What Changes Are in the 2022 Version Of ISO 27001?

This blog looks at the main changes that certified organisations will need to consider when transitioning from the 2013 version of ISO 27001 to the new 2022 version. Some of the changes can help improve the performance of the Information Security Management System (ISMS) and some may just be “things to do to maintain certification.” Below is a list of what I believe are the changes that are worth mentioning.

Clause 4.2 Understanding the Needs and Expectations of Interested Parties

The addition here is that as well as identifying the needs and expectations of interested parties, organisations are also now required to analyse and identify which of these needs and expectations will be addressed through the ISMS.

It is mostly understood that just because an interested party has a need and expectation with respect to information security, that did not mean that the ISMS had to deal with it. This new requirement asks organisations to be clear about which ones will be addressed. 

Clause 4.4 Information Security Management System

A phrase has been added requiring planning for processes and their interactions as part of the ISMS.

Clause 5.3 Organisational Roles, Responsibilities and Authorities

A phrase has been added to clarify that the communication of roles relevant to information security is done internally within the organisation. It is reasonable to think that organisations are already doing this as part of the requirement for clause 7.4 Communication.

Clause 6.1.3 Information Security Risk Treatment

Annex A is no longer described as a comprehensive list of control objectives and controls. It is now described as a list of possible information security controls. This is a more reasonable description of Annex A but organisations do not need to change anything in the ISMS because of this change in wording.

Clause 6.2 Information Security Objectives and Planning to Achieve Them

There is now an additional requirement to clarify how information security objectives are monitored. This is sensible enough and organisations will need to update the documentation on the objectives to make it clear how they are going to “monitor” them.

Clause 6.3 Planning of Changes

There is a new requirement: “When the organization determines the need for changes to the information security management system, the changes shall be carried out in a planned manner.”

Organisations are most likely doing this already as it was also partially covered in requirement 8.1. I.e., organisations do a bit of thinking and planning when making changes to anything to do with the ISMS. 

Clause 7.4 Communication

The requirement has been slightly reworded so that instead of saying “who shall communicate” it now says, “how to communicate.” Also, the requirement “the processes by which communication shall be effected” has been removed. Organisations will need to pay some attention to this and revise any documentation relating to communication to show “how.”

Clause 8.1 Operational Planning and Control 

This is one of the more significant changes. New requirements have been added for:

— “establishing criteria for the processes;

— implementing control of the processes in accordance with the criteria.”

This is vague as it does not say what processes (which implies all of them) and does not say what sort of criteria organisations should define. A logical interpretation may be that it is the criteria related to the successful management of the processes. In other words, these criteria could be “success criteria” and/or “critical success factors,” "key performance indicators" etc. 

In this clause, the requirement to "implement plans to achieve information security objectives" has been removed.

Another change in clause 8.1 is that instead of organisations ensuring that outsourced processes are determined and controlled, it has been reworded as “The organization shall ensure that externally provided processes, products or services that are relevant to the information security management system are controlled.”

Clause 9.2 Internal Audit

A minor change whereby this clause has been divided into two sub-sections – 9.2.1 – General and, 9.2.2 - Internal audit programme. 

Clause 9.3 Management Review

A new mandatory item 9.3.2 c) has been added for the management review:

“Changes in needs and expectations of interested parties that are relevant to the information security management system;” top management in the organisation will need to ensure that this is covered at the management reviews.

Clause 10 Improvement

The change is that the subclauses have switched places, so the first is now Continual improvement (10.1), and the second is Nonconformity and corrective action (10.2), nothing in the text has changed.

Annex A