Cloud 101
Circle
Events
Blog

How to Prepare for ISO/IEC 27001:2022

How to Prepare for ISO/IEC 27001:2022

Blog Article Published: 03/15/2023

Originally published by Schellman.

When it comes to ISO/IEC 27002:2022 recently, it felt a bit like a game of Red Light, Green Light—you know, the childhood game where everyone runs to the finish line upon Green Light being called, but you had to stop on a dime when you heard “Red Light!” and await the next, random declaration of Green so you could move forward again.

On the playground, it was a game of anticipation, and for those of us that were monitoring this standard, it was very similar, at least until recently—ISO/IEC 27002:2022 was released in February 2022, and on October 25, 25, 2022, ISO 27001:2022 was released as well.

Now that the “green light” on these new versions has officially been given, understanding the timeline for the related transition to ISO/IEC 27001:2022 is important for organizations undergoing ISO 27001 certification.

These major updates to standards can make things a bit complicated for you, and that’s why, in this article, we’ll discuss the key takeaways from relevant transition documents so that you know more of what to expect as things move forward with implementation.

What are the ISO/IEC 27001:2022 Transition Requirements?

Leading up to that publication of ISO/IEC 27001:2022, the International Accreditation Form (IAF), published a Mandatory Document (MD) in August 2022 outlining the transition requirements for migrating from ISO/IEC 27001:2013 to ISO/IEC 27001:2022. The document addressed both accreditation bodies (ABs) and accredited certification bodies (also referred to as conformity assessment bodies (CABs)) and was made publicly available on the IAF’s website here.

The following are the main takeaways, which have now been updated and are now based on the transition requirements outlined in IAF MD 26:2023 (issue 2):

Key Takeaways from IAF MD 26:2023

Details

New technical updates

  • Control Set Replaced: ISO/IEC 27002:2022 controls (93 controls within newly formed Clauses 5-8) replace the current Annex A control set (114 controls within A.5-A.18). For more details, please refer to our previously recorded webinar.
  • Minor Wording Changes to Clause 6.1.3.c-d: Removes potential wording ambiguity and outdated references to terms such as “control objectives” (which no longer exist under the updated control set structure of ISO/IEC 27002:2022).
  • Addition of a New Subclause 6.3 (Planning for Changes): Defines that changes to an ISMS by an organization shall be conducted in a planned manner.

*The above bullets do not represent a comprehensive list of changes but rather those that Schellman believed to be most relevant. For a complete listing of changes from ISO/IEC 27001:2013 to ISO/IEC 27001:2022, please refer to clause 2.2 “key changes” of IAF MD 26:2023)

Transition period for certified organizations

  • There will be a three-year (36-month) transition period for organizations that are currently ISO 27001 certified, which began once ISO/IEC 27002:2022 was published.
  • However, there was an important update in IAF MD 26:2023: The above three-year transition period does not apply to organizations who will be conducting a recertification review during this transition period; rather, those organizations must now start that recertification review against the ISO/IEC 27001:2022 no later than 18 months from the last day of the publication month of ISO/IEC 27001:2022 (4/30/2024).

So, you can do your recertification review against the ISO/IEC 27001:2013 version of the standard provided that your recertification review is started on or prior to April 29, 2024.You would then need to transition your ISO/IEC 27001:2013 certification to ISO/IEC 27001:2022 on or before October 31, 2025 (as noted below).

  • Aside from those circumstances, the hard deadline for the recertification against ISO/IEC 27001:2013 will be 36 months from the last day of the publication month of ISO/IEC 27001:2022 (10/31/2025).

Transition period for organizations not yet certified

  • As per IAF MD 26:2023, organizations that are not yet certified but are looking to become certified during the transition period will not be able to initiate an initial certification review against the ISO/IEC 27001:2013 version of the standard after April 30, 2024 (18 months following the publication of ISO/IEC 27001:2022).
  • In other words, organizations not yet certified have until April 29, 2024, to initiate their initial certification review (e.g., Stage 1 review) against the ISO/IEC 27001:2013, otherwise, beginning April 30, 2024, all initial certification reviews must be conducted against ISO/IEC 27001:2022. (This represents a 6-month increase from the original timelines contained in issue 1 of IAF MD 26, which only gave 12 months.)

Certification Expiration

All certifications based on ISO/IEC 27001:2013 will expire or be withdrawn at the end of each respective transition period.

Transition period for accreditation bodies

Accreditation bodies will have 12 months from the last day of the publication month of ISO/IEC 27001:2022 (i.e., a deadline of October 31, 2025) to transition the accreditations of their change advisory boards (CABs), enabling them to perform certification audits of their ISO/IEC 27001:2013 certified clients.

Transition Audits

  • Transition audits can occur either in conjunction with an already scheduled surveillance/recertification review or in a separate audit.
  • Assuming the transition audit objectives can still be met, transition audits can be performed remotely.
  • This transition audit shall include the following (at a minimum):
    • Gap analysis of ISO/IEC 27001:2022, as well as the need for changes to the client’s information security management system (ISMS)
    • Updates to the statement of applicability (SOA)
    • Updates to the risk treatment plan (if applicable)
    • The implementation of the new or changed controls chosen by clients as applicable per their SOA (as well as assessment of their effectiveness)
    • Per IAF MD 26:2023:
      • When the transition is carried out in conjunction with a recertification review, an additional one half (0.5) auditor day will be needed to confirm the transition of the certified client.
      • When the transition is conducted during either a surveillance audit or a separate audit, a full additional day (1.0) will become necessary.

If the transition audit is successfully completed, the certificate document will be updated to reflect conformance with ISO/IEC 27001:2022; however, the expiration date of the current certification cycle will not be changed.

Learning More About ISO/IEC 27001:2022

Though we’re not on the playground anymore, the green light has been given—now, organizations can and are streaking towards the “finish line” that is a successful transition to the new version of ISO 27001.

Thanks to IAF MD 26:2022 and subsequent updates in IAF MD 26:2023, some transition requirements have been outlined that can help you take any necessary internal steps to prepare.

As you get going in your preparation, make sure you’re all caught up there by reading our other content on the changes contained within the new standard:

Share this content on your favorite social network today!

Sign up to receive CSA's latest blogs

This list receives 1-2 emails a month.