The new version of ISO/IEC 27001:2013 is here

19 September 2013

The internationally acclaimed standard for information security management (ISO/IEC 27001) and accompanying ISO/IEC 27002, ‘Code of practice for information security management controls’ have been revised.

Following the publication of an initial draft international standard (DIS) and extensive public consultation, both ISO/IEC 27001 and ISO/IEC 27002 have passed their final draft standard (FDIS) ballots and  proceeded to final publication.

What are the main changes?
The revised standard has been written using the new high level structure, which is common to all new management systems standards. This will allow easy integration when implementing more than one management system. Terminology changes have been made and some definitions have been removed or relocated

Risk assessment requirements have been aligned with BS ISO 31000Management commitment requirements have a focus on “leadership”Preventive action has been replaced with “actions to address, risks and opportunities”SOA  requirements are similar, with more clarity on the need to determine controls by the risk treatment process. Controls in Annex A have been modified to reflect changing threats, remove duplication and have a more logical grouping. Specific controls have also been added around cryptography and security in supplier relationships. Greater emphasis is on setting objectives, monitoring performance and metrics. 

I’m interested in certifying to ISO/IEC 27001 now – what should I do?
The current standard is still valid and you can still get certified against it. If you are close to implementing your ISO/IEC 27001 management system we can assess you against the ISO/IEC 27001:2005 standard, as long as your visits are completed within the next 12 months. We can then work with you to complete your transition to the new ISO/IEC 27001:2013 version during your continual assessment visits.

If you are still in the very early stages of adopting ISO/IEC 27001, or unlikely to be able to go through the assessment visits within the next 12 months, we would recommend that you work towards certification against ISO/IEC 27001:2013.