PECB ISO 28000 Transition study plan

Map the clause structure of ISO 28000:2007 against ISO 28000:2022 side by side, listing which clauses were retained, renamed, merged, or removed.

Define the 2022 core vocabulary in your own words: security management system, security risk, interested party, context of the organization, and documented information.

Identify the harmonized structure (Annex SL) clauses 4 through 10 in the 2022 edition and note where each 2007 requirement now sits.

Explain in writing why the 2007 preventive-action clause disappeared and where risk-based thinking replaced it.

Analyze the new Clause 4 requirements on context, interested parties, and scope determination, contrasting them with 2007's narrower scope statement.

Differentiate leadership obligations in 2022 (commitment, policy, roles) from the 2007 management-commitment wording.

Compare planning requirements: how 2022 treats risks and opportunities, security risk assessment, and security risk treatment versus 2007's risk assessment and preventive action.

Draft a short comparison of the 2022 security policy expectations against the 2007 policy clause.

Contrast 2007's resource, competence, and awareness clauses with the expanded 2022 Clause 7 requirements on communication and documented information.

Distinguish 'documented information' from 2007's 'documents' and 'records', and state the practical implications for control and retention.

Compare operational planning and control clauses, noting new emphasis on outsourced processes and change control.

Explain the 2022 performance evaluation and improvement clauses, including internal audit, management review, and incident/nonconformity handling.

Consolidate all identified differences into a single prioritized gap list ranked by implementation effort and risk.

Build a set of 40 original practice questions on clause differences and answer them under timed conditions.

Explain how the shift from a security-centric model to a broader organizational resilience framing affects scope decisions.

Identify which 2007 artifacts (manual, procedures, records) can be reused and which must be rewritten.

Draft a transition project plan with phases, owners, dependencies, and a realistic timeline for moving from the 2007 system to 2022.

Perform a context-of-the-organization analysis for a sample organization, identifying internal and external issues and interested parties with their requirements.

Define the scope of the security management system for that sample organization and justify exclusions.

Conduct a security risk assessment using a documented methodology and record the results in a risk register.

Write a security policy aligned with 2022 requirements and set measurable security objectives with plans to achieve them.

Design the documented information architecture: what must be created, updated, controlled, and retained under the 2022 standard.

Plan the communication processes required by Clause 7, specifying what, when, with whom, and how.

Map competence and awareness needs to new or changed roles introduced by the transition.

Build an internal audit programme that covers all 2022 clauses, including the newly added context and interested-party requirements.

Prepare a management review agenda and inputs/outputs that satisfy the 2022 clause.

Design monitoring and measurement activities, including indicators for security performance and risk treatment effectiveness.

Plan the handling of incidents and nonconformities, including corrective action and continual improvement loops.

Rehearse explaining each major clause difference aloud in under two minutes, as you would in an audit or exam answer.

Complete a full timed mock exam and review every incorrect answer back to the clause text.

Consolidate a one-page summary sheet of the highest-yield differences and implementation steps.

Identify remaining weak areas and schedule targeted review before exam day.