ISO 27001:2022 Updates: Everything You Need To Know

What are the Business Benefits of being ISO 27001 certified?

• You can implement a structured framework for risk management and treatment. 
• You can enjoy a certain peace of mind pertaining to the overall security posture of your business. 
• Demonstration to your clients, partners, customers and government of your commitment to cybersecurity. 
• You could avoid getting heavily penalised in case of an attack due to slipshod security practices. 
• It helps you to determine risks in your supply chain and treat them accordingly. You will ensure that you are not vulnerable to supply chain attacks which are very rampant these days. 
• It’s a great opportunity to alter the organisational mindset and make everyone understand the importance of cybersecurity. To get certified, you’ll probably need to train your staff in better Incident Response and Ransomware Response.

Why have there been updates in ISO 27001 and ISO 27002?

ISO 27001 was first published in 2005 and it was later revised in 2013. The information security management standard has been updated again in 2022. It is now being commonly referred to as ISO 27001:2022. 

First off, let’s address the elephant in the room - Why have the standards been updated? 

The answer lies pretty much in your news headlines. Just take a look at this list of cyber- attacks in October 2022. You’ll get a pretty good idea of how dangerous the cyber landscape is getting every day. 

Cyber criminals are always working on new tactics and techniques to attack your business, your data and your crown jewels. As we shift more and more to the digital world, the threat landscape increases by the minute. Add the anonymity that cryptocurrency offers to ransomware criminals and you have a cybersecurity disaster brewing every day. 

And no, this is not fear mongering - it’s the truth! 

The ISO 27001 standard and its code of practice the ISO 27002 have been updated to address this new ominous reality. The update is intended to ensure that businesses evolve their cyber postures and update technologies in sync with the escalating information security risks.  
  

To the Top

ISO 27001 2013 vs. 2022 revision – What has changed?

• Control type 
• Operational capabilities 
• Security domains 
• Cybersecurity concepts
• Information security properties

To the Top

How do the changes impact my business’s existing certification?

To the Top

My business is already in the process of applying for ISO 27001:2013. How do the new changes impact me? 

Are you already working on getting your ISO 27001:2013 certification? Don’t stress over the fact that all the work you’ve done so far has been wasted. 
In fact, certification bodies are unlikely to give ISO 27001:2022 certifications for at least 6 months from October, 2022.  
Also, ISO 27001:2013 will not be fully retired for at least three years so you’re good for now. 

To the Top

Should I hold my application till the certification bodies start giving ISO 27001:2022 certification? 

How much time is provided to upgrade/transition our certification from 2013 to 2022?

Organisations which are already certified with the ISO 27001:2013 standard will be given a three-year transition period to upgrade their Information Security Management system. You can upgrade during your upcoming surveillance or re-certification audit.

It is important to keep an eye out for when the new certifications begin and then you might want to expedite your transition. Our Virtual Cyber Assistants can help you update or align your security processes to accommodate  the new compliance requirements and revised controls quickly and conveniently. 

Essentially, there’s no point in rushing to upgrade/transition to the new standard. But it is advisable to start thinking about it immediately. Start evaluating how you can better integrate your security processes with the ISO 27001:2022 standard.
 
However, on September 29, 2025, all existing ISO 27001 certificates issued under the 2013 revision will expire regardless of the expiration date on the certificate.

To the Top

What should our approach be to upgrading to the latest version?

Simply put - the approach should be methodical and not haphazard. There is still time for the ISO IEC 27001:2013 standard to fully retire. 

Start by conducting Gap/Readiness  assessments for your business. Then, familiarise yourself with the new controls as well as the categorisation attributes. This can help you focus on your implementations  better.

Here are some of first few steps you’ll have to look at while transitioning:  

1. Conduct a Readiness assessment to deduce the required changes.
2. Create an implementation plan for plugging the identified gaps.
3. Review and update your ISMS documents and processes.
4. Implement new controls or modify the existing controls as needed.
5. Align your risk assessment & treatment with the modified and/or new implemented controls. 
6. Update your statement of applicability: You’ll have to update your Statement of Applicability or SoA to reflect the new and merged controls. The new SoA will most likely be reviewed by all certification bodies at the time of the transition audit.  

To the Top

How can our Virtual Cyber Assistants help you upgrade to the updated version of ISO 27001:2022?     

Our Virtual Cyber Assistants can support you at all phases of the certification and/or transition. Our Virtual Cyber Assistants can:

• Conduct Readiness Assessments.
• Provide recommendations/guidance/support on aligning your cybersecurity posture to ISO 27001:2022 requirements.
• Create, Review + Comment, Review + update your ISMS policies and supporting documentation.
• Create a Risk Management framework and support in conducting Risk Assessments and defining Risk treatment plans.
• Conduct Internal audits before the certification/transition audits to ensure compliance to all requirements
• Support during external audits
  
  Our Virtual Cybersecurity Experts can also help you maintain your certification and cybersecurity posture by conducting periodic checks and reviews.

To the Top

 Useful Links to ISO 27001:2022 Resources

To the Top