Sometimes complex implementation
While obtaining (and maintaining) ISO 27001 certification offers numerous benefits, its implementation can be a real challenge for organisations.
- Achieving compliance can be costly in terms of time, money, and human resources (training, documentation, audits, etc.).
- The text and its requirements can be difficult to understand, especially for small businesses that do not have a dedicated cybersecurity department.
- Implementing an ISMS according to ISO 27001 requires significant changes in internal processes and organisational culture.
- Maintaining compliance requires ongoing commitment and regular monitoring, as well as detailed (and extensive!) documentation, which represents a significant administrative burden.
How to Facilitate Compliance with ISO 27001
To implement ISO 27001 in your organisation, you first need to secure the support of your employees and management:
- secure the commitment of your executive committee (COMEX), which must actively support the project and allocate the necessary resources;
- train and raise awareness among staff about the importance of the standard;
- involve all stakeholders, including suppliers and partners.
Another important point: carry out a precise assessment of the risks associated with your organisation (threats, vulnerabilities and impacts) to define the controls to be put in place. Once this stage has been completed, carry out regular internal audits as part of a continuous improvement process.
Also remember to document security policies and audit reports clearly and exhaustively.
Finally, you can rely on specialist tools (such as Tenacy!) that make compliance management easier.
ISO 27001:2022 VERSION: A SIGNIFICANT UPDATE
The necessary adaptation of the ISO 27001 standard
A decade has passed since the last update of the standard in 2013. During this time, threats have evolved significantly. On one hand, our lifestyles and relationship with digital technology have been transformed, presenting an increasingly broad attack surface:
- rapid acceleration of digital transformation;
- adoption of remote work and hybrid working models at a rapid pace;
- dominance of cloud computing with a need for connectivity everywhere and all the time…
At the same time, cyberattacks have been increasing, with attackers becoming more professional and techniques of compromise becoming more accessible. It has never been easier to launch an attack: cybercriminal networks have become structured and now offer malware and initial access on demand.
These developments made securing organisations increasingly complex. It was essential for the ISO standard to adapt to this new reality. It all starts with the change in the standard’s name. The title of the standard shifts from “Information Technology” to “Information Security, Cybersecurity, and Privacy Protection.“
What changes can be expected with ISO 27001:2022?
The 2022 version of ISO 27001 aims to (re)define the standards and requirements for establishing your organisation’s information security management system. Widely used across all types of organisations, this version update naturally raises questions about the changes it entails.
Annex A and Its Updates on Controls
The changes in this new version of the standard primarily concern Annex A, which is derived from the latest version of the ISO 27002:2022 standard published in February 2022. This annex is no longer regarded as a detailed and exhaustive list.
In the ISO 27001:2013 version, the controls were divided into 14 different domains. They are now consolidated into 4 categories.
- Controls related to people: remote work, confidentiality, non-disclosure of information, filtering…
- Organisational controls: organisational information policies, use of cloud services, use of assets…
- Physical controls: security surveillance, storage media, maintenance, facility security…
- Technological controls: authentication, encryption, data leakage prevention…
Another notable change is the addition of 11 new controls covering the following aspects:
- threat intelligence (A.5.7),
- cloud-hosted information security (A.5.23),
- ICT preparedness for business continuity (A.5.30),
- physical security monitoring (A.7.4),
- monitoring / surveillance activities (A.8.16),
- web filtering (A.8.23),
- secure code design (A.8.28),
- configuration management (A.8.9),
- information deletion (A.8.10),
- data masking (A.8.11),
- data leakage prevention (A.8.12).
Regarding the domains, despite the addition of new controls, their number has decreased from 114 to 93 due to consolidations and mergers.
What are its concrete impacts on the organisation?
The evolution of the standard emphasizes procedures, criteria, and controls, which are reiterated as integral parts of the ISMS. Objectives must now be documented and monitored; changes to the ISMS must be planned.
In practice, for the ISMS to comply with the new ISO standard, organisations will need to undergo a transitional phase over the next two to three years.
The main change lies in the Statement of Applicability (SoA) as well as in the evidence of the comparison between the two versions of the ISO 27001 standard. Several tasks need to be planned:
- updating the framework and translating it into certification requirements;
- reviewing the risk treatment plan;
- reviewing the ISMS communication plan;
- updating procedures and checklists used for internal or external audits.
Whether you are a certified company or not, you will need to assess the necessary adaptations to your third-party security tools. Fortunately, at Tenacy, we are ahead of the game, and the requirements framework is already updated on the platform (requiring no action from you). You can be assured that the records you use to demonstrate compliance meet the new security requirements!