ISO/IEC 27001:2022

Why does it matter?

ISO/IEC 27001 turns information security from a list of controls into a management system. Controls are chosen because a risk assessment calls for them, each choice is justified in a Statement of Applicability, and top management is answerable for the result through the policy, the objectives and the management review.

Key benefits include:

• Controls follow risk

The organization defines risk criteria, identifies risks and owners, and selects treatment options and controls from the results (Clauses 6.1.2 and 6.1.3).

• Top management is accountable

Clause 5.1 lists eight things top management must do, from ensuring the policy and objectives fit the strategy to supporting other managers' leadership, and Clause 9.3 requires a management review.

• Every control decision is recorded

The Statement of Applicability states each necessary control, why it is included, whether it is implemented, and why any Annex A control is excluded (Clause 6.1.3 d).

• Changes are planned

Clause 6.3 requires that changes to the ISMS be carried out in a planned manner.

• One system with other standards

It follows the high-level structure of Annex SL, so it can sit in a single management system with other standards that use it (Introduction 0.2).

How does it work?

The requirements are in Clauses 4 to 10: context of the organization (4), leadership (5), planning (6), support (7), operation (8), performance evaluation (9) and improvement (10). Clause 3 takes its terms from ISO/IEC 27000, and the Introduction points to ISO/IEC 27000 for the family of ISMS standards, including ISO/IEC 27003, 27004 and 27005.

Risk work is the core of Clause 6.1. The organization applies a risk assessment process with risk acceptance criteria and criteria for performing assessments, identifies risks of loss of confidentiality, integrity and availability within the ISMS scope and their owners, analyzes consequences and likelihood, and evaluates the results against its criteria (6.1.2). It then selects treatment options, determines all necessary controls, compares them with Annex A to be sure none is omitted, produces the Statement of Applicability, writes a risk treatment plan, and obtains risk owners' approval of the plan and acceptance of residual risk (6.1.3). Clauses 8.2 and 8.3 apply the same assessment and treatment in operation.

Annex A is a reference list, not a checklist. Notes to Clause 6.1.3 state that controls can be designed or taken from any source and that the Annex A list is not exhaustive. The 93 controls are grouped as organizational (5.1 to 5.37), people (6.1 to 6.8), physical (7.1 to 7.14) and technological (8.1 to 8.34), the clause numbers of ISO/IEC 27002:2022, which replaced the 114 controls in 14 clauses of the 2013 edition.

Key Elements

• Context of the organization (Clause 4)

Determine external and internal issues (4.1), interested parties and their requirements, which can include legal, regulatory and contractual obligations (4.2), the ISMS scope as documented information (4.3), and the ISMS itself (4.4).

• Leadership (Clause 5)

Top management leadership and commitment (5.1), an information security policy that is documented and communicated (5.2), and assigned responsibilities and authorities (5.3).

• Planning (Clause 6)

Risk assessment (6.1.2), risk treatment and the Statement of Applicability (6.1.3), measurable security objectives and plans (6.2) and planning of changes (6.3).

• Support (Clause 7)

Resources, competence, awareness, communication and documented information: creating, updating and controlling it (7.5.1 to 7.5.3).

• Operation (Clause 8)

Operational planning and control (8.1), information security risk assessment (8.2) and risk treatment (8.3), with documented information kept as the standard requires.

• Performance evaluation (Clause 9)

Monitoring, measurement, analysis and evaluation (9.1), an internal audit program (9.2) and management review inputs and results (9.3.1 to 9.3.3).

• Improvement (Clause 10)

Continual improvement (10.1) and nonconformity and corrective action (10.2).

• Information security controls reference (Annex A)

93 controls in four themes, aligned with ISO/IEC 27002:2022, including threat intelligence (5.7), information security for use of cloud services (5.23) and data leakage prevention (8.12), which are among the 11 new controls.

What does it cover?

ISO/IEC 27001:2022 specifies requirements for establishing, implementing, maintaining and continually improving an ISMS within the context of the organization, including requirements for assessing and treating information security risks tailored to the organization. The organization sets the boundaries and applicability of its own ISMS (Clause 4.3), and the scope must be available as documented information.

What are its objectives?

The Introduction gives the purposes of the ISMS:

To preserve the confidentiality, integrity and availability of information by applying a risk management process and to give interested parties confidence that risks are adequately managed (Introduction 0.1).

To be part of, and integrated with, the organization's processes and management structure, and to be scaled to the organization's needs (Introduction 0.1).

To let internal and external parties assess whether the organization can meet its own information security requirements (Introduction 0.1).

To keep compatibility with other management system standards through the Annex SL high-level structure (Introduction 0.2).

Framework in Context

ISO/IEC 27002:2022 gives the controls that Annex A references and the implementation guidance behind them. ISO/IEC 27000:2026 gives the overview of the ISMS family, and ISO/IEC 27005:2022 gives guidance on managing information security risks, which ISO 31000 also informs (Notes to Clauses 4.1 and 6.1.3). Accredited certification bodies follow ISO/IEC 27006-1:2024, which replaced ISO/IEC 27006:2015 and supplements ISO/IEC 17021-1. The 2022 edition cancels and replaces the 2013 edition and incorporates its two technical corrigenda; ISO lists no revision under development.

Common Framework Mappings

ISO/IEC 27001:2022 is commonly mapped to the privacy, cloud and control frameworks that reuse its ISMS structure or its Annex A controls, so one set of evidence can serve several programs.

Mapped frameworks include:

CIS Critical Security Controls

ISO/IEC 27002

ISO/IEC 27003

ISO/IEC 27004

ISO/IEC 27017

ISO/IEC 27018

ISO/IEC 27701

NIST Cybersecurity Framework

NIST SP 800-53