PECB ISO 28000 Transition flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

2007 clause 4.3 Risk assessment

In ISO 28000:2007, a standalone clause requiring identification of security threats, vulnerabilities, likelihood, and consequences, and selection of risk treatment measures. In 2022 this content is relocated to clause 6.1 Planning and expanded to include opportunities.

2022 clause 4 Context

New in ISO 28000:2022: the organization must determine external and internal issues, identify interested parties and their relevant requirements, and define the scope of the security management system, all supported by documented information.

Harmonized structure adoption

ISO 28000:2022 follows the common management system clause structure used by ISO 9001, 14001, and 45001, replacing the 2007 layout of clauses 4.1 through 4.7. This enables integrated management system implementation.

Security definition broadened

ISO 28000:2007 framed security as resistance to intentional unauthorized acts causing harm. The 2022 edition broadens coverage to protection against unintentional and natural events affecting the organization and its supply chain as well.

2007 clause 4.5 Implementation

The 2007 clause bundling competence, training, communication, documentation, operational control, and emergency preparedness. In 2022 these split between clause 7 Support and clause 8 Operation.

2007 clause 4.6 Checking

The 2007 clause covering monitoring, internal audit, management review, and corrective action. In 2022 it becomes clause 9 Performance evaluation, with corrective action moved to clause 10 Improvement.

Clause 10 Improvement added

ISO 28000:2007 had no dedicated improvement clause. ISO 28000:2022 clause 10 requires determining improvement opportunities, implementing actions, and handling nonconformity and corrective action.

2007 clause 4.4 Objectives

In ISO 28000:2007, security management objectives appeared in clause 4.4. In 2022 objectives move to clause 6.2 with added requirements: measurable where practicable, monitored, communicated, and updated.

Risk and opportunity in 6.1

ISO 28000:2022 clause 6.1 requires determining risks and opportunities relevant to the security management system, assessing them, and documenting risk treatment options and their effectiveness evaluation.

Supply chain in clause 8

ISO 28000:2022 clause 8 explicitly requires control of externally provided processes, products, and services, including outsourced processes and suppliers, making supply chain security controls a directly auditable requirement.

2007 clause 4.7 Management review

In ISO 28000:2007, management review sat under clause 4.7 as a short requirement. ISO 28000:2022 clause 9.3 prescribes specific review inputs and outputs that must be documented.

Documented information terminology

ISO 28000:2022 replaces the 2007 terms documents and records with documented information, meaning information that must be controlled and maintained, and evidence of results achieved that must be retained.

Leadership accountability requirement

ISO 28000:2022 clause 5 requires top management to demonstrate accountability for the effectiveness of the security management system, ensure policy aligns with strategic direction, and integrate requirements into business processes.

Scope of 2022 standard

ISO 28000:2022 specifies requirements for a security management system covering the organization's operations and supply chain, addressing physical, human, information, and organizational security rather than physical supply chain security alone.

Emergency preparedness relocation

In ISO 28000:2007, emergency preparedness sat within clause 4.5. In ISO 28000:2022 it is addressed under clause 8 Operation, requiring planned response to potential emergency situations and periodic testing.

2007 to 2022 clause mapping

A gap analysis technique: list each 2007 clause, identify its 2022 counterpart, and flag content that is new, relocated, expanded, or removed, so transition effort is directed at genuine gaps.

Transition planning sequence

A practical order for ISO 28000 transition: perform gap analysis, update scope and context, revise risk methodology, realign documented information, update audit and management review, then verify effectiveness before the certification audit.

Context documentation gap

Because ISO 28000:2007 had no context clause, most organizations must create new documented evidence of external and internal issues, interested parties, and their requirements to satisfy ISO 28000:2022 clause 4.

Risk methodology revision

Transition action: extend the risk assessment method so it covers unintentional and natural events as well as malicious acts, adds opportunities, and documents treatment options with acceptance criteria and effectiveness evaluation.

Objectives must be documented

Under ISO 28000:2022 clause 6.2, security objectives must be documented, consistent with policy, measurable where practicable, monitored, communicated, and updated, with plans describing what will be done, resources, and timelines.

Monitoring and measurement plan

ISO 28000:2022 clause 9.1 requires defining what is monitored, the methods used, when monitoring occurs, and when results are analyzed and evaluated, with documented evidence retained as performance evaluation input.

Internal audit programme criteria

ISO 28000:2022 clause 9.2 requires the audit programme to consider process importance, changes affecting the organization, and previous audit results, so a fixed annual schedule without justification is insufficient.

Management review inputs

ISO 28000:2022 clause 9.3 inputs include status of prior actions, changes in issues and interested party needs, security performance, audit results, and risk and opportunity status, all of which must appear in review records.

Management review outputs

ISO 28000:2022 clause 9.3 requires review outputs to include decisions on improvement opportunities and on any need for changes to the security management system, including resource needs.

Supplier control evidence

Transition action: because ISO 28000:2022 clause 8 addresses externally provided processes explicitly, organizations must show supplier security criteria, evaluation records, and controls over outsourced processes.

Policy content requirements

ISO 28000:2022 clause 5.2 requires a documented security policy appropriate to purpose and context, including commitments to satisfy applicable requirements and to continual improvement of the management system.

Integration into business processes

ISO 28000:2022 clause 5 requires top management to ensure security requirements are integrated into the organization's business processes, so a standalone security manual without process linkage is insufficient evidence.

Competence evidence under clause 7

ISO 28000:2022 clause 7 requires determining necessary competence, ensuring persons are competent, and retaining documented evidence of competence, separate from the 2007 practice of grouping training under implementation.

Transition audit preparation

Before the transition audit, organizations should run a full internal audit against all ISO 28000:2022 clauses, close identified gaps, and hold a management review covering the new clause 9.3 inputs and outputs.

Certification transition period

Accredited certification bodies generally allow a defined transition window after publication of a revised standard, commonly three years; organizations should confirm the exact deadline with their certification body and schedule accordingly.

Documented information control

ISO 28000:2022 clause 7.5 requires documented information to be available, protected, and controlled, covering creation, updating, distribution, access, retention, and disposition, replacing the 2007 documents and records split.

Improvement opportunities in transition

ISO 28000:2022 clause 10 requires determining and selecting opportunities for improvement and implementing actions; transition plans should show how improvement is driven, not only how nonconformities are corrected.