ISO/IEC 27001:2022 Published on 25 October
On 25 October 2022, the International Organization for Standardization published the latest version of ISO 27001 and updated its title to ‘Information security, cybersecurity and privacy protection — Information security management systems — Requirements’. In line with its title, this latest version of ISO 27001 reflects a broader context and that preventing, detecting and responding to cyberattacks is now considered, as well as protecting information and data.
The 2022 version of the Standard provides the updated requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS) within the context of your organisation.
What are the key changes?
The major change to the Standard has been the incorporation of the control set from ISO 27002:2022 into Annex A of ISO 27001:2022. Naturally, threats change over time and the new Annex A controls reflect some of the threats that have emerged since the 2013 version was published, e.g., the increasing range of cyber-related threats and moves towards home and remote working.
There have also been a number of changes to the management system clauses, with the goal of making some of the requirements more explicit and improving the alignment (structure, terms and definitions) with other Annex SL standards, such as ISO 9001 and ISO 22301.
How URM can help
URM is ideally placed to help organisations certify against the updated Standard. Should you already be certified to ISO 27001:2013, we can provide you with the following practical support to help you quickly and seamlessly transition to the 2022 version of the Standard:
- Consultancy services where we will work with you in a bespoke manner to prepare for, and successfully transition to, the 2022 version of the Standard
- 1-day ISO 27002:2022 Control Migration and our 2-day ISO 27001:2022 Transition training courses
- Automated risk assessment tool Abriska, which has been updated with the new control set (see webinar 2 November)
Not certified?
If you are not certified, now has never been a better time to develop an information security management system and achieve certification. If you would like to understand more about the benefits and what’s involved in implementing ISO 27001, please register your interest here and we will be in touch.
