ISO 27001 Transition cheat sheet

Clause 4 has four sub-clauses: 4.1 external and internal issues, 4.2 interested parties, 4.3 ISMS scope, 4.4 ISMS and its processes.

4.1 requires determining external and internal issues relevant to purpose and affecting ability to achieve intended outcomes - no documented information is explicitly required.

4.2 requires determining interested parties and their relevant requirements; the requirements become compliance obligations the ISMS must address.

4.3 scope statement must be available as documented information and must state interfaces and dependencies with other organizations or parties.

4.4 requires establishing, implementing, maintaining and continually improving the ISMS including processes and their interactions.

Scope exclusions are permitted only if they do not affect the organization's ability to ensure security of information within scope; justify them in the SoA.

Issues from 4.1 and requirements from 4.2 feed risk identification in 6.1.2 and the risk assessment in 8.2.

The transition from ISO 27001:2013 kept Clause 4 largely intact; the 2022 revision added explicit wording on continual improvement in 4.4.

Top management must demonstrate leadership and commitment by ensuring the information security policy and objectives are compatible with strategic direction.

Top management must ensure ISMS requirements are integrated into the organization's processes - integration is a 5.1 requirement, not optional.

5.2 requires an information security policy: appropriate to purpose, includes objectives or framework, includes commitment to satisfy applicable requirements and to continual improvement.

The information security policy must be available as documented information, communicated within the organization, and available to relevant interested parties as appropriate.

5.3 requires assigning and communicating responsibilities and authorities for ISMS conformity and reporting ISMS performance to top management.

Top management must promote improvement and support persons contributing to ISMS effectiveness - this is a leadership requirement, not a delegation.

Roles and authorities must be assigned even where ISMS operation is delegated to a CISO or ISMS manager; accountability stays with top management.

Clause 5 has no separate 'management representative' role in the 2022 revision - that 2013 concept was removed.

6.1.1 requires planning to address risks and opportunities from 4.1 and 4.2, giving assurance the ISMS achieves intended outcomes, prevents or reduces undesired effects, and achieves continual improvement.

6.1.2 requires defining and applying an information security risk assessment process that establishes and maintains risk criteria and a repeatable, comparable process.

Risk assessment must identify risks associated with loss of confidentiality, integrity and availability, identify risk owners, and analyze and evaluate risks.

6.1.3 requires an information security risk treatment process that selects appropriate options and determines all controls necessary.

The Statement of Applicability must list necessary controls, justify inclusion or exclusion, and be available as documented information.

6.2 requires information security objectives at relevant functions and levels, measurable where practicable, monitored, communicated and updated.

6.2 requires objectives to be consistent with the policy, measurable where practicable, and supported by plans answering what, who, when, resources and evaluation.

6.3 requires determining changes to the ISMS and carrying them out in a planned manner when needed.

The 2022 revision removed the explicit 'risk assessment and risk treatment methodology' phrase from 6.2 and moved planning of changes into a new 6.3.

7.1 requires determining and providing the resources needed for the ISMS, including people, infrastructure and environment.

7.2 requires determining the necessary competence of persons doing work affecting information security performance and ensuring they are competent.

Competence evidence includes education, training or experience; documented information of competence must be retained.

7.3 requires persons to be aware of the information security policy, their contribution to ISMS effectiveness, and implications of not conforming.

7.4 requires determining internal and external communications relevant to the ISMS: what, when, with whom, and how.

7.5.1 requires the ISMS to include documented information required by the standard and determined as necessary for effectiveness.

7.5.2 requires documented information to be controlled for availability, suitability, protection, distribution, access, retrieval, retention and disposition.

7.5.3 requires documented information of external origin determined necessary to be identified and controlled.

8.1 requires planning, implementing and controlling the processes needed to meet ISMS requirements and to implement the actions from Clause 6.

8.1 requires retaining documented information to the extent necessary to have confidence the processes were carried out as planned.

8.2 requires performing information security risk assessments at planned intervals or when significant changes occur, and retaining results as documented information.

8.3 requires an information security risk treatment plan and retaining documented information of results; risk owners must approve the plan and accept residual risks.

8.2 and 8.3 were restructured in the 2022 revision: 8.2 is risk assessment and 8.3 is risk treatment, replacing the 2013 'operational planning and control' sub-clauses.

Risk assessment results and the risk treatment plan must be retained as documented information, not just produced once.

8.3 requires the treatment plan to describe how selected controls are implemented and how the treatment is integrated into the ISMS.

8.1 requires control of outsourced or externally provided processes, products or services to the extent necessary to meet ISMS requirements.