Important changes to ISO 27001 in 2022

Restructuring of controls

The number of controls has reduced from 114 to 93. They are now split into four themed categories, instead of the previous 14. They are:

• People (8 controls)
• Organisational (37 controls)
• Technological (34 controls)
• Physical (14 controls)

The reason for reducing the number of categories is to simplify the implementation of your Information Security Management System (ISMS) and to add clarity to the process. For example, businesses will have different people that are responsible for implementing different sets of controls. Reducing the number of controls, and introducing the four groups to which they belong, will make life easier for the implementation team to understand who inside the organisation is responsible for each set of controls. Though it may seem at first like a minor administrative change, it can have real impacts on the way the standard is implemented.

What about changes to the clauses?

In broad strokes, ISO 27001:2022 is the same standard as before, with the same aims. However, there have been some minor editorial changes to clauses 4-10, with the revisions designed to offer greater clarity to businesses. This does mean that you do need to review both the application of the new controls in Annex A as well as the clauses, to make sure you have addressed everything. Some particular areas to look at include:

• Clause 4.2 – Understanding the needs and expectations of interested parties
• Clause 5.3 – Organisational roles, responsibilities and authorities
• Clause 6.1.3 – Information security risk treatment
• Clause 6.2 – Information security objectives and planning to achieve them
• Clause 6.3 – Planning of changes
• Clause 7.4 – Communication
• Clause 8.1 – Operational planning and control
• Clause 9.3 – Management review

What do the new changes to ISO 27001 require you to do?

I am already certified, so how will the new changes affect my business?

If your organisation is already certified to ISO 27001:2013, your certification will remain valid, and organisations have up to 3 years to transition to the new standard. However, it is worth checking with your certification body, as some may stop certifying to the 2013 version of the standard earlier than this.

Certification bodies themselves will naturally go through a transitional period to ensure a certification scheme exists that aligns with the new changes, while also getting auditors up to scratch with the revised scheme. The formal transition requirements are defined here, and they describe the steps required to transition to ISO 27001:2022.

What happens if I am in the middle of an implementation?

There’s no need to panic if you’re mid-way through implementation, as you can still certify to the 2013 version until 2025 assuming your chosen certification body allows this. Depending on the timescale of your project, it will be more efficient to certify to ISO 27001:2013 and update to the newer version at a later date. Alternatively, if you are only at the beginning, you could use the new Annex A controls from 27001:2022 and compare these with the 2013 version of the controls in the Statement of Applicability.

What happens if I am starting an implementation?

This will depend on the length of your project. If you believe you can implement an ISMS within 3-6 months, it is likely that you will end up certifying to the old 2013 standard as the certification bodies may not be ready to certify to the new version of the standard. However, as mentioned above, you could implement the new 2022 Annex A controls and compare these to the 2013 version of the controls in your Statement of Applicability, so that you are part of the way to transitioning to the new standard. If implementation is likely to take longer, it’d be wise to prepare for ISO 27001:2022. Chat with your consultant to gauge the best option for certification.

Key takeaways

• ISO 27001 has been updated and its changes address global cyber security challenges and evolving business environments
• Annex A has been overhauled to include 11 new controls to reflect changes in technology and risks that were not previously covered
• The controls have been restructured to make it easier and quicker for businesses to implement
• Businesses have up to 3 years to transition to the new standard
• The changes to ISO 27001 are not vast, however it will take time to understand the structure and new controls without the additional burden of implementing or running your ISMS