the clauses, and a change in the title of the standard.
The latest version of ISO/IEC 27002 has been published at the beginning of 2022, and its latest changes have also impacted ISO/IEC 27001.
Summary of new changes of ISO/IEC 27001:2022
As the world is facing new evolving security challenges, the internationally recognized standard ISO/IEC 27001, which aims to protect the confidentiality, availability, and integrity of organizations’ information assets has been updated and its new more relevant, and up-to-date edition has been published.
Different from ISO/IEC 27001:2013, the new version’s complete title is ISO/IEC 27001:2022 Information Security, Cybersecurity and Privacy Protection.
The part that has gone under the most significant changes is Annex A of ISO/IEC 27001 which is aligned with the ISO/IEC 27002:2022 updates, published earlier this year.
As for other parts, clauses 4 to 10 have undergone several minor changes, especially in clauses 4.2, 6.2, 6.3, and 8.1 where additional new content has been added. Other updates include minor changes in the terminology and restructuring of sentences and clauses. However, the title and order of these clauses remain the same:
Clause 4 Context of the organization
Clause 5 Leadership
Clause 6 Planning
Clause 7 Support
Clause 8 Operation
Clause 9 Performance evaluation
Clause 10 Improvement
Summary of main control changes in Annex A of ISO/IEC 27001:2022?
Annex A of ISO/IEC 27001:2022 contains changes in both, the number of controls, and their listing in groups. The title of this Annex has also changed from Reference control objectives and controls to Information security controls reference. Therefore, the reference objectives of each control group that were present in the previous version of the standard, now have been removed.
The number of Annex A controls has decreased from 114 to 93. The decrease in the number of controls has mostly come from merging many of them. 35 controls have remained the same, 23 controls were renamed, 57 controls were merged into 24 controls, and one control has been divided into two. The 93 controls have been restructured to four control groups or sections.
The new control groups of ISO/IEC 27001:2022 are:
- A.5 Organizational controls – contains 37 controls
- A.6 People controls – contains 8 controls
- A.7 Physical controls – contains 14 controls
- A.8 Technological controls – contains 34 controls
ISO/IEC 27001:2022 has also added the below-mentioned 11 new controls to its Annex A:
- Threat intelligence
- Information security for the use of cloud services
- ICT readiness for business continuity
- Physical security monitoring
- Configuration management
- Information deletion
- Data masking
- Data leakage prevention
- Monitoring activities
- Web filtering
- Secure coding
ISO/IEC 27001 and ISO/IEC 27002
ISO/IEC 27001 and ISO/IEC 27002 are both related to IT security and information security management system, hence they seem to be quite similar. However, they are not the same.
ISO/IEC 27001 is an information security management system standard that provides a list of compliance requirements against which organizations and professionals can be certified. It helps organizations establish, implement, maintain, and improve an information security management system (ISMS).
This standard exists as of the early ‘90s, first under the name of ISO/IEC 17799. In 2005, the standard was revised and published with a new name ISO/IEC 27001. To keep up with the developments in technology and be more relevant to the latest security threats, ISO/IEC 27001 was revised in 2013 and a new version was published. In 2019, the standard experienced another revision, but the same version remained current, until now.
Another standard, also part of the ISO/IEC 27000 ISMS family of standards, closely related to ISO/IEC 27001, is ISO/IEC 27002. This standard is used to tailor information security management systems to the specific context of organizations by providing guidelines for selecting and implementing proper information security controls listed in Annex A of ISO/IEC 27001. Furthermore, ISO/IEC 27002 offers much more detailed and thorough information regarding these controls.
Considering that ISO/IEC 27002 is a supporting standard containing guidance and not requirements, organizations cannot be certified against it, only professionals can.
PECB Courses available for you from 1st Career USA, on ISO 27001 can be founding by visiting https://www.1stcareer.org/product-category/iso-27001/