PECB ISO 28000 Transition cheat sheet

Clause architecture changed: 2007 used 4.1 General requirements, 4.2 Security management policy, 4.3 Risk assessment, 4.4 Security management objectives, 4.5 Implementation and operation, 4.6 Checking and corrective action, 4.7 Management review; 2022 adopts the harmonized structure: 4 Context of the organization, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement.

Scope wording shifted from a 'security management system' for risks in supply chains to a 'security management system' covering security of the organization's operations and supply chain; 2022 explicitly frames security as including physical, human, information/cyber, and organizational dimensions rather than physical supply-chain security alone.

2007 defined security as 'resistance to intentional, unauthorized acts designed to cause harm'; 2022 broadens this to protection against both intentional and unintentional events affecting the organization and its supply chain, so risk assessment must cover accidental and natural events as well as malicious acts.

2007 required a risk assessment in 4.3 focused on threats, vulnerabilities, and impacts; 2022 moves risk and opportunity determination into 6.1 (Planning), requiring identification of risks and opportunities, risk assessment, and documented risk treatment options - the risk process is now a planning input, not a standalone implementation clause.

2007 had 'security management objectives' in 4.4; 2022 places objectives in 6.2 with the standard SMART-style requirements (consistent with policy, measurable where practicable, monitored, communicated, updated) plus planning to achieve them - mirroring ISO 9001/14001/45001 clause 6.2.

2007 lacked an explicit 'Context of the organization' clause; 2022 clause 4 requires determining external and internal issues, interested parties and their requirements, and defining the scope of the security management system with documented information.

2007 'Implementation and operation' (4.5) bundled competence, training, communication, documentation, operational control, and emergency preparedness; 2022 splits these: competence/awareness/communication/documentation into clause 7 (Support), and operational planning, supply chain controls, and emergency preparedness into clause 8 (Operation).

2007 used 'Checking and corrective action' (4.6); 2022 renames and restructures this as 'Performance evaluation' (clause 9) covering monitoring, measurement, analysis, evaluation, internal audit, and management review, with corrective action moved to clause 10 (Improvement).

2007 had no explicit clause on 'Improvement'; 2022 clause 10 requires determining opportunities for improvement and implementing actions to meet objectives, with nonconformity and corrective action as a sub-clause - aligning with the Annex SL common text.

Transition planning sequence: (1) gap analysis against 2022 clause structure, (2) update scope and context, (3) revise risk methodology to cover unintentional/natural events and opportunities, (4) realign documented information, (5) update internal audit and management review, (6) verify effectiveness before certification audit.

Gap analysis must map each 2007 clause to its 2022 counterpart, identifying new requirements (clauses 4, 6.1 risk and opportunity, 6.2 objectives planning, 7.5 documented information, 8.1 operational planning and control, 9.1 monitoring/measurement, 10 improvement) and requirements that were dropped or relocated.

Context of the organization (clause 4) requires documented evidence of external and internal issues, interested parties (regulators, customers, insurers, employees, suppliers), and their relevant requirements - this is new work not present in 2007, so it typically drives the largest documentation gap.

Risk assessment in 2022 must be documented and include: identification of assets/processes, threats (intentional and unintentional), vulnerabilities, likelihood, consequences, and a risk evaluation with acceptance criteria; risk treatment options must be documented and their effectiveness evaluated, not just selected.

Leadership (clause 5) is stronger in 2022: top management must demonstrate accountability for the effectiveness of the security management system, ensure policy is compatible with strategic direction and context, integrate requirements into business processes, and ensure resources are available - evidence is needed beyond a signed policy.

Policy (5.2) must be documented and include commitments to satisfy applicable requirements and to continual improvement; objectives (6.2) must be documented, measurable where practicable, monitored, communicated, and updated - both are auditable documented information.

Supply chain controls: 2022 clause 8 explicitly requires control over externally provided processes, products, and services, including outsourced processes and suppliers; 2007 addressed this less explicitly within 4.5, so organizations must now show outsourced security controls and supplier evaluation criteria.

Performance evaluation (clause 9) requires defined monitoring and measurement: what is monitored, methods, when, and when results are analyzed and evaluated; internal audit programme must consider process importance, changes, and previous audit results - audit frequency must be justified, not fixed by rote.

Management review inputs and outputs are prescribed in 9.3: inputs include status of actions, changes in issues/needs, performance information, audit results, and risk/opportunity status; outputs must include decisions on improvement opportunities and resource needs - minutes must show these explicitly.

Transition timeline rule: certification bodies operating under accreditation rules (e.g., IAF/ISO 17021-1) typically allow a three-year transition period from publication; organizations must confirm the exact date with their certification body and plan the transition audit before expiry of the old certificate.

Clause architecture changed: 2007 used 4.1 General requirements, 4.2 Security management policy, 4.3 Risk assessment, 4.4 Security management objectives, 4.5 Implementation and operation, 4.6 Checking and corrective action, 4.7 Management review; 2022 adopts the harmonized structure: 4 Context of the organization, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement.

Scope wording shifted from a 'security management system' for risks in supply chains to a 'security management system' covering security of the organization's operations and supply chain; 2022 explicitly frames security as including physical, human, information/cyber, and organizational dimensions rather than physical supply-chain security alone.

2007 defined security as 'resistance to intentional, unauthorized acts designed to cause harm'; 2022 broadens this to protection against both intentional and unintentional events affecting the organization and its supply chain, so risk assessment must cover accidental and natural events as well as malicious acts.

2007 required a risk assessment in 4.3 focused on threats, vulnerabilities, and impacts; 2022 moves risk and opportunity determination into 6.1 (Planning), requiring identification of risks and opportunities, risk assessment, and documented risk treatment options - the risk process is now a planning input, not a standalone implementation clause.

2007 had 'security management objectives' in 4.4; 2022 places objectives in 6.2 with the standard SMART-style requirements (consistent with policy, measurable where practicable, monitored, communicated, updated) plus planning to achieve them - mirroring ISO 9001/14001/45001 clause 6.2.

2007 lacked an explicit 'Context of the organization' clause; 2022 clause 4 requires determining external and internal issues, interested parties and their requirements, and defining the scope of the security management system with documented information.

2007 'Implementation and operation' (4.5) bundled competence, training, communication, documentation, operational control, and emergency preparedness; 2022 splits these: competence/awareness/communication/documentation into clause 7 (Support), and operational planning, supply chain controls, and emergency preparedness into clause 8 (Operation).

2007 used 'Checking and corrective action' (4.6); 2022 renames and restructures this as 'Performance evaluation' (clause 9) covering monitoring, measurement, analysis, evaluation, internal audit, and management review, with corrective action moved to clause 10 (Improvement).

2007 had no explicit clause on 'Improvement'; 2022 clause 10 requires determining opportunities for improvement and implementing actions to meet objectives, with nonconformity and corrective action as a sub-clause - aligning with the Annex SL common text.

Transition planning sequence: (1) gap analysis against 2022 clause structure, (2) update scope and context, (3) revise risk methodology to cover unintentional/natural events and opportunities, (4) realign documented information, (5) update internal audit and management review, (6) verify effectiveness before certification audit.

Gap analysis must map each 2007 clause to its 2022 counterpart, identifying new requirements (clauses 4, 6.1 risk and opportunity, 6.2 objectives planning, 7.5 documented information, 8.1 operational planning and control, 9.1 monitoring/measurement, 10 improvement) and requirements that were dropped or relocated.

Context of the organization (clause 4) requires documented evidence of external and internal issues, interested parties (regulators, customers, insurers, employees, suppliers), and their relevant requirements - this is new work not present in 2007, so it typically drives the largest documentation gap.

Risk assessment in 2022 must be documented and include: identification of assets/processes, threats (intentional and unintentional), vulnerabilities, likelihood, consequences, and a risk evaluation with acceptance criteria; risk treatment options must be documented and their effectiveness evaluated, not just selected.

Leadership (clause 5) is stronger in 2022: top management must demonstrate accountability for the effectiveness of the security management system, ensure policy is compatible with strategic direction and context, integrate requirements into business processes, and ensure resources are available - evidence is needed beyond a signed policy.

Policy (5.2) must be documented and include commitments to satisfy applicable requirements and to continual improvement; objectives (6.2) must be documented, measurable where practicable, monitored, communicated, and updated - both are auditable documented information.

Supply chain controls: 2022 clause 8 explicitly requires control over externally provided processes, products, and services, including outsourced processes and suppliers; 2007 addressed this less explicitly within 4.5, so organizations must now show outsourced security controls and supplier evaluation criteria.

Performance evaluation (clause 9) requires defined monitoring and measurement: what is monitored, methods, when, and when results are analyzed and evaluated; internal audit programme must consider process importance, changes, and previous audit results - audit frequency must be justified, not fixed by rote.

Management review inputs and outputs are prescribed in 9.3: inputs include status of actions, changes in issues/needs, performance information, audit results, and risk/opportunity status; outputs must include decisions on improvement opportunities and resource needs - minutes must show these explicitly.

Transition timeline rule: certification bodies operating under accreditation rules (e.g., IAF/ISO 17021-1) typically allow a three-year transition period from publication; organizations must confirm the exact date with their certification body and plan the transition audit before expiry of the old certificate.

Clause architecture changed: 2007 used 4.1 General requirements, 4.2 Security management policy, 4.3 Risk assessment, 4.4 Security management objectives, 4.5 Implementation and operation, 4.6 Checking and corrective action, 4.7 Management review; 2022 adopts the harmonized structure: 4 Context of the organization, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement.

Scope wording shifted from a 'security management system' for risks in supply chains to a 'security management system' covering security of the organization's operations and supply chain; 2022 explicitly frames security as including physical, human, information/cyber, and organizational dimensions rather than physical supply-chain security alone.

2007 defined security as 'resistance to intentional, unauthorized acts designed to cause harm'; 2022 broadens this to protection against both intentional and unintentional events affecting the organization and its supply chain, so risk assessment must cover accidental and natural events as well as malicious acts.

2007 required a risk assessment in 4.3 focused on threats, vulnerabilities, and impacts; 2022 moves risk and opportunity determination into 6.1 (Planning), requiring identification of risks and opportunities, risk assessment, and documented risk treatment options - the risk process is now a planning input, not a standalone implementation clause.

2007 had 'security management objectives' in 4.4; 2022 places objectives in 6.2 with the standard SMART-style requirements (consistent with policy, measurable where practicable, monitored, communicated, updated) plus planning to achieve them - mirroring ISO 9001/14001/45001 clause 6.2.

2007 lacked an explicit 'Context of the organization' clause; 2022 clause 4 requires determining external and internal issues, interested parties and their requirements, and defining the scope of the security management system with documented information.

2007 'Implementation and operation' (4.5) bundled competence, training, communication, documentation, operational control, and emergency preparedness; 2022 splits these: competence/awareness/communication/documentation into clause 7 (Support), and operational planning, supply chain controls, and emergency preparedness into clause 8 (Operation).

2007 used 'Checking and corrective action' (4.6); 2022 renames and restructures this as 'Performance evaluation' (clause 9) covering monitoring, measurement, analysis, evaluation, internal audit, and management review, with corrective action moved to clause 10 (Improvement).

2007 had no explicit clause on 'Improvement'; 2022 clause 10 requires determining opportunities for improvement and implementing actions to meet objectives, with nonconformity and corrective action as a sub-clause - aligning with the Annex SL common text.

Transition planning sequence: (1) gap analysis against 2022 clause structure, (2) update scope and context, (3) revise risk methodology to cover unintentional/natural events and opportunities, (4) realign documented information, (5) update internal audit and management review, (6) verify effectiveness before certification audit.

Gap analysis must map each 2007 clause to its 2022 counterpart, identifying new requirements (clauses 4, 6.1 risk and opportunity, 6.2 objectives planning, 7.5 documented information, 8.1 operational planning and control, 9.1 monitoring/measurement, 10 improvement) and requirements that were dropped or relocated.

Context of the organization (clause 4) requires documented evidence of external and internal issues, interested parties (regulators, customers, insurers, employees, suppliers), and their relevant requirements - this is new work not present in 2007, so it typically drives the largest documentation gap.

Risk assessment in 2022 must be documented and include: identification of assets/processes, threats (intentional and unintentional), vulnerabilities, likelihood, consequences, and a risk evaluation with acceptance criteria; risk treatment options must be documented and their effectiveness evaluated, not just selected.

Leadership (clause 5) is stronger in 2022: top management must demonstrate accountability for the effectiveness of the security management system, ensure policy is compatible with strategic direction and context, integrate requirements into business processes, and ensure resources are available - evidence is needed beyond a signed policy.

Policy (5.2) must be documented and include commitments to satisfy applicable requirements and to continual improvement; objectives (6.2) must be documented, measurable where practicable, monitored, communicated, and updated - both are auditable documented information.

Supply chain controls: 2022 clause 8 explicitly requires control over externally provided processes, products, and services, including outsourced processes and suppliers; 2007 addressed this less explicitly within 4.5, so organizations must now show outsourced security controls and supplier evaluation criteria.

Performance evaluation (clause 9) requires defined monitoring and measurement: what is monitored, methods, when, and when results are analyzed and evaluated; internal audit programme must consider process importance, changes, and previous audit results - audit frequency must be justified, not fixed by rote.

Management review inputs and outputs are prescribed in 9.3: inputs include status of actions, changes in issues/needs, performance information, audit results, and risk/opportunity status; outputs must include decisions on improvement opportunities and resource needs - minutes must show these explicitly.

Transition timeline rule: certification bodies operating under accreditation rules (e.g., IAF/ISO 17021-1) typically allow a three-year transition period from publication; organizations must confirm the exact date with their certification body and plan the transition audit before expiry of the old certificate.

Clause architecture changed: 2007 used 4.1 General requirements, 4.2 Security management policy, 4.3 Risk assessment, 4.4 Security management objectives, 4.5 Implementation and operation, 4.6 Checking and corrective action, 4.7 Management review; 2022 adopts the harmonized structure: 4 Context of the organization, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement.

Scope wording shifted from a 'security management system' for risks in supply chains to a 'security management system' covering security of the organization's operations and supply chain; 2022 explicitly frames security as including physical, human, information/cyber, and organizational dimensions rather than physical supply-chain security alone.

2007 defined security as 'resistance to intentional, unauthorized acts designed to cause harm'; 2022 broadens this to protection against both intentional and unintentional events affecting the organization and its supply chain, so risk assessment must cover accidental and natural events as well as malicious acts.

2007 required a risk assessment in 4.3 focused on threats, vulnerabilities, and impacts; 2022 moves risk and opportunity determination into 6.1 (Planning), requiring identification of risks and opportunities, risk assessment, and documented risk treatment options - the risk process is now a planning input, not a standalone implementation clause.

2007 had 'security management objectives' in 4.4; 2022 places objectives in 6.2 with the standard SMART-style requirements (consistent with policy, measurable where practicable, monitored, communicated, updated) plus planning to achieve them - mirroring ISO 9001/14001/45001 clause 6.2.

2007 lacked an explicit 'Context of the organization' clause; 2022 clause 4 requires determining external and internal issues, interested parties and their requirements, and defining the scope of the security management system with documented information.

2007 'Implementation and operation' (4.5) bundled competence, training, communication, documentation, operational control, and emergency preparedness; 2022 splits these: competence/awareness/communication/documentation into clause 7 (Support), and operational planning, supply chain controls, and emergency preparedness into clause 8 (Operation).

2007 used 'Checking and corrective action' (4.6); 2022 renames and restructures this as 'Performance evaluation' (clause 9) covering monitoring, measurement, analysis, evaluation, internal audit, and management review, with corrective action moved to clause 10 (Improvement).

2007 had no explicit clause on 'Improvement'; 2022 clause 10 requires determining opportunities for improvement and implementing actions to meet objectives, with nonconformity and corrective action as a sub-clause - aligning with the Annex SL common text.

Transition planning sequence: (1) gap analysis against 2022 clause structure, (2) update scope and context, (3) revise risk methodology to cover unintentional/natural events and opportunities, (4) realign documented information, (5) update internal audit and management review, (6) verify effectiveness before certification audit.

Gap analysis must map each 2007 clause to its 2022 counterpart, identifying new requirements (clauses 4, 6.1 risk and opportunity, 6.2 objectives planning, 7.5 documented information, 8.1 operational planning and control, 9.1 monitoring/measurement, 10 improvement) and requirements that were dropped or relocated.

Context of the organization (clause 4) requires documented evidence of external and internal issues, interested parties (regulators, customers, insurers, employees, suppliers), and their relevant requirements - this is new work not present in 2007, so it typically drives the largest documentation gap.

Risk assessment in 2022 must be documented and include: identification of assets/processes, threats (intentional and unintentional), vulnerabilities, likelihood, consequences, and a risk evaluation with acceptance criteria; risk treatment options must be documented and their effectiveness evaluated, not just selected.

Leadership (clause 5) is stronger in 2022: top management must demonstrate accountability for the effectiveness of the security management system, ensure policy is compatible with strategic direction and context, integrate requirements into business processes, and ensure resources are available - evidence is needed beyond a signed policy.

Policy (5.2) must be documented and include commitments to satisfy applicable requirements and to continual improvement; objectives (6.2) must be documented, measurable where practicable, monitored, communicated, and updated - both are auditable documented information.

Supply chain controls: 2022 clause 8 explicitly requires control over externally provided processes, products, and services, including outsourced processes and suppliers; 2007 addressed this less explicitly within 4.5, so organizations must now show outsourced security controls and supplier evaluation criteria.

Performance evaluation (clause 9) requires defined monitoring and measurement: what is monitored, methods, when, and when results are analyzed and evaluated; internal audit programme must consider process importance, changes, and previous audit results - audit frequency must be justified, not fixed by rote.

Management review inputs and outputs are prescribed in 9.3: inputs include status of actions, changes in issues/needs, performance information, audit results, and risk/opportunity status; outputs must include decisions on improvement opportunities and resource needs - minutes must show these explicitly.

Transition timeline rule: certification bodies operating under accreditation rules (e.g., IAF/ISO 17021-1) typically allow a three-year transition period from publication; organizations must confirm the exact date with their certification body and plan the transition audit before expiry of the old certificate.

Clause architecture changed: 2007 used 4.1 General requirements, 4.2 Security management policy, 4.3 Risk assessment, 4.4 Security management objectives, 4.5 Implementation and operation, 4.6 Checking and corrective action, 4.7 Management review; 2022 adopts the harmonized structure: 4 Context of the organization, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement.

Scope wording shifted from a 'security management system' for risks in supply chains to a 'security management system' covering security of the organization's operations and supply chain; 2022 explicitly frames security as including physical, human, information/cyber, and organizational dimensions rather than physical supply-chain security alone.

2007 defined security as 'resistance to intentional, unauthorized acts designed to cause harm'; 2022 broadens this to protection against both intentional and unintentional events affecting the organization and its supply chain, so risk assessment must cover accidental and natural events as well as malicious acts.

2007 required a risk assessment in 4.3 focused on threats, vulnerabilities, and impacts; 2022 moves risk and opportunity determination into 6.1 (Planning), requiring identification of risks and opportunities, risk assessment, and documented risk treatment options - the risk process is now a planning input, not a standalone implementation clause.

2007 had 'security management objectives' in 4.4; 2022 places objectives in 6.2 with the standard SMART-style requirements (consistent with policy, measurable where practicable, monitored, communicated, updated) plus planning to achieve them - mirroring ISO 9001/14001/45001 clause 6.2.

2007 lacked an explicit 'Context of the organization' clause; 2022 clause 4 requires determining external and internal issues, interested parties and their requirements, and defining the scope of the security management system with documented information.

2007 'Implementation and operation' (4.5) bundled competence, training, communication, documentation, operational control, and emergency preparedness; 2022 splits these: competence/awareness/communication/documentation into clause 7 (Support), and operational planning, supply chain controls, and emergency preparedness into clause 8 (Operation).

2007 used 'Checking and corrective action' (4.6); 2022 renames and restructures this as 'Performance evaluation' (clause 9) covering monitoring, measurement, analysis, evaluation, internal audit, and management review, with corrective action moved to clause 10 (Improvement).

2007 had no explicit clause on 'Improvement'; 2022 clause 10 requires determining opportunities for improvement and implementing actions to meet objectives, with nonconformity and corrective action as a sub-clause - aligning with the Annex SL common text.

Transition planning sequence: (1) gap analysis against 2022 clause structure, (2) update scope and context, (3) revise risk methodology to cover unintentional/natural events and opportunities, (4) realign documented information, (5) update internal audit and management review, (6) verify effectiveness before certification audit.

Gap analysis must map each 2007 clause to its 2022 counterpart, identifying new requirements (clauses 4, 6.1 risk and opportunity, 6.2 objectives planning, 7.5 documented information, 8.1 operational planning and control, 9.1 monitoring/measurement, 10 improvement) and requirements that were dropped or relocated.

Context of the organization (clause 4) requires documented evidence of external and internal issues, interested parties (regulators, customers, insurers, employees, suppliers), and their relevant requirements - this is new work not present in 2007, so it typically drives the largest documentation gap.

Risk assessment in 2022 must be documented and include: identification of assets/processes, threats (intentional and unintentional), vulnerabilities, likelihood, consequences, and a risk evaluation with acceptance criteria; risk treatment options must be documented and their effectiveness evaluated, not just selected.

Leadership (clause 5) is stronger in 2022: top management must demonstrate accountability for the effectiveness of the security management system, ensure policy is compatible with strategic direction and context, integrate requirements into business processes, and ensure resources are available - evidence is needed beyond a signed policy.

Policy (5.2) must be documented and include commitments to satisfy applicable requirements and to continual improvement; objectives (6.2) must be documented, measurable where practicable, monitored, communicated, and updated - both are auditable documented information.

Supply chain controls: 2022 clause 8 explicitly requires control over externally provided processes, products, and services, including outsourced processes and suppliers; 2007 addressed this less explicitly within 4.5, so organizations must now show outsourced security controls and supplier evaluation criteria.

Performance evaluation (clause 9) requires defined monitoring and measurement: what is monitored, methods, when, and when results are analyzed and evaluated; internal audit programme must consider process importance, changes, and previous audit results - audit frequency must be justified, not fixed by rote.

Management review inputs and outputs are prescribed in 9.3: inputs include status of actions, changes in issues/needs, performance information, audit results, and risk/opportunity status; outputs must include decisions on improvement opportunities and resource needs - minutes must show these explicitly.

Transition timeline rule: certification bodies operating under accreditation rules (e.g., IAF/ISO 17021-1) typically allow a three-year transition period from publication; organizations must confirm the exact date with their certification body and plan the transition audit before expiry of the old certificate.

Clause architecture changed: 2007 used 4.1 General requirements, 4.2 Security management policy, 4.3 Risk assessment, 4.4 Security management objectives, 4.5 Implementation and operation, 4.6 Checking and corrective action, 4.7 Management review; 2022 adopts the harmonized structure: 4 Context of the organization, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement.

Scope wording shifted from a 'security management system' for risks in supply chains to a 'security management system' covering security of the organization's operations and supply chain; 2022 explicitly frames security as including physical, human, information/cyber, and organizational dimensions rather than physical supply-chain security alone.

2007 defined security as 'resistance to intentional, unauthorized acts designed to cause harm'; 2022 broadens this to protection against both intentional and unintentional events affecting the organization and its supply chain, so risk assessment must cover accidental and natural events as well as malicious acts.

2007 required a risk assessment in 4.3 focused on threats, vulnerabilities, and impacts; 2022 moves risk and opportunity determination into 6.1 (Planning), requiring identification of risks and opportunities, risk assessment, and documented risk treatment options - the risk process is now a planning input, not a standalone implementation clause.

2007 had 'security management objectives' in 4.4; 2022 places objectives in 6.2 with the standard SMART-style requirements (consistent with policy, measurable where practicable, monitored, communicated, updated) plus planning to achieve them - mirroring ISO 9001/14001/45001 clause 6.2.

2007 lacked an explicit 'Context of the organization' clause; 2022 clause 4 requires determining external and internal issues, interested parties and their requirements, and defining the scope of the security management system with documented information.

2007 'Implementation and operation' (4.5) bundled competence, training, communication, documentation, operational control, and emergency preparedness; 2022 splits these: competence/awareness/communication/documentation into clause 7 (Support), and operational planning, supply chain controls, and emergency preparedness into clause 8 (Operation).

2007 used 'Checking and corrective action' (4.6); 2022 renames and restructures this as 'Performance evaluation' (clause 9) covering monitoring, measurement, analysis, evaluation, internal audit, and management review, with corrective action moved to clause 10 (Improvement).

2007 had no explicit clause on 'Improvement'; 2022 clause 10 requires determining opportunities for improvement and implementing actions to meet objectives, with nonconformity and corrective action as a sub-clause - aligning with the Annex SL common text.

Transition planning sequence: (1) gap analysis against 2022 clause structure, (2) update scope and context, (3) revise risk methodology to cover unintentional/natural events and opportunities, (4) realign documented information, (5) update internal audit and management review, (6) verify effectiveness before certification audit.

Gap analysis must map each 2007 clause to its 2022 counterpart, identifying new requirements (clauses 4, 6.1 risk and opportunity, 6.2 objectives planning, 7.5 documented information, 8.1 operational planning and control, 9.1 monitoring/measurement, 10 improvement) and requirements that were dropped or relocated.

Context of the organization (clause 4) requires documented evidence of external and internal issues, interested parties (regulators, customers, insurers, employees, suppliers), and their relevant requirements - this is new work not present in 2007, so it typically drives the largest documentation gap.

Risk assessment in 2022 must be documented and include: identification of assets/processes, threats (intentional and unintentional), vulnerabilities, likelihood, consequences, and a risk evaluation with acceptance criteria; risk treatment options must be documented and their effectiveness evaluated, not just selected.

Leadership (clause 5) is stronger in 2022: top management must demonstrate accountability for the effectiveness of the security management system, ensure policy is compatible with strategic direction and context, integrate requirements into business processes, and ensure resources are available - evidence is needed beyond a signed policy.

Policy (5.2) must be documented and include commitments to satisfy applicable requirements and to continual improvement; objectives (6.2) must be documented, measurable where practicable, monitored, communicated, and updated - both are auditable documented information.

Supply chain controls: 2022 clause 8 explicitly requires control over externally provided processes, products, and services, including outsourced processes and suppliers; 2007 addressed this less explicitly within 4.5, so organizations must now show outsourced security controls and supplier evaluation criteria.

Performance evaluation (clause 9) requires defined monitoring and measurement: what is monitored, methods, when, and when results are analyzed and evaluated; internal audit programme must consider process importance, changes, and previous audit results - audit frequency must be justified, not fixed by rote.

Management review inputs and outputs are prescribed in 9.3: inputs include status of actions, changes in issues/needs, performance information, audit results, and risk/opportunity status; outputs must include decisions on improvement opportunities and resource needs - minutes must show these explicitly.

Transition timeline rule: certification bodies operating under accreditation rules (e.g., IAF/ISO 17021-1) typically allow a three-year transition period from publication; organizations must confirm the exact date with their certification body and plan the transition audit before expiry of the old certificate.