When do I need to transition to ISO 27001:2022?

The transition period to ISO 27001:2022 spans three years, starting from 31 October 2022. By 31 October 2025, companies must comply with the revised standard to maintain certification, as ISO 27001:2013 will no longer be valid.

Starting from 31 October 2023, it is no longer possible to obtain certifications under the 2013 version of ISO 27001. All audits conducted after this date will be based solely on the requirements of the 2022 version of the standard.

While there is still time until the transition deadline, it is recommended to start the process earlier rather than later. Doing so provides ample time for preparation, the implementation of necessary changes, employee training, and addressing any challenges.

Transitioning to the new standard involves several steps. First, you need to conduct a gap analysis to identify the differences between the old and new standards. This will help you understand what changes need to be made to your existing Information Security Management System (ISMS). Next, you should develop a transition plan that outlines the steps you need to take to comply with the new standard. This plan should include timelines, resources, and responsibilities. Finally, you need to implement the changes and conduct an internal audit to ensure that your ISMS meets the requirements of the new standard.

Are there any new requirements for the statement of applicability (SOA)?

The Four Environments and what are they?

The standards and Annex A have thoughtfully grouped the SOA requirements into four 'environments' to enable an organisation to better assess the requirements. The environments are:

• Organisation: This environment focuses on the overall structure and governance of the organisation. It involves developing policies and procedures to ensure that the organisation operates in a secure and efficient manner.
• People: This environment focuses on the individuals within the organisation. It involves developing measures to ensure that employees are aware of their responsibilities and have the necessary skills and knowledge to perform their roles effectively.
• Physical: This environment focuses on the physical security of the organisation. It involves implementing measures to protect the organisation's assets, such as access controls, surveillance, and physical barriers.
• Technology: This environment focuses on the organisation's ICT systems. It involves developing measures to ensure that these systems are secure and can support the organisation's operations. Here are the new requirements for the standard and some operational considerations:

4.2 c) Identify which interested party requirements must be addressed through the ISMS

Overview: This clause requires organisations to identify the requirements of interested parties that must be addressed through the Information Security Management System (ISMS). Interested parties can include customers, employees, regulators, suppliers, and other stakeholders.

Operational Examples:

• Customer Data Protection: Implementing measures to protect customer data, such as encryption, access controls, and regular audits. This ensures that customer data is secure and complies with privacy regulations.
• Employee Training: Providing regular training to employees on information security policies and procedures. This helps ensure that employees are aware of their responsibilities and can effectively protect sensitive information.
• Regulatory Compliance: Implementing processes to ensure compliance with relevant regulations, such as GDPR, HIPAA, or PCI DSS. This can involve conducting regular audits, maintaining documentation, and reporting compliance status to regulators.
• Supplier Security Assessments: Conducting security assessments of suppliers to ensure they meet the organisation's security requirements. This can involve reviewing their security certifications, conducting audits, and assessing their security controls.

6.3 Implement changes to the ISMS in a planned manner

Overview: This clause requires organisations to implement changes to the ISMS in a planned manner. This involves developing a change management process that ensures changes are reviewed, approved, and documented.

Operational Examples:

• Change Management Process: Developing a change management process that outlines the steps for implementing changes to the ISMS. This can involve using change management tools, conducting regular change reviews, and maintaining documentation.
• Impact Assessments: Conducting impact assessments to evaluate the potential effects of changes on the ISMS. This can involve analysing the risks and benefits of changes, identifying potential issues, and developing mitigation strategies.
• Approval Workflow: Implementing an approval workflow to ensure that changes are reviewed and approved by relevant stakeholders. This can involve using automated tools to track approvals and maintain documentation.
• Communication Plan: Developing a communication plan to inform employees and other stakeholders about changes to the ISMS. This can involve conducting training sessions, providing updates, and addressing any concerns.

8.1 There are new requirements for defining criteria for security processes and implementing processes based on those criteria

Overview: This clause requires organisations to define criteria for security processes and implement processes based on those criteria. This involves developing clear and measurable criteria for security processes and ensuring that these processes are effectively implemented.

Operational Examples:

• Security Process Criteria: Developing criteria for security processes, such as access controls, data encryption, and incident response. This can involve specifying the requirements for each process, such as the level of security, the frequency of reviews, and the methods to be used.
• Process Implementation: Implementing security processes based on the defined criteria. This can involve using automated tools to enforce access controls, encrypting sensitive data, and conducting regular incident response drills.
• Regular Reviews: Conducting regular reviews of security processes to ensure they meet the defined criteria. This can involve using automated tools to monitor processes, conducting manual reviews, and addressing any issues.
• Continuous Improvement: Implementing a continuous improvement process to enhance security processes based on feedback and lessons learned. This can involve conducting regular assessments, identifying areas for improvement, and implementing changes.

9.3.2 c) Ensure inputs from interested parties focus on their needs, expectations, and relevance to the ISMS

Overview: This clause requires organisations to ensure that inputs from interested parties focus on their needs, expectations, and relevance to the ISMS. This involves gathering feedback from interested parties and using it to improve the ISMS.

Operational Examples:

• Stakeholder Feedback: Gathering feedback from stakeholders, such as customers, employees, and regulators, to understand their needs and expectations. This can involve conducting surveys, holding focus groups, and reviewing feedback.
• Needs Assessment: Conducting needs assessments to identify the requirements of interested parties. This can involve analysing feedback, identifying common themes, and prioritising requirements.
• ISMS Adjustments: Making adjustments to the ISMS based on the needs and expectations of interested parties. This can involve implementing new security controls, updating policies, and conducting training sessions.
• Regular Communication: Maintaining regular communication with interested parties to ensure their needs and expectations are being met. This can involve providing updates, addressing concerns, and gathering additional feedback.

PART 2