ISO 27001 AND ISO 27002 CHANGES FOR 2022

(ISO/IEC 27001:2022 and ISO/IEC 27002:2022)

Recently a publication notice was released regarding the ISO 27001 and ISO 27002 changes in 2022, which states that, “all organizations having an ISO 27001:2013 (ISMS) will be required to map and update their controls in place in accordance with the new recommendations in the revised ISO/IEC 27002:2002, considering their organizational needs and context.”

Highlight of ISO 27001 Updates

CHANGES TO ISO 27001 and ISO 27002 for 2022

ISO/IEC 27001:2022:

All organizations having an ISO 27001:2013 (ISMS) will be required to map and update their controls in place in accordance with the new recommendations in the revised ISO/IEC 27002:2002, considering their organizational needs and context.

ISO/IEC 27002:2022:

The current version of ISO 27002 that contains 114 controls divided over fourteen chapters, and  the version of ISO 27002:2022 that will contain 93 controls will all be divided over four categories/themes:

  • Chapter 5 Organizational (37 controls)
  • Chapter 6 People (8 controls)
  • Chapter 7 Physical (14 controls)
  • Chapter 8 Technological (34 controls)

THE NEW CONTROLS

The guidance section for each control have been examined and updated to reflect current advancements and practices (as necessary). Additionally, each control now has a ‘Purpose’ statement and a set of ‘Attributes’ to be used in conjunction with cybersecurity principles and other industry standards. An update to the standard also needs to factor in today’s threat landscape and security threats. The new controls are:

  1. Threat intelligence
  2. Information deletion
  3. Information security for the use of cloud services
  4. ICT readiness for business continuity
  5. Physical security monitoring
  6. Configuration management
  7. Data masking
  8. Secure coding
  9. Data leakage prevention
  10. Monitoring activities
  11. Web filtering

CONTROL ATTRIBUTES

These controls have five types of ‘attributes’ to make them easier to categorize:

  1. Control type (preventive, detective, corrective)
  2. Information security properties (confidentiality, integrity, availability)
  3. Cybersecurity concepts (identify, protect, detect, respond, recover)
  4. Operational capabilities (governance, asset management, etc.)
  5. Security domains (governance and ecosystem, protection, defense, resilience)

Timing & Enforcement:

A two-year transition period will be granted (unlike three years in several previous transitions).

FAQs ON ISO 27001 and ISO 27002

1. Will Accorian help us transition to the new revision of ISO 27001:2022?

We will assist in preparing material for the adjustments, and the organization will be able to upgrade until the 2022 revision is published, which is likely to occur soon, unless their existing ISO 27001 certificate expires after 2024, in which case, the certification bodies will conduct regular surveillance visits to ensure compliance with the new revision.  If the organization’s existing ISO 27001 certificate expires before 2024, then they will need to upgrade through subsequent re-certification.

2. We have chosen to begin implementing ISO 27001 now; which controls should we apply considering future changes?

Organizations should begin applying the clauses mentioned in the ISO 27001:2013 standard until this new standard is available. This will ensure the upcoming modifications and the work required to implement the new standard will be minimal.

2.1 How to plan a transition from ISO 27001:2013 revision to 2022 revision?

Contrary to popular belief, there will be no ISO 27001:2022 but an addendum to 27001:2013 (dubbed ISO/IEC 27001:2013+A1:2022, source). Annex A will be superseded by a normative version of ISO 27002:2022’s 93 new regulations (but without the useful hashtags).

If ISO 27001:2022 is amended, organizations who have already implemented ISO 27001:2013 are undoubtedly thinking to themselves, “Oh no, now that the 2022 revision has been published, we have to start over.” This is not true — while the 2022 revision does introduce some modifications, they are quite trivial. Organizations should plan for:

  • Assess the gap between the organization’s current controls and the new control set; update the organization’s risk assessment considering the their upcoming control update, and revise the organization’s statement of applicability considering their new risk assessment and new controls.
  • Update organizational security metrics in accordance with the organization’s new risk assessment and control procedures
  • Evaluate and alter third-party security solutions (e.g., Organization SIEM or GRC platform) to verify the artifacts used to show compliance support the new requirements.

3. Is the Auditor (certifying body) going to go through the revisions in the documentation?

If the organization is ISO 27001 Certified, the auditor will also examine documentation to determine whether the organization has made the necessary changes throughout the transition time. This will take place during regular surveillance audits.

ISO 27001 AND ISO 27002 Correlation & Differences in the updated versions of 2022

(ISO/IEC 27001:2022 and ISO/IEC 27002:2022)

ISO 27001 – A Framework for Information Security Management Systems

ISO 27001 is an ISMS (Information security management system) standard that emphasizes a risk-based approach to the management of people, processes, and technological controls. The standard’s structured nature to auditing people and technology interdependence enables the measurement, comparison, and improvement of multiple operational benchmarks if security breaches are detected.

The current standard, ISO/IEC 27001:2013, will shortly be replaced by ISO/IEC 27001:2022, the new international standard for information security management and will be renamed from “Information technology – Security techniques – Code of conduct for information security controls” to “Information security, cybersecurity, and privacy protection – Information security controls.”

Why should organizations implement ISO 27001

Businesses of all sizes face an imminent threat due to complex attacks, driven attackers and lack of current . Securing an organization’s information framework requires ensuring that security measures, controls, and policy guidelines fit the specific demands of an organization.

Adopting a proven security management system can fill gaps utilizing accurate and tried best practices. ISO 27001 is much more than a security standard. When implemented, the standard includes all stakeholders across the organization and has a scalable design that allows individuals, business units, or the whole organization to take responsibility for security in their environment.

This method aids management in strengthening security and increasing danger awareness at all levels of the organization. The ISO 27001 audit is frequently part of a more extensive organizational assessment that looks at all aspects of processes, technologies, and supply chains.

ISO 27001 a risk-based framework

Understanding that ISO 27001 is not a compliance tool but rather a risk-based framework and approach is critical. A risk-based strategy means that resources, cost, and time can be invested in minimizing threats based on the weightage of each threat and severity of the business risk. Thus making it possible to devote resources to initiatives that provide the greatest return on investment, rather than wasting time and money on “ticks in the compliance box” that have no real value.

What is the difference between ISO 27001 and 27002?

The distinguishing factor between ISO 27001 and ISO 27002 is that although an organization may achieve ISO 27001 certification, it cannot get ISO 27002 certification.

ISO 27001 is the primary standard, whereas ISO 27002 is a set of support controls that serves as a guideline and assists organizations in implementing best security practices to get ISO 27001 certification. They are following the same ISO 27000 Family.

How will the new ISO 27002 standard affect existing ISO 27001 certification or the current "first-time" implementation of the standard ?

If the 2022 revision of ISO 27001 is broadly identical to the 2013 revision, a recent version of Annex A will be applicable once the standard is published. This will be consistent with the controls specified in the new ISO 27002.

At the very least, organizations are expected to evaluate their risk assessment, identify appropriate new controls, and modify the ‘Statement of Applicability’ considering the revised ‘Annex A’. Organizations should evaluate the controls for any implementation modifications, as there are some new controls and revised guidelines for the remaining controls.

 

As previously stated, organizations are reminded that controls listed in ISO/IEC 27001 Annex A are not mandatory. ISO/IEC 27001 contains only two requirements: the use of Annex A’s control set as a reference for the comparison process (6.1.3 c)) and the development of a ‘Statement of Applicability’ (6.1.3 d)). These standards remain unaltered in ISO/IEC 27001:2022 and are essential to prevent accidental omissions.

Control themes of ISO 27001:2022

Control themes of ISO 27001:2022

Market assurance and governance

The advantages of deploying an information security management system (ISMS) is classified into these two key categories: Market Assurance and Governance.

Market Assurance refers to an information security management system’s (ISMS) ability to build market confidence in an organization’s ability to protect sensitive data. It demonstrates to external parties – clients, partners & investors that the organization will safeguard and maintain the security posture (including confidentiality, integrity, availability, and privacy of the customer’s information).

Governance is a collection of executive management responsibilities and processes to provide strategic direction, ensure objectives are being met, verify that risks are effectively managed, and validate that the enterprise’s resources are used effectively and responsibly.

To Summarize

The advantage of implementing the new controls is that because they are attribute-based, it is easier to focus on organization selections, which may reduce their compliance burden or help them see how to integrate the organization’s security processes better, thereby simplifying the implementation and management of the organization ISMS (information security management system).

WHAT IS SOC 2 COMPLIANCE

Everything you need to know about getting your SOC 2

Written by Om Hazela

Accorian has aided 100s of companies in attaining SOC 2 compliance through its end-to-end implementation services. Subsequently, our audit arm – Accorian Assurance, has enabled independently conducted audits and attestations to provide clients with their SOC 2 reports.

In the last few years, SOC 2 reports , have become the de facto way for service providers, especially SaaS companies, to showcase security assurance to their clients. Hence, it’s essential for companies that transmit, process, or, store client data. All SOC 2 reports contain a 3rd party auditors (CPA) opinion on the end company’s security posture against the requirements of the reporting standard (auditing procedure) along with scope information, exceptions, and deviations.

Such a report will aid in taking the cybersecurity question off the table by showcasing a level of security assurance to your clients and simplifying vendor evaluations & security due-diligence checks. Thus, allowing you to focus on the growth of your organization.

IS SOC 2 AN AUDITING PROCEDURE

SOC 2 is a reporting framework and auditing procedure, and not  a set of hard rules. It’s a set of best practices across various security attributes and domains with strong signals, that an organization needs to prioritize, encasing the criteria of Security, Availability, Processing Integrity, Confidentiality, and Privacy. These went on to formulate the TSCs (Trust Service Criteria) for SOC 2.

We would like to reiterate that a SOC 2 report does not prove that an organization is 100% secure, but, it’s a great baseline & starting point in your journey to instill security assurance and trust in your customers.

HOW DOES SOC 2 AID MODERN ORGANIZATIONS

Today’s modern organizations, especially service providers, need to showcase security assurance through attestations/certifications across various global, regional, and industry-focused security frameworks like ISO 27001, HIPAA, HITRUST, GDPR, CCPA, NIST CSF, etc.

Breaking down AICPA’s suite of SOC Reports

Soc stands for ‘System and Organization Controls.’” These were formerly called Service Organization Control reports. SOC is a suite of reports from the AICPA that CPA firms can issue in connection with system-level controls at a service organization.

SOC 1 – Report of your internal controls related to financial data & statements

SOC 2 – Report of your internal controls related to the 5 TSCs

SOC 3 – Report on the results of SOC 2 for public consumption

What is a SOC 2 Report?

  • A SOC 2 (System and Organization Control 2) report is an objective third-party review of an organization’s commitment to service, security, and trustworthiness via a System and Organization Controls (SOC) examination
  • A SOC 2 report is a confidential document with the auditor’s attestation. It is shared with end clients by organizations, especially service providers, to showcase assurance through internal controls for security and exceptions (if any). Thus, ensuring client data is secure. Since there are no exhaustive set of requirements, SOC 2 is different from several other information security standards and frameworks
  • End organizations are required to engage a SOC 2 auditor (CPA firm with AICPA membership) to review agreed-upon procedures relating to the organization’s internal controls and issue a report thereof.

TSC Examination (Trust Service Criteria)

SOC 2’s TSCs cover five key criteria across security. They are as follows – Security, Availability, Processing Integrity, Confidentiality, and Privacy.

TSC Examination (Trust Service Criteria)

The baseline TSC is Security, and is mandatory for all SOC 2 assessments. Often organizations choose the other TSCs based on the nature of their business and the assurance required to be showcased to clients. However, we would recommend your company be audited across all 5 TSCs to ensure that your organization securely manages client, sensitive & internal data. Thus, protecting the interests of the organization and its clients.

Types of SOC 2 Report:

  • A Type 1 report is typically sought after by companies that have a nascent security framework and maturity. For this report, auditors focus on the security framework (Policies, Procedures, and SOPs) and implementation of internal controls. They review the evidence and provide their feedback to capture the current posture against all the clauses. This capture also includes  exceptions, deviations, etc.The Type 1 report is a point-in-time assessment and does not assess control maturity. Hence, it’s ideal for companies that have recently implemented their security framework and controls.
  • A Type 2 report is ideal for companies who’ve designed, implemented, and achieved a steady state across a significant period of time. The auditor will assess the organization’s security framework and control implementation for maturity across a fixed period of time (the minimum is 6 months).

It is not mandatory to finish a Type 1 audit before a Type 2 audit. But, it is recommended for companies who are implementing security for the first or, have a nascent security posture.

Types of SOC 2

TYPICAL SOC 2 TIMELINE FOR SMB (PROCESS FLOW)

TYPICAL SOC 2 TIMELINE FOR SMB (PROCESS FLOW)

WHO NEEDS A SOC 2 REPORT?

  • An organization that offers services or that collects, manages, or transmits client data or, sensitive information is recommended to undergo a SOC 2 audit by an assessor. It can also be used by organizations to assess their current security posture across their security framework, control implementation
  • Numerous organizations are eligible for a SOC 2 report, including but not limited to

WHO NEEDS A SOC 2 REPORT

BENEFITS OF SOC 2 EXAMINATION REPORT

Few important benefits are as follows:

Benefits of SOC2

PREPARATION FOR SOC 2 & IT’S EXAMINATION:

While the scope of each SOC report varies from client to client, certain areas of focus are common to all SOC examinations. An organization can begin preparing its employees for a better control environment and, as a result, a more efficient SOC inspection by focusing on the following tasks.

PREPARATION FOR SOC 2

COMMON PITFALLS

COMMON PITFALLS

FINDING THE RIGHT PARTNER FOR YOUR SOC 2 JOURNEY

Choose your implementation & remediation advisory partner and, finally the auditor should be based on the following criteria

Partner

WHY CHOOSE ACCORIAN FOR SOC 2 EXAMINATION REPORT?

Accorian can aid you in achieving your SOC 2 report from start to finish. This would include:

  • Scoping
  • Gap Assessment
  • Security Framework Development: Writing and updating policies & procedures
  • Security Tool Implementation Services
  • vSecurity & vCISO Services – Short-term staff augmentation
  • Remediation Advisory with validated recommendations
  • Pre-audit
  • Type 1/Type 2 audits by our independent audit team
  • Sustenance services

We specialize in aiding service providers and SaaS companies.

Hence, regardless of where you are in your SOC journey or, your level of security compliance or, security posture, working with a team of experts helps reduce the time required to understand the framework, things to be implemented, and validated recommendations on tools & controls that need to be implemented.

    Ready to Start?



      Download Case study




        Download Guide




        Human Resources Director

        Posted On: 09 May, 2022

        Drop your CVs to joinourteam@accorian.com

          Interested Position

          First Name

          Last Name

          Email

          Total Experience

          Mobile Number

          Upload Resume