The revised editions of ISO/IEC 27001:2013 (requirements for an information security management system) and ISO/IEC 27002:2013 (the code of practice for information security controls) have been published, replacing the 2005 editions.
What has changed?
- The standard now follows the common high-level structure (Annex SL), making integration with ISO 9001, ISO 22301 and other management systems simpler.
- Risk assessment is no longer tied to an asset-based approach, and aligns with ISO 31000 principles.
- The “Plan-Do-Check-Act” model is no longer mandated, and preventive action is replaced by the broader concept of addressing risks and opportunities.
- Annex A is restructured from 133 controls in 11 domains to 114 controls in 14 domains, with new controls on supplier relationships and secure development.
- Greater emphasis on understanding the organisation’s context, interested parties and measuring ISMS effectiveness.
Certification bodies are expected to allow a two-year transition period. Now is the time to plan your gap analysis against the new edition.
Source: ISO/IEC 27001:2013 (ISO)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
