Building an ISO 27001 ISMS: the implementation plan, policies, what changed in the 2022 edition and its new controls, and running ISO 27001 alongside other management system standards.
A practical ISO 27001 implementation plan for the work before a certification body is involved: context and scope, risk assessment and treatment, Statement of Applicability, controls, internal audit and management review, plus the guidance standards an implementer can use.
Which policies ISO 27001 requires: the top-level policy under clause 5.2, topic-specific policies under A.5.1, approval, communication and acknowledgment, review intervals, and how NIST CSF 2.0 references the same requirements.
What changed between ISO 27001:2013 and ISO 27001:2022: the harmonized structure, Annex A cut from 114 to 93 controls in four themes, new, merged and updated controls, control attributes in ISO/IEC 27002:2022, and the transition deadline that has passed.
The 11 controls added to Annex A in 2022 and what each asks for: threat intelligence, cloud services, ICT readiness, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring, web filtering and secure coding.
Running ISO 27001 with other management system standards such as ISO 9001 and ISO 22301: the shared Annex SL structure, the A.5.30 ICT readiness link to business continuity, integrated audits and how certification bodies set and reduce audit time.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.