In the meantime, threats to information security continue to grow; hopefully you can see them on the horizon, but many companies can find it really easy to start lagging behind. Unfortunately, if you are still working to the 2013 edition of ISO 27001 then you’re now behind the curve.

Its easy to put off the transition; it has been so far anyway. But this will absolutely create unnecessary stress and potential complications down the line for you and your staff. The new updates to the standard introduce a number of controls that can be surprising time-sinks if you aren’t familiar with them. They can also end up costing a significant amount of time and money to implement if you aren’t careful.

The problem is, the longer you wait and mull this over, the greater your potential exposure is to emerging security and compliance threats. And, the greater number of resources and time you’ll need at the last minute to get it sorted. ISO 27001 certification isn’t just a tick-box exercise giving you a badge of compliance. It’s a commitment to proactive cybersecurity. If you fail to transition in time, you risk having your certificate revoked, this can impact existing client trust and even your ability to secure new contracts and customers.

What’s Changed in ISO 27001:2022?

The 2022 edition introduces some key updates that make the framework more relevant to today’s security landscape, some of these changes are quite crucial and can be surprisingly challenging:

1. Annex A, the Statement of Applicability (SOA) has been rejigged

Definitely the most significant update out of the lot, is the restructuring of Annex A, this now includes 93 controls (down from 114). Several controls have merged, some have been refined, and the overall structure of the SOA has been re-organised into four key themes:

• People
• Organisational
• Technological
• Physical

This restructuring is supposedly meant to make it easier to understand an implement the security measures ‘making implementation more effective’ but we’ll have to wait and see if it’s really that groundbreaking.

2. New Security Controls (As part of the SOA update)

The 2022 update introduces 11 new controls that address modern cybersecurity challenges. These cover:

• Threat Intelligence – Encouraging organizations to proactively collect and use threat intelligence.

• Information security for use of cloud services – Providing specific guidance on securing cloud-based environments.

• ICT Readiness for business continuity – Ensuring IT services are resilient against disruptions.

• Physical Security Monitoring – brings a more simplified but definitive stance on physical security than the previous edition.

• Configuration Management – Enhancing security through better control of system configurations.

• Information Deletion – introduces the concept from GDPR that you can no longer keep data forever, as much as your inner dragon likes hoarding gold; you’re no longer along to emulate Smaug in Erebor (but with data!)

• Data Masking – introduces the concept that if people don’t need to know specific info to do their job, then they shouldn’t be able to see it. A simple principle in concept but can become complicated when looking at ways to apply it in a meaningful way.

• Data Leakage Prevention – Strengthening data protection measures.

• Monitoring Activities – Adds a bit of Big Brother seasoning to the standard to make sure your networks, systems and applications aren’t going haywire with “anomalous behaviour”.

• Web Filtering – makes it a requirement for you to make sure your staff aren’t using their web browsers to access anywhere dumb during work hours / from a work device.

• Secure Coding – this makes industry best practice essentially a requirement. This covers things like code reviews, peer checks before publishing, making sure you apply Least Privilege methodology etc.

3. Enhanced Focus on Risk Management

The new standard places a stronger emphasis on risk-based thinking. Companies must ensure their ISMS is not just a static set of policies but that they are actually used, this also means making sure these policies are efficient and appropriate to the task.

4. More Flexibility in Implementation

ISO 27001:2022 does however allow for a more tailored implementation of controls based on an organisation’s specific risk environment. This should make compliance more efficient, but it also means companies must take a fresh look at how their security measures align with the new framework.

How to Get Started with the Transition

Switching to ISO 27001:2022 doesn’t have to be overwhelming. Here are some tips to make it more manageable:

1. You’ll need Leadership “Buy-In” so make sure they’re involved

All businesses need support from the leadership team when implementing new controls, policies, procedures or anything that disrupts the norm (sometimes even a new kettle needs approval). Without “buy-in” from leadership you may struggle with the resources you need to prioritise transitioning the system and making sure everyone understands and adheres to it.

2. Perform a Gap Analysis (if you want)

If you want to do the transition yourself, then you’ll need to assess your current ISMS against the new requirements; this is so you can identify any gaps and areas that need updating. This should then help you to create a clear action plan for the transition.

3. Update your Policies and Procedures

Many of the new controls require policy updates or even new policies writing from scratch. This is especially prevalent in areas like cloud security, threat intelligence and configuration management. You’ll need to make sure your documentation reflects the latest best practices too. (This is something we can help you do if you don’t have the time or knowledge).

4. Train Your Team

Your staff must understand the changes and their implications. So, you’ll need to provide training on the new controls, risk management approach, and updated compliance requirements. People will need to understand these changes and how they impact the day-to-day operations of the business.

5. Schedule Your Certification Audit

I’ve written this blog on the assumption you’re already certified to ISO 27001:2013, (if that’s not the case then I atleast hope you’ve enjoyed this read! And you should build your system around the 2022 edition from scratch instead of jumping through these hoops).

The certification body I imagine will have also been hounding you by this point; but you need to get booked in with them for your transition and tell them it’s a transition audit; they will undoubtedly want to add an extra day or more to your visit in order to transition you.

I had one customer who forgot to mention they were transitioning to the auditing body so when we were sat down infront of the auditor and I handed over our updated docs he was a little dumb struck; after a quick panic call to his head office we ended up managing to transition that visit but it was only because they were able to switch the auditors ‘office day’ to another assessment day.

They would have been well within their rights to have cancelled and rescheduled the visit along with slapping our customer with an extra charge for the issue had we not been so lucky. SO, plan your transition audit well in advance, this will also help avoid last-minute bottlenecks from the limited supply of 27001 auditors that the cert bodies have.

Final Thoughts

Most cert bodies like to see at least 3 months of evidence of a new system being in place; which means, if you want to show them evidence of your new system, that 7 months to deadline drops to 4 months from now (to get your system updated and audited).

You’ve also got to consider your staff and the availability of the auditors to come and do the transition. With the Summer Holidays and Easter half-term happening, this could make it even more strategically challenging to transition before the deadline.

Ultimately, this deadline for transitioning isn’t as far off as it seems. It’s also not optional – it’s necessary to maintain your existing certification. Companies that delay risk operational disruptions, security vulnerabilities, and compliance failures.

Getting started now will save you from even more last-minute stress. Making the switch sooner means your compliance efforts will be all-round smoother, and you’ll be able to catch up to those early birds already standing proud with their 2022 certs pinned to their chests.

More importantly, waiting and leaving it much longer could mean a rushed, ineffective transition that leaves your organization exposed.

Cyber Essentials and ISO 27001, what are they and what are the differences?

Cyber Essentials and ISO27001 work in tandem to ensure that sensitive data, be it from a client, a supplier, or your own internal records, is handled with appropriate levels of control and protection. They provide a framework for identifying and mitigating risks, safeguarding against the significant dangers of operating a business in today’s market, and ensuring that should you be attacked you have effective protection to ensure the continuity of your company.

Do you understand the level of security risk you are carrying?

Time and Priorities

A good starting point is to identify what data you hold, where you hold it and how its accessed, and that’s not always obvious.

A UK business preparing for a government tender asked me to complete a quick third-party assessment of their information security. This is a good foundational task to complete and, in this case, we found some critical information our customer didn’t know. One of the primary services they use is cloud based, but as it turned out the cloud service provider was using data centres outside of the UK/EU economic area. Data centres operating outside of this area are not obligated to conform with Data protection laws in the UK and some can even be required to share access to your data with the government of their host country. Our customer, completely unaware of this would have struggled to win anything to do with UK government work whilst using this overseas hosted service. Sometimes its worthwhile reading the small print and completing detailed due diligence!

Cyber Security and Information/Data Control are almost certainly the biggest threats to your business currently, in terms of direct financial loss, loss of reputation, status and significant liability claims.

The cost of implementing the controls recommended by security experts across the globe can vary drastically; especially if you don’t have the time to understand what you’re implementing.
We’re here to help you control these costs and implement effective controls.

Getting independently certified is a great way to make sure these controls are effective but this can also cost you; especially if they aren’t a reputable accredited body. But we can liaise with bodies to get you the most competitive rates.

Ultimately, at the end of the day, failure to implement proper information security could destroy your reputation, collapse your business, severely damage the future of you and your employees and could result in significant fines and lawsuits.

Are the risks of rolling that dice everyday really worth it? Get some piece of mind with a quick quote from us, we reckon its worth a look at least.

Conclusion

2024 saw a huge growth in businesses being attacked. This is certain to continue into 2025. It’s getting easier and easier to attack businesses and leaps forward in AI could open the floodgates. Start the year with your eyes looking forwards and let us help.

We have over 50 years’ experience of working with ISO systems covering Information Security, Quality and many others. We can deliver effective and compliant systems built for your business needs, quickly and efficiently so give us a try.

Early in 2024, now only a few months away, you won’t be able to have your information security system certified to ISO 27001, 2013. Early in 2025, if you have a certification to ISO 27001, 2013 you’ll have to update your systems to the new 2022 version.

Experience

Reliability

Flexibility

So, when you are up to your neck in finding new customers, looking after those you already have, making sure your suppliers are delivering what you want, when you want it, keeping your eye on the competition and industry developments, and making sure employees are doing what you employ them to do, how do you also keep track of your responsibilities to the environment, health and safety and keep the business legally compliant?

ISO standards can help manage a business!

Originally quite bureaucratic and very difficult to follow, more recently these standards have been simplified and brought into a standard format. This means that the structure and format of the standards are almost identical, its only how you address the risks relating to the individual subjects (quality, environment, health and safety, information security etc) which change.

This means that in developing a scheme to address one standard, its relatively easy to then add the risks and controls to another subject, even if you don’t go for certification against that standard. Hence, an existing ISO 9001 system can easily be used to manage environmental, health and safety and information security, giving you compliance to ISO 14001, ISO 45001 and ISO 27001 relatively easily. Such systems are known as “Integrated Systems” and are a very cost-effective way for a company to keep aware and up to date with compliance in many different fields.

How Can we Help?

If you are interested in an Integrated System written around your unique business, but compliant with ISO 9001, 14001, 45001, 27001 or any of the growing list of management system standards why not drop us a line and find out how a concise, business focussed system can help your company?

If you need assistance with any element of ISO certification or accreditation, please feel free to contact us by going here.

As we’ve seen while helping businesses to gain certification over the last few years, the 2013 version of ISO 27001 is becoming increasingly out of touch with the technology in common use today. It was written when companies were buying servers and 3.5” disks, needed extensive backup facilities and were just becoming aware of the dangers from virus’s, Trojans and ransomware. As the majority of business moves to cloud-based solutions many parts of this version of the standard are becoming redundant.

So why hasn’t it been updated?

Well, international standards are supposed to be updated every six years to keep them relevant, so ISO 27001 should have been updated in 2019. This hasn’t happened, technological change, a worldwide pandemic and its crippling impact probably have something to do with it.

But ISO 27002, titled “Information security, cybersecurity and privacy protection. Information security controls” has been updated. This isn’t a standard you can be certified against; its content is meant to help businesses to select the security controls they need to implement in their business environment.

Many organisations see ISO 27001 implementation as probably difficult, slow and expensive. Sadly, some ISO Consultants are quite happy for this illusion to remain. The clock ticks, the documents get bigger, and the fees roll in, as I’ve discussed here (where I also give outline costs and time scales)

Of course, information security is a serious business, and requires focus. However, it is often made over-complex. ISO certification seems hard to attain, difficult to understand, and disengaged from normal business life.

Therefore, in the pursuit of clarity and simplicity, I set out to create a ten-point guide. It’s not “The Answer”, but a beginning, a framework of “how”, rather than “what”. And. of course, it’s always best to discuss these things face-to-face.

So, some basics:

3 – “Where Are You? Where Do You Need To Be?”

Examine your current information security systems with potential ISO 27001 demands. It is quite possible that you are already using parts of “best practice” already. Reinventing the wheel is not required.

A good ISO 27001 system will be designed around your current situation. Companies are often severely challenged by the prospect of ISO Certification. However, they discover that they are using some of the component principles already.

6 – Have a Plan

Roles, responsibilities and timescales need to be made clear. Add too many team members, and they will generate more heat than light. Implementation is unlikely to go smoothly. Adjustments are always necessary.

The key issue is to progress and not duplicate activity. A framework and objectives will save much time and energy. Most importantly, Getting started is good. And often the hardest part.

9 – Get Some “Buy In”

Raise Some Champions. Share that ISO 27001 should be “done with” not “done to” staff. Getting them to train as internal auditors is a major step. The most vocal “champions” will be the early adopters. Sadly, your IT team is not all-seeing and all-knowing. A wider company team will have insights from their daily work that only they themselves could ever discover.

ISO 27001 needs to escape the IT department at the first opportunity in order to be truly effective.

“How Much Does ISO 27001 Certification Cost?” I’m asked this frequently. Here, I won’t give you precise figures, but some important pointers as to why prices might vary, and what to avoid. We offer a different approach.

On The Other Hand…

Meanwhile, I recently achieved ISO 27001 certification for a local business for less than £6000. This included certification by a leading independent body. Was this “ISO 27001-lite”? No. Did I skip over anything? No. So what was different?

Smarter Versus Wordier

Furthermore, we “work smart”. Our senior consultant was a former auditor with a major certification body. This is the equivalent of your driving instructor being a former driving test examiner. We understand ISO systems and certification requirements from the auditor’s side. This means that we create lean and bespoke systems. Furthermore, We do not create tonnes of documents, hoping that the auditor will be impressed. In a previous corporate quality role, our senior consultant had to read systems by many “world-leading companies”. Many were infected with heavily documented procedures and systems which appear to have been generated by consultants on a “paid by the number of words” basis.

Less is More. It Also Works.

Weighty and pointless procedures waste time, and hence money. Also, concise, easy-to-understand ISO 27001 Certification documents tend to win favour with employees, and have more chance of being followed. Additionally, simple and effective systems have less risk of potential audit failure.

Next?

How Much Does ISO 27001 Certification Cost? Agreed, we haven’t really answered the “cost” question in hard figures ? Our costs will be based on your company, which is, of course, unique among companies.

Like a bespoke suit, it needs to fit but measurements must be taken. This leads me to the next stage – if you like the sound of our approach, maybe it’s time to get together, find out about your enterprise, and come up with a solution. We would love to hear from you.