ISO 27001:2022 Information security, cybersecurity, and privacy protection – By Magnus Management Consulting LLC

ISO/IEC 27001:2022 Information security, cybersecurity, and privacy protection — Information security management systems — Requirements

This document specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system within the context of the organization. This document also includes requirements for assessing and treating information security risks tailored to the organization’s needs. The requirements set out in this document are generic and are intended to be applicable to all organizations, regardless of type, size, or nature.

After nine years, ISO 27001, the world’s leading information security standard, has been updated – on October 25, 2022, the new ISO 27001:2022 was published. Even though this revision brings only moderate changes, it is important to study them closely – let’s go through all the changes and see how this 2022 revision compares to the old 2013 revision of ISO 27001.

Main changes in the ISO 27001:2022 revision:

The main part of ISO 27001, i.e., clauses 4 to 10, has changed only slightly.
The changes in Annex A security controls are moderate.
The number of controls has decreased from 114 to 93.
The controls are placed into 4 sections, instead of the previous 14.
There are 11 new controls, while none of the controls were deleted, and many controls were merged.

Comparison

Overall, when compared to the 2013 revision, the changes in the ISO 27001:2022 revision are small to moderate. The main part of the standard remains with 11 clauses, and the changes in this part of the standard are small (see below).

At first glance, Annex A has changed a lot – the number of controls has dropped from 114 to 93 and is organized into only four sections versus the 14 sections in the 2013 revision. However, after a closer look, it becomes obvious that the changes in Annex A are only moderate – see the explanation below.

Changes in the management system

The text of the mandatory clauses 4 through 10 has changed only slightly, mainly to align with ISO 9001, ISO 14001, and other ISO management standards, and with Annex SL.

Here’s a brief overview of the changes in ISO 27001:2022:

In clause 4.2 (Understanding the needs and expectations of interested parties), item (c) was added requiring an analysis of which of the interested party requirements must be addressed through the ISMS.
In clause 4.4 (Information security management system), a phrase was added requiring planning for processes and their interactions as part of the ISMS.
In clause 5.3 (Organizational roles, responsibilities, and authorities), a phrase was added to clarify that communication of roles is done internally within the organization.
In clause 6.2 (Information security objectives and planning to achieve them), item (d) was added that requires objectives to be monitored.
Clause 6.3 (Planning of changes) was added, requiring that any change in the ISMS needs to be made in a planned manner.
In clause 7.4 (Communication), item (e) was deleted, which required setting up processes for communication.
In clause 8.1 (Operational planning and control), new requirements were added for establishing security processes and implementing processes according to those criteria. In the same clause, the requirement to implement plans for achieving objectives was deleted.
In clause 9.3 (Management review), the new item 9.3.2 c) was added that clarifies that inputs from interested parties need to be about their needs and expectations, and relevant to the ISMS.
In clause 10 (Improvement), the subclauses have changed places, so the first one is Continual improvement (10.1), and the second one is Nonconformity and corrective action (10.2), while the text of those clauses has not changed.

Overview of new security controls in ISO 27002:2022.

11 new controls introduced in the ISO 27001:2022 revision:

A.5.7 Threat intelligence
A.5.23 Information security for use of cloud services
A.5.30 ICT readiness for business continuity
A.7.4 Physical security monitoring
A.8.9 Configuration management
A.8.10 Information deletion
A.8.11 Data masking
A.8.12 Data leakage prevention
A.8.16 Monitoring activities
A.8.23 Web filtering
A.8.28 Secure coding

Resources:

1.ISO – ISO/IEC 27001:2022 – Information security, cybersecurity and privacy protection — Information security management systems — Requirements

iso certificate business consultancy iso 9001 certification iso 27001 certification iso 14001 certification iso 27001 2022 iso 9001 version 2015 business consulting services iso 9001 quality management system iso 45001 certification iso 14001 environmental management system iso 13485 certification iso 9001 requirements iso 9000 certification cyber security information iso 2700 iso 27001 lead auditor iso 27001 certification cost iso 26001 iso 22000 certification restaurant consultant starting a consulting business iso 9001 certification cost data security in cloud computing information security courses qms iso 9001 certified management consultant 45001 iso 2018 17025 iso iso certified company iso iec 27002 2022 iso 27001 lead implementer information security certifications franchise consultant iso 901 top cyber security companies food safety and inspection service independent business consultant cyber security consulting iso 22301 certification iso iec 17065 iso certification list iso 17025 certification ohsas 18001 certification investment consulting iso consultant iso 17025 requirements iso certification consultants iso auditor certification infosecurity europe risk management consultant iso 9001 2005 cybersecurity best practices 27001 2013 iso 45001 requirements nist 800 115 iso 20000 certification food safety certificate online cloud data security iso 9001 2015 certification iso 27001 latest version 13485 certification haccp certification online information security services iso 9004 2018 iatf 16949 certification information security risk ohsas certification iso environmental 9001 iso 2008 lead auditor iso 9001 top cybersecurity certifications iso quality management qms certificate 17025 2017 iso 22301 business continuity management bsi iso 27001 iso certificate registration it business consultant it consultant company iso lead auditor business strategy consulting iso lead auditor certification iso 27001 lead auditor certification iso 90012015 14001 certification iso certification requirements iso 27001 clauses iso 45001 and iso 14001 international business consultant cyber security companies near me startup consulting firms iso 9001 iso 14001 iso security standards pecb iso 27001 infosec certification crisc certification cost iso 14000 certification bsi iso 9001 iso 9001 consultant cyber security checklist iso consulting services franchise business consultant iso 26000 certification pharma consulting companies 27001 iso 2022 tuv iso certification 22000 iso iso certification for individuals lead implementer iso 9001 2015 quality management system online cyber security training iso 27001 certification for individuals devops consulting companies iso 27001 implementation iso9001 and iso14001 the franchise consulting company iso 9001 2015 qms 22000 iso 2018 sgs iso certification is027001 iso 27001 information security quality management system certification iso 22000 standards starting your own consulting business business management consulting services iso 27001 certification process qms standards iso quality certification integrated management system iso 9001 iso 14001 iso 45001 sap consulting companies crisc training data security plus iso 19650 certification iso 9001 quality management advisera iso 27001 iso 27001 cost it consultant services iso iec 27001 certification computer security certifications project management consulting services iso 27001 lead auditor certification cost business continuity consulting iso iec 27001 2005 iso 9001 cost food safe level 2 cism certificate iso 45001 certification cost iso 27002 certification iso 45001 lead auditor iso 9001 certification requirements iso 9001 lead auditor certification lead auditor iso 45001 consultant project manager iso 50001 energy management iso 27001 auditor certification iso90012015 marketing consultant services iso 37001 anti bribery management systems iso 9002 standard iso internal auditor certification iso 20007 iso 27001 asset management intertek iso certification iso 14001 and 45001 iso 140001 2015 bsi iso 27001 lead auditor iso 27001 information security management system iso lab certification food quality management system iso 55000 certification iso 19001 certification iso certification cost for small business iso 14001 2016 iso 22301 business continuity iso 9001 2019 iso iec 27001 lead auditor canadian food safety iso 37301 certification iso lead implementer qms implementation business planning consultant iso 90001 certification food safe online iso 9001 to 2015 iso environmental certification iso 27001 for dummies 17065 iso iso certificate price iso 20121 certification certified lead auditor 9001 2015 iso iso 9001 2015 certification cost iso 45001 accreditation business advisory consultant iso 9001 2015 lead auditor latest iso certification qms lead auditor iso in food industry iso safety certification iso 9001 explained irca iso 9001 sap b1 consultant iso certification process steps iso 9001 internal auditor certification digital marketing consulting agency iso 27001 lead implementer certification iso 14001 lead auditor aviation consulting companies iso 14001 2015 environmental management system iso 9001 2011 iso 45001 safety management system iso 14001 2015 certification occupational health and safety management system iso 45001 quality management system in construction iso for educational institutions irca iso iso for sustainability tuv nord iso certification udemy iso 27001 iso 27001 implementer certification iso document management system iso sustainability management system tuv sud iso 9001 us consulting companies integrated management system certification quality management system audit 27001 iso 2013 controls iso 4001 certification qms for medical devices iso certification 45001 ce iso 9001 iso 17025 accreditation bodies irca iso 9001 lead auditor quality management programs iso 9001 2015 lead auditor certification iso 9001 construction ai business consultant certification in quality management iso 9000 certification cost lead auditor 45001 ohsas iso 45001 qms iso 9001 certification iso 9001 qms requirements get iso 27001 certified iso bureau veritas 9001 2016 latest iso 9001 standard franchise consulting services iso 27001 cloud security customer service consultancy iso 27001 nist iso 9001 2015 iso 14001 2015 iso 45001 2018 iso 90001 2008 iso for food quality restaurant consultancy services iso 9001 quality management system certification iso 27000 information security iso qar gmp iso certification iso 14001 sustainability dropshipping consultant iso 9001 certified lead auditor business consulting business iso 27001 security standards iso ts 16949 certification iso 45001 lead auditor certification iso 39001 certification understanding iso 9001 iso certified certificate tuv iso 27001 iso certification for cyber security bim iso 19650 certification iso 27001 2023 iso 9001 and 45001 iso certification for food management consulting agency iso 14001 20 iso certification provider iso 27001 2022 lead auditor iso 27001 lead auditor information security certification irclass iso certification iso 27001 lead implementer price qms certification for individuals bs en iso 9001 2000 safety management system iso 45001 iso 45001 2018 lead auditor iso 20000 requirements latest iso 27001 lead auditor 14001 iso 27001 lead implementer certification cost india iso 22000 and fssc 22000 iso 90001 quality management system lloyds iso certification iso 2700 standards iso 45001 certification requirements lead auditor iso 22000 isms lead implementer qms certification cost 45001 occupational health and safety iso 20000 certification requirements iso 9001 certification cost for individuals iso 14001 for iso 27000 lead auditor certification iso 27001 new standard coursera iso 27001 iso 9001 details iso 27001 in a nutshell iso 27001 2013 information security management system certified lead auditor iso 9001 lead implementer 27001 9001 2001 pecb iso 9001 bqc iso certification lead auditor certification iso 9001 iso90001 certified auditor iso certification integrated iso 14001 and iso 45001 iso27k standards bsi lead implementer 27001 iso food safety certification cisa iso 27001 quality lead auditor certification isms security controls iso 2700 2022 iso quality assurance standards latest qms standard iso 27001 cissp iso 22000 haccp certification itil and iso 27001 isms incident management iso 27001 compliance certification

iso 9001 iso 14001 iso 27001 iso 45001 iso 50001 iso 9001 2015 iso 22000 iso certification iso 37001 iso 14040 iso 26000 iso 27000 iso standards iso 9001 certification iso 14001 2015 iso 20000 iso 27001 certification iso 45001 2018 fssc as9100 iso 14001 certification iso 22000 2018 iso 270001 iso 9001 quality management system 9001 2015 iso 13485 certification iso accreditation iso 901 iso 22301 certification iso certification list iso 17025 certification ohsas 18001 certification iso consultant iso certification consultants iso auditor certification iso 9001 2005 27001 2013 iso 20000 certification iso 9001 2015 certification iso 27001 latest version 13485 certification iso 9004 2018 9001 iso 2008 lead auditor iso 9001 iso quality management qms certificate iso 9001 consultants iso 19001 certification iso 9000 certification iso 9001 requirements iso certificate registration iso 90012015 iso certification requirements iso 45001 and iso 14001 iso 9001 iso 14001 bsi iso 9001 iso consulting services iso consultants tuv iso certification iso 9001 2015 quality management system iso9001 and iso14001 iso 9001 2015 qms quality management system certification integrated management system iso 9001 iso 14001 iso 45001 iso 9001 quality management iso 9001 cost iso 9001 certification requirements iso 9001 lead auditor certification iso90012015 iso 9002 standard intertek iso certification iso 14001 and 45001 iso 90001 certification iso 9001 to 2015 iso certificate price 9001 2015 iso iso 9001 2015 certification cost latest iso certification qms lead auditor iso certification 14001 tuv nord iso certification tuv sud iso 9001 ce iso 9001 iso 9001 construction iso 9000 certification cost qms iso 9001 certification 9001 2016 latest iso 9001 standard iso 9001 2015 iso 14001 2015 iso 45001 2018 iso 90001 2008 bureau veritas iso iso 9001 quality management system certification iso certified certificate iso 9001 and 45001 iso certification provider irclass iso certification lloyds iso certification qms certification cost iso 9001 certification cost for individuals iso 9001 details bqc iso certification