What are the ISO 27001:2022 controls?

ISO published the ISO 27001 standard to outline an information security management system (ISMS) in 2005. Since then, significant revisions have taken place in 2013 and 2022 to better reflect the evolving climate of cybersecurity threats and technologies. This article lays out the most current control requirements as established in ISO 27001:2022

‍

This article will explain how the 2022 version of ISO has evolved from its 2013 predecessor and the current controls that your organization can implement to become ISO 27001 compliant.

‍

What are the current ISO 27001 controls?

ISO 27001 controls form the backbone of the ISMS. They are designed to address risks to information security and ensure that critical data remains confidential, available, and integral. The controls are divided into four categories, or themes, under Annex A: organizational, people, physical, and technological measures.

‍

Annex A in the ISO 27001:2013 standard included 114 controls across 14 domains, including access control, cryptography, and incident management. The 2022 update reorganized and modernized these controls to align with cybersecurity challenges. Instead of 14 domains, the updated controls are grouped into four broader themes:

1. People: Addressing human factors in security, such as training and awareness
2. Organizational: Governance, risk management, and compliance practices
3. Physical: Protection of physical assets and locations
4. Technological: Safeguarding IT systems and infrastructure

‍

The update aimed to simplify implementation and improve clarity as new threats emerge. 

‍

{{cta_withimage2="/cta-blocks"}} 

‍

Key differences between ISO 27001:2022 and ISO 27001:2013

The shift from ISO 27001:2013 to ISO 27001:2022 introduced several notable changes:

‍‍

#1 Reduction and consolidation of controls

‍The number of controls has decreased from 114 to 93, with several consolidated to eliminate redundancy. For example, cryptographic policies and key management controls are now grouped under a single, streamlined control.

‍‍

‍#2 Introduction of "attributes" for enhanced context

‍The 2022 version introduces five attributes to help organizations understand the purpose and application of each control:some text

1. Cybersecurity concepts
2. Information security properties
3. Operational capabilities
4. Security domains
5. Control types (preventive, detective, corrective)

These attributes allow for a more flexible and tailored approach to implementing controls based on organizational needs.

‍‍

#3 New controls to address emerging threats

‍Fourteen new controls have been added, reflecting advancements in technology and the rise of threats like ransomware and supply chain attacks. Some of these include:some text

• Threat intelligence: Requires organizations to collect and analyze information relating to information security threats
• Data leakage prevention: Companies must implement technical measures that detect and prevent the disclosure and/or extraction of information
• Information security for use of cloud security services: Requires organizations to specify and manage information security for the use of cloud services
• Configuration management: Policies must be established to manage how an organization documents, implements, monitors, and reviews the use of configurations across its entire network
• Data masking: This control is fulfilled by providing data masking techniques for personal identifiable information (PII) to comply with laws and regulations

These changes provide a more holistic and modern approach to information security, helping organizations address risks more effectively with the rise of remote work and ever-evolving cybersecurity threats.

‍

Implementing 27001 controls with Vanta

Implementing ISO 27001 controls can seem daunting, but Vanta’s automated compliance platform helps organizations map existing controls to the updated standard, identify gaps, and implement changes seamlessly.

‍

Vanta’s progress tracking and views of tests and controls overlap with complementary standards like SOC 2 and GDPR, which get you closer to multi-standard compliance for a fraction of the effort.

‍

The platform’s control mapping feature simplifies understanding how your current ISMS aligns with the 2022 framework, saving time and reducing complexity. Additionally, the platform’s continuous monitoring capability ensures that new controls like cloud service security are actively maintained, reducing the risk of non-compliance.

‍

Want to learn more about how to implement ISO 27001 controls effectively? Discover how BD Emerson’s information security experts can help your organization get ISO 27001 audit-ready. Schedule a consultation today! 

‍

{{cta_simple2="/cta-blocks"}}