ISO 27001:2022 Transition – Is Your Organisation Still Using the Old Version?

The transition from ISO/IEC 27001:2013 to ISO/IEC 27001:2022 has been underway for some time, and many organisations have already updated their certification. However, some organisations are still holding certificates based on the older version.

In many cases, these organisations obtained ISO 27001 certification to meet a customer's requirement. They continued with regular surveillance audits but did not pay much attention to changes in the standard. When the transition requirement was announced, it was acknowledged but often put aside because of other business priorities.

If your organisation is in a similar situation, it is important to understand what needs to be done.

What Has Changed in ISO 27001:2022?

The overall structure of ISO 27001 has remained largely the same. However, there have been important updates to Annex A, which covers information security controls.

In the 2013 version, Annex A included 114 controls divided into 14 categories. In the 2022 version, these have been reorganised into 93 controls under four main themes:

• Organisational Controls

• People Controls

• Physical Controls

• Technological Controls

Some existing controls have been combined or updated, while 11 new controls have been introduced. These cover areas such as threat intelligence, cloud security, data masking, information deletion and secure coding.

One important point is that organisations cannot simply update the control numbers in their existing documents. They need to review their Statement of Applicability (SoA), map the old controls against the new structure and assess whether the new controls are relevant to their operations.

What Do Auditors Check During the Transition Audit?

During the transition audit, auditors generally focus on three important areas:

1. Updated Statement of Applicability (SoA) 

Your existing SoA needs to be reviewed and updated according to the new Annex A controls. It should clearly explain which controls apply to your organisation and why certain controls have been excluded.

2. Implementation of the 11 New Controls

Organisations need to review all 11 newly introduced controls and determine which ones are applicable to their business. If a control is relevant, there should be proper implementation and supporting evidence.

For example, an organisation may already be monitoring security threats but may not have formally documented this activity as part of its information security management system.

3. Updated Risk Assessment

Your information security risk assessment should also be reviewed and updated. If it has not been revisited since the transition, there may be gaps between your identified risks, selected controls and current business requirements.

What Should You Do If You Have Not Started the Transition?

If your organisation is still following ISO 27001:2013, it is important to take action rather than delay the process further.

Here are a few practical steps:

• Contact your certification body: Discuss your current certification status and understand the applicable transition requirements and timelines.

• Review your existing SoA: Identify the changes required under the new Annex A structure.

• Assess the new controls: Check which of the 11 additional controls apply to your organisation and plan their implementation.

• Update your risk assessment: Make sure your risk assessment reflects current information security risks and business requirements.

• Maintain proper documentation: Keep records and evidence to demonstrate that the updated controls are implemented and working effectively.

For organisations that already have a properly implemented Information Security Management System (ISMS), the transition may mainly involve updating documentation, reviewing controls and maintaining the necessary evidence.

However, if the original certification was completed mainly to meet a customer requirement, without properly implementing the controls, the transition may require more work. It could highlight gaps that were not identified earlier.

Final Thoughts

ISO 27001 certification is not just about having a certificate. It is about protecting information, managing security risks and building confidence among customers and business partners.

Moving to ISO 27001:2022 is an opportunity to review your existing information security practices and make sure they meet the updated requirements.

If your organisation is still following the older version, do not wait until a customer audit or security review highlights the gaps. Start reviewing your ISMS and plan your transition.