ISO 27001 2013 vs 2022

ISO 27001 2013 vs 2022 explained simply. The key changes and how to transition to the new version.

The world of information security standards can sometimes feel like it’s constantly shifting. Recently, there have been updates to both ISO 27001, the standard for information security management systems (ISMS), and ISO 27002, the guidance document that supports it. If you’re involved in managing or implementing ISO 27001, you might be wondering what these changes mean for you. Let’s break it down.

ISO 27001: Minimal Changes to the Management System

The good news is that the 2022 update to ISO 27001 brought very little change to the core management system itself. If you’re already familiar with the standard, you can breathe a sigh of relief. The updates were primarily focused on clarification:

• Wording Adjustments: The standard now refers to itself as a “document” rather than a “standard” in certain places. Minor changes like removing extra spaces were also implemented. These are superficial changes that don’t impact the fundamental requirements.
• Introduction of a Planning Clause: A new clause emphasising the importance of planning for the ISMS was added. However, for those already following established methodologies, this isn’t groundbreaking. Effectively managing an ISMS inherently involves planning for updates, reviews, audits, and other key activities. If you’ve been using a structured approach, you’ve likely been doing this all along.
• Clarifications on Management Review and Internal Audit: The update provided more explicit details regarding the inputs and outputs of management reviews and internal audits. Again, this is more about formalising existing good practices.

Organizations that have been conducting thorough management reviews with documented agendas and minutes, and structured internal audits with defined inputs and outputs, won’t find this to be a significant shift.

The Takeaway for ISO 27001: Don’t panic! The changes to the management system are minimal and largely codify what many organizations were already doing. Transitioning to the 2022 version should be straightforward, especially if you have well-documented processes and a mature ISMS.

ISO 27002: A More Significant Update to the Guidance

While ISO 27001 saw minor tweaks, ISO 27002, which provides guidance on implementing the controls listed in Annex A of ISO 27001, underwent a more substantial update. This is where most of the changes you’ll need to consider reside.

• Consolidation and Restructuring of Controls: The number of controls in Annex A was reduced from 114 to 93. This was achieved through consolidation, removal of some controls, and restructuring. The controls are now organised into simpler domains.
• Introduction of New Controls: Eleven new controls were added, addressing areas like threat intelligence, information security during development, ICT readiness for business continuity, and physical security monitoring.
• Focus on Guidance: The update aims to provide more comprehensive and up-to-date guidance on implementing these controls.

Digging Deeper into the New Controls (and Some Questionable Aspects):

While most of the new controls are sensible additions reflecting the evolving threat landscape, some have raised eyebrows:

• Cloud Services Control: A new control specifically addressing cloud security was introduced. While cloud security is crucial, the guidance associated with this control includes recommendations, such as having an account manager with the cloud provider and conducting audits, which may not be feasible or necessary for all organizations, especially when dealing with major providers like Microsoft and Amazon. It’s important to view this guidance critically and apply it proportionate to your risk and business needs. In many ways, managing cloud providers effectively aligns with existing third-party supplier management practices.
• Data Leakage Prevention: This control, while important, overlaps with existing data protection regulations like GDPR, which already mandate measures like data masking and anonymization.
• Business Continuity and BIA: Similarly, the update includes elements related to business continuity and business impact assessments (BIA), areas already well-covered by ISO 22301. This feels like a bit of “land grabbing” from other established standards.

The Takeaway for ISO 27002: The update to ISO 27002 requires more attention. You’ll need to review the new set of 93 controls and assess which ones are relevant to your organisation’s risks and business needs. Treat these new controls like any other potential control:

1. Identify the Risk: Do you have a risk that the new control aims to mitigate?
2. Evaluate the Control: Does the control effectively mitigate that risk?
3. Implement Proportionately: If you decide to implement the control, tailor the implementation to your specific risk profile, budget, and business requirements. Don’t blindly follow the guidance if it doesn’t make sense for your organization.

Transitioning Smoothly

When transitioning to the updated standards, remember these key points:

• Focus on the Management System Clarifications: Ensure your documentation and processes align with the minor clarifications in ISO 27001.
• Assess the New Controls in ISO 27002: Don’t feel obligated to implement every single new control. Conduct a risk assessment to determine which controls are necessary and appropriate for your organization.
• Treat Guidance as Guidance: The guidance in ISO 27002 is just that – guidance. Adapt it to your specific context and don’t be afraid to deviate if necessary.
• Leverage Existing Frameworks: If you’re already using a robust ISMS framework, the transition should be manageable. Many of the concepts and practices remain the same.

In Conclusion

The updates to ISO 27001 and ISO 27002, while requiring some attention, shouldn’t be a cause for significant concern. The changes to ISO 27001 are minimal, and while ISO 27002 has been updated more substantially, a thoughtful and risk-based approach to assessing and implementing the new controls will ensure a smooth transition. Remember to document your decisions and maintain a focus on continuous improvement to keep your information security management system effective and aligned with your business needs.