Differences Between the Main Clauses of ISO 28000:2022 and ISO 28000:2007
This domain tests whether you can identify structural and substantive changes between the 2007 specification and the 2022 requirements standard. Exam questions commonly ask where a concept now sits, which requirement disappeared, or how terminology changed.
Structural shift
ISO 28000:2007 used clauses 4.1 to 4.8: general requirements, security management policy, risk assessment, objectives and targets, implementation and operation, checking and corrective action, management review, and continual improvement. ISO 28000:2022 adopts the Annex SL high-level structure with clauses 4 to 10: context of the organization, leadership, planning, support, operation, performance evaluation, and improvement. The old policy clause maps broadly to 5.2; old risk assessment supports 6.1 and operational risk work; old objectives map to 6.2; implementation and operation spread across 7 and 8; checking maps to 9; continual improvement maps to 10.
New and strengthened content
Clause 4 introduces context of the organization, interested parties, and scope. Clause 5 strengthens leadership and commitment and removes the management representative requirement. Clause 6 adds actions to address risks and opportunities. Clause 7 covers resources, competence, awareness, communication, and documented information. Clause 8 covers operational planning and control. Clause 9 covers monitoring, internal audit, and management review. Clause 10 covers nonconformity, corrective action, and continual improvement. Preventive action is no longer a separate requirement; risk-based thinking replaces it. “Documented information” replaces “documents” and “records.”
Worked example
A 2007-certified organization asks where its “management representative” clause moved. The correct answer is that it did not move: ISO 28000:2022 does not require a management representative. Top management must still ensure responsibilities and authorities are assigned under 5.3, but a single named representative is not a conformity requirement. Keeping one as an internal role is acceptable but cannot be presented as a mandatory 2022 clause.
Traps that cost marks
Do not map every 2007 clause one-to-one. Do not claim preventive action remains mandatory. Do not treat “documented information” as a cosmetic rewording. Do not limit the 2022 scope to supply chain only; the title and scope broaden to security and resilience for organizations generally.