ISO 27001: Celebrating 20 years of information security excellence
From BS 7799 to ISO 27001: the evolution of a global standard
The forebear of ISO 27001 first appeared in the mid-1990s as British Standard BS 7799, which provided the foundation for an information security framework. BS 7799 was split into BS 7799-1 and BS 7799-2, with the former providing a wish list to be considered by any organisation interested in strengthening their information security posture, whilst the latter put forward a list of what could be regarded as mandatory requirements, in effect becoming the cornerstone for what was to become ISO 27001.
BS 7799-2 was published in 1999 and was elevated 6 years later in 2005 to the internationally recognised standard, ISO 27001. Two years later, BS 7799-1 became ISO 27002, providing extensive guidance on how to best implement an Information Security Management System compliant with the requirements of ISO 27001.
The 2013 update – integrating Annex SL for consistency
In 2013, ISO 27001 was reviewed to incorporate Annex SL, which improved consistency by differentiating mandatory clauses focused on the management of the ISMS and a set of optional technical controls. The adoption of Annex SL was key to promoting consistency and supporting the integration of an ISO 27001-certified Information Security Management System with other ISO management systems.
The standard received some minor updates in 2017, mainly clarifications from two corrigenda issued in 2014 and 2015: the updated version did not introduce any new requirements.
ISO 27001:2022 – a new structure for modern security challenges
The big change came in with ISO 27001:2022. Whilst the clauses remained largely the same, the controls, on the other hand, were subject to a full restructure. Not only was the terminology updated (at last, teleworking was replaced with remote working and references to cyber security and cloud computing made their appearance), but the number of controls diminished from 114 to 93, which became divided into 4 themes: 37 organisational controls, 8 people controls, 14 physical controls and 34 technical controls.
Attributes were introduced to include control types, information security properties, cybersecurity concepts, operational capabilities and security domains. Some controls did disappear, others merged… and 11 new ones appeared.
Published some months ahead of ISO 27001, ISO 27002 provided an early view of the new structure and, helpfully, mapped the 2013 controls to the 2022 controls for backward compatibility.
The ISO 27001:2013 transition
As if to mark the 20th anniversary of the standard by decisively turning a new page, certifications to the 2013 standard became invalid on November 1st. If you have not yet transitioned to the 2022 version of the standard, you’d better liaise with your ISO Certification Body soon, or you risk seeing your certification lapse at the end of this month, and you may have to go through a full (Stage 1 and Stage 2) certification.
Read more FAQs on the ISO 27001 update here
How Evalian can support your ISO 27001:2022 transition
For the last 6 years, Evalian has helped dozens of organisations of all industries and sizes prepare for certification to ISO 27001 by developing tailored management systems and delivering client-specific training. For over two years, we have successfully transitioned clients to the new version of the standard.
“We recently used Evalian for our company’s upgrade to the ISO 27001:2022 certification. From the outset, Evalian’s team demonstrated an exceptional level of professionalism and patience, navigating us through the complexities of the ISO 27001 certification process. They didn’t just offer solutions; they provided a learning experience, ensuring our team understood each step and its importance. Evalian’s contribution to our organisation went beyond achieving certification; they have left us with a stronger, more resilient information security management system.” – Claude Kajue, MYCOM
If your organisation hasn’t yet transitioned to ISO 27001:2022, there’s still time. Our consultants can help you update your ISMS, train your teams, and stay certified. Understand the costs associated with ISO 27001 certification here. Get in touch today to arrange support before the deadline…
Learn more about Evalian’s expert ISO 27001 consultancy service
