Understanding, Interpreting, and Planning the Implementation of ISO 28000:2022 Changes
This domain tests transition planning: how to interpret the 2022 requirements, convert them into a credible implementation plan, and produce evidence that satisfies a certification body.
Interpretation method
Compare the 2022 clauses against your existing 2007 system and classify each gap as new, moved, removed, or renamed. Do not assume one-to-one mapping. Establish what clause 4 requires for your organization: external and internal issues, interested parties and their requirements, and the boundary of the security management system. Then confirm how clause 6 risk and opportunity actions connect to clause 8 operational controls and clause 9 performance evaluation.
Planning elements
A credible transition plan includes a gap analysis, an owner and timeline, updates to policy and objectives, a revised risk methodology covering threats, vulnerabilities, and opportunities, documented information changes, competence and awareness activities, communication arrangements, internal audit against the 2022 clauses, management review, and corrective action. Plan certification body communication early. If you integrate with ISO 9001 or ISO 27001, use the shared Annex SL structure but keep security-specific evidence distinct.
Worked example
A logistics company holds a 2007 certificate expiring in 12 months. Its gap analysis finds no context or interested-party analysis, a risk register that covers threats only, a policy naming a management representative, procedures referring to “records,” no communication process, and internal audit checklists built on clause 4.6. The plan sequences three months to define context, interested parties, and a revised risk method; two months to revise policy, objectives, and documented information and to train staff; one month for an internal audit and management review; then the transition audit. The reasoning is that new clauses create new evidence needs, so rewriting the manual alone would fail.
Traps that cost marks
Do not treat transition as a documentation exercise. Do not ignore interested parties or opportunities. Do not keep the management representative as a stated requirement. Do not audit only old clause numbers. Do not forget competence, awareness, and communication evidence.
Key takeaway
Build the plan around new evidence, not renamed documents.