ISO 27002 Update 2022 – Summary of Changes

Author: Tony McCutcheon – GRC Consultant

The Final Draft of ISO 27002 was released in late 2021 and the final version is expected to be released around 18th February 2022, with the release of the revised version of ISO 27001 following shortly thereafter.

Summary of Changes to ISO 27002

The title of ISO 27002 has been changed to incorporate more focus on cyber security and privacy.

There are not only significant changes to the structure and controls, but also changes relating to how to organise and use all controls. This will make it easier to integrate ISO 27002 controls with other similar security frameworks.

Here are some statistics, which compare the current version to the revised version:

Details 2013 2022 release
Chapters 14 (numbered 5 to 18) 4 (numbered 5 to 8)
Controls 114 93

 

Chapter No. Chapter Title No. of Controls
5 Organisational Controls 37
6 People Controls 8
7 Physical Controls 14
8 Technological Controls 34

The following table shows the entirely new controls:

Control No. Name
5.7 Threat intelligence
5.23 Information security for use of cloud services
5.30 ICT readiness for business continuity
7.4 Physical security monitoring
8.9 Configuration management
8.10 Information deletion
8.11 Data masking
8.12 Data leakage prevention
8.16 Monitoring activities
8.22 Web filtering
8.28 Secure coding

The following table shows a control which has been removed:

2013 Control Name
11.2.5 Removal of assets

There are two new elements of each control as follows:

  • Attributes
  • Purpose of applying the control

Organisations will typically have around two years to migrate to the revised standard, so after the revisions have been formally released, Dionach will post additional blogs containing more specific mapping comparisons between the revisions, as well as factors which organisations should consider in planning transition to the revised versions.

Contact Dionach to discuss how we can help you plan transition to the 2022 version of ISO 27001.

Find out how we can help with your cyber challenge

Please enter your contact details using the form below for a free, no obligation, quote and we will get back to you as soon as possible. Alternatively, you can email us directly at [email protected]