INSIGHTS

ISO 27001:2022 – Key Changes andApproaches to Transition
Executive Summary:This article will address the changes and updates to ISO 27001 standard
published on 25 October 2022, and the approaches organisations can taketo implement the changes introduced. There have been significant
advancements in technology, as well as an increase in the complexity ofsecurity threats since the last iteration of ISO 27001 was published on 25
September 2013. The changes introduced in the ISO 27001 and the Annex
A controls aim to provide guidance on improving the governance around theimplemented security controls and addressing risks introduced by emerging
security threats.
As organisations begin the transition process to ISO 27001:2022, theyshould factor in changes that may be needed across their security processes
and updates to their policies, procedures and standard. Transition to the newversion should be completed by 31 October 2025, and will require planning,education, staff and budget to accomplish.
What is ISO 27001:

ISO 27001 is an international standard that outlines a framework for an Information Security
Management System (ISMS). The standard provides a systematic approach to implementing information
security controls to manage the applicable risks to an organisation. It provides guidance on theimplementation of security controls and best practices for protecting information assets, including people,processes, and technology.
The standard covers the management of risks to the security of information that an organisation holds. It
includes requirements for risk assessment, the implementation of security controls, and regular reviews toensure that the ISMS is effective. It also includes guidelines for incident management and business
continuity planning. Organisations that adopt the standard are required to have a management system inplace to protect against unauthorised access, disclosure, disruption, modification, or destruction ofinformation.

ISO 27001 certification is the process of demonstrating to an external auditor from a certifying body, thatthe organisation's ISMS meets the requirements outlined in the standard. Achieving certification requires
the completion of an external audit, and ongoing surveillance audits to demonstrate ongoing compliancewith the standard. Organisations that are certified can use the standard as a benchmark for theirinformation security management, and it can also be used to demonstrate the company's commitment toinformation security to clients, stakeholders and regulatory bodies.
What are the changes to ISO 27001:

ISO 27001 was first published in 2005 and then revised on 25 September 2013, as ISO/IEC 27001:2013.
The most recent revision was published on 25 October 2022, as ISO/IEC 27001:2022 "Information
security, cybersecurity and privacy protection — Information security management systems".
It is important to understand the differences between ISO 27001 and ISO 27002. ISO 27001 is the mainstandard against which organisations are certified, whereas ISO 27002 provides guidance on
implementing Annex A security controls.
The ISO 27001 management clauses (4-10) have undergone several minor changes, especially across thefollowing clauses:•Clause 4.2: Understanding the needs and expectations of interested parties•

Clause 6.2: Information Security objectives and planning to achieve them•

Clause 6.3: Planning of Changes•

Clause 8.1: Operational Planning and control

In terms of structural changes, Clause 9.2: Internal audit has been divided into 9.2.1: General and 9.2.2:
Internal audit program. However, the requirements remain the same.
Similarly, Clause 9.3: Management review has been split into three subsections — 9.3.1: General, 9.3.2:
Management review inputs, and 9.3.3: Management review results. A new mandatory item 9.3.2 c) has
been added for the management review: “Changes in needs and expectations of interested parties that arerelevant to the information security management system;” top management in the organisation will needto ensure that this is covered at the management reviews.
The ISO 27001:2022 version also introduces a new Clause 6.3: Planning for Changes. “When theorganisation determines the need for changes to the information security management system, thechanges shall be carried out in a planned manner.” To meet this requirement, it is important that changes
to the ISMS are planned and evidence retained to show the changes were managed appropriately.
Organisations should ensure they have a documented plan that includes activities completed, evidence ofmanagement review and communications based on the defined communication plan.

protiviti.com

Point of View ● 2

The major change that organisations should be aware of is the update to Annex A controls within the newISO 27001:2022 standard. ISO 27001:2022 adopts a new structure for the Annex A controls (InformationSecurity Controls), which has been reorganised, updated, and extended. This aligns with ISO/IEC
27002:2022, published in March 2022. ISO/IEC 27002 is to be used as a reference for selecting andimplementing controls for risk treatment in an Information Security Management System (ISMS) basedon ISO/IEC 27001.
Key Changes to ISO 27002 - Annex A Controls

The major changes to ISO 27002, include restructuring the original 14 control domains into 4 categories.
As a result, the total number of controls has decreased from the original 114 to 93. This decrease has comemainly due to merging 57 controls into 24 controls. 58 controls remain mostly unchanged, with minor
contextual updates, and 11 controls are brand new (not available in ISO/IEC 27001:2013).
The controls are restructured into 4 clauses:•

A.5 Organisational - contains 37 controls•

A.6 People - contains 8 controls•

A.7 Physical - contains 14 controls•

A.8 Technological - contains 34 controls

The 11 new controls added to Annex A include:•

A.5.7 Threat intelligence•

A.5.23 Information security for the use of cloud services•

A.5.30 ICT readiness for business continuity•

A.7.4 Physical security monitoring•

A.8.9 Configuration management•

A.8.10 Information deletion•

A.8.11 Data masking•

A.8.12 Data leakage prevention•

A.8.16 Monitoring activities•

A.8.23 Web filtering•

A.8.28 Secure coding

Key Transition Points for ISO 27001:2022

Organisations that are currently certified to ISO 27001:2013 will have three years to transition to ISO/IEC
27001:2022. The transition period began on 31 October 2022 and ends on 31 October 2025. Certifications
based on ISO 27001:2013 will expire or be withdrawn at the end of the transition period.

protiviti.com

Point of View ● 3

Organisations pursuing ISO 27001 for the first time (both Stage 1 and Stage 2 audits) can be certified on
the 27001:2013 version until October 2023. Transition audits can either be done at the same time as theorganisation’s next audit (e.g., surveillance audit and transition audit), or separately.
All organisations that wish to remain certified to ISO 27001 will have to transition to the 2022 version of
the standard within the set transition period which ends on October 31,2025. During the transition period
both versions of the ISO 27001 standard remain valid and audits to either version of the standard may beconducted subject to the rules noted below, but plans should be made for an organisation’s transition tofully occur prior to the transition period ending.
•All new certifications starting 1 November 2023 should be to the new ISO 27001:2022 version, after
this date all recertification audits are recommended to utilise the ISO 27001:2022 version.

•

All transition audits should be conducted by 31 July 2025.

•Transition period ends on 31 October 2025, ISO 27001:2013 certificates will no longer be valid after
this date.

Certification Timeline•••Entities that hold an ISO 27001:2013 will have to complete transition within 36 months.
oDuring transition, existing ISO 27001:2013 certificates will remain valid.

oISO 27001:2022 certificates will be issued based on the 3-year re-certificate cycle.

Transition audits to the ISO 27001:2022 are based on any one of the following:oSurveillance audit.

oRecertification audit.

oSpecial audit.

oInitial certification does not require a transition audit.

Transition audits must consider and include:
oGap analysis against ISO 27001:2002, and any needed changes to the auditee’s ISMS.

oUpdate of the Statement of Applicability (SoA).

o

Update of the risk treatment plan, as applicable.

A detailed report of the transition requirements can be found here.
How can organisations approach the transition to the revised Annex A in ISO 27001:2022.

Changes in Annex A will require organisations to realign their controls. There are two ways to transition
to the new requirements. The first option would be to perform a comparison of the existing risk
assessment for coverage against the Annex A controls. The new controls introduced in Annex A should beconsidered for applicability and risk treatment plans may need to be updated. The Statement ofApplicability (SOA) would need to be updated to reflect any new controls added or modified.

protiviti.com

Point of View ● 4

The second option would be to perform a fresh risk assessment and identify relevant controls from thenew Annex A, which may be considered to manage the risk. As a part of this process, coverage of all
applicable Annex A controls should be ensured. Risk Treatment plans will likely require an amendment toreflect any new risks that require a treatment plan. A new SOA should be created which is aligned to thenew controls. The final step would be to update any documents that reference the old set of controls.
How can Protiviti help

Whether you are currently certified to ISO/IEC 27001 or new to the standard, Protiviti provides anextensive array of services to prepare you for successful certification.
Our services include:•ISO 27001 gap assessments and remediation support to prepare you for the certification audit. We
can support all aspects of remediation activities required, from design of processes and architecture,
implementation of solutions, and development of documentation to project and program
management and subject matter expert support in specific areas.

•ISO 27001 internal audits as required by clause 9.2.

•Prepare your team and provide support during the certification process.

Contacts
Chip Wolford+1.513.362.1716
Chip.wolford@protiviti.com
Anil Chacko
Anil.chacko@protiviti.com

Protiviti (www.protiviti.com) is a global consulting firm that delivers deep expertise, objective insights, a tailored approach and unparalleledcollaboration to help leaders confidently face the future. Protiviti and our independent and locally owned Member Firms provide clients with consulting
and managed solutions in finance, technology, operations, data, analytics, governance, risk and internal audit through our network of more than 85
offices in over 25 countries.
Named to the 2023 Fortune 100 Best Companies to Work For® list, Protiviti has served 80 percent of Fortune 100 and Fortune Global 500 companies.
The firm also works with smaller, growing companies, including those looking to go public, as well as with government agencies. Protiviti is a wholly
owned subsidiary of Robert Half (NYSE: RHI). Founded in 1948, Robert Half is a member of the S&P 500 index.

© 2023 Protiviti Inc. An Equal Opportunity Employer M/F/Disability/Veterans. PRO 0122
Protiviti is not licensed or registered as a public accounting firm and does not issue opinions on financial
statements or offer attestation services.