ISO/IEC 27001:2022 Has Been Published: What Now?

Today, after much anticipation, ISO announced that ISO/IEC 27001:2022 has officially been published. Ever since ISO/IEC 27002:2022 was published in February of this year, the industry has waited for this—that includes Schellman. 

Now that it’s here, Schellman’s ISO practice co-director and principal Danny Manimbo had this to say about the impact and importance of this update to the standard: 

“For a standard that is based around managing information security risk, having a period of almost 10 years between updates makes this one particularly welcome. Given the ever-evolving security and technology landscape we live in, you certainly don’t want a standard that has the global reach and prevalence of an ISO 27001 to become antiquated and outdated.” 

Danny went on to provide perspective on the changes themselves: 

“What ISO did well with this standard update is that the whole idea was to make the controls more modernized, simplified, and versatile, to promote ease of use and understanding and it also removed references to things like obsolete technologies. Taking into consideration these changes, we believe that, if your ISMS has been staying up-to-date and current with technology and regulatory trends, it will be well-positioned to absorb this standard update.”

But the fact remains that the big question has now shifted from “when” to “what happens next?” Now that the first revision to the ISO 27001 standard since 2013 is here, where do organizations go from here? 

In this article, we’ll help point you in the right direction as things begin to move forward. 

What is ISO 27001?

First, a little groundwork for those that may be unfamiliar with this standard. (If that’s not you, feel free to skip ahead to the next section.) 

ISO 27001 provides the requirements for establishing, implementing, maintaining, and continually improving an information security management system, which is commonly referred to as an “ISMS.” 

Because it does require considerable effort, the adoption of an ISMS must be a strategic decision for an organization. Once you do decide to implement an ISMS, you should proceed with considerations of the following: 

• Your particular needs and objectives,
• Security requirements,
• The organizational processes used, and
• The size and structure of your organization—all of which will change over time. 

Your ISMS becomes part of and is integrated with your processes and overall management structure—because the ISO 27001 standard requires you to continuously improve your ISMS, information security becomes a primary factor in the further design of processes, information systems, and controls. 

Despite the requisite heavier lift in preparation and integration, establishing and maintaining an ISMS can aid you in preserving the confidentiality, integrity, and availability of information in your charge through its required risk management process. Certifying your ISMS against the ISO 27001 standard and confirming such a holistic approach to information security can reassure your interested parties that your risks are adequately managed. 

The New ISO/IEC 27001:2022 - 4 Things You Need to Know

But to do that, you and your ISMS must meet the requirements for ISO 27001 and become certified. With the newly published update, how will you do that? 

Here’s what you need to know: 

1. ISO/IEC 27001:2022 Timeline

• Organizations that are currently certified to ISO/IEC 27001:2013 will have three years to transition to ISO/IEC 27001:2022. 

2. ISO/IEC 27001:2022 Transition Requirements for Organizations

• The transition requirements are formally defined within International Accreditation Form (IAF) Mandatory Document (MD) 26:2022 (IAF MD 26).
• They describe the necessary steps to transition to and/or become certified against the ISO/IEC 27001:2022 standard for both organizations that are currently certified to ISO/IEC 27001:2013 as well as those considering certification in the future.

3. ISO/IEC 27001:2022 Transition Requirements for Accreditation Bodies and Certification Bodies

• The document also contains the transition process requirements for accreditation bodies (ABs) and their accredited certification bodies (CBs) which will allow CBs to have their accreditations updated to include the 2022 version of the ISO 27001 standard.
• This is required before a CB can perform any certification audits against the new version of the ISO 27001 standard. 

For additional information on the transition requirements, please reference our recent, more in-depth blog. 

4. Updated Control Set for ISO/IEC 27001:2022

• This is the main change introduced in the update—the previous control set within ISO 27001 (referred to as “Annex A”) was replaced with the newly introduced control set from ISO/IEC 27002:2022.
• This new set consolidates the controls from 14 control domains in A.5-A.18 to four control categories (or themes).
  • Since the ISO/IEC 27002:2022 control set was published earlier this year, along with mappings, tools, and insights within the standard to facilitate the selection and implementation process of the new controls, organizations have had the majority of the year to assess what is the most material change within the 2022 version of ISO 27002.
• There were minor changes to Clause 6 of the ISMS framework introduced as well, which were mostly wording changes to remove ambiguity and outdated language as well as the introduction of clause 6.3 (planning for changes). 

Next Steps for ISO/IEC 27001:2022

This is the first big change for this ISO 27001 standard in nearly ten years—the standard’s prominence has only grown during the time since then, and with this big shift, organizations will be looking to discern how they need to proceed in order to maintain or obtain certification. 

This article provides a good jumping-off point, but as more details drop and we get more familiar with the new standard, keep an eye out for more, in-depth perspective from us that will help deconstruct important changes and ease your upcoming transition. 

In the meantime, we would encourage you to reach out to us with any questions you might have regarding your current or possible future ISO 27001 certification. Our team has been focused on this transition for months, and we are ready to address any concerns you find that you have.