The New Information Management and Physical Security Controls in ISO 27001:2022

Introducing ISO/IEC 27001

Best-practice security management standards lay out baseline guidance for securing corporate assets, be those assets digital or physical. The ISO (International Organization for Standardization) 27001 information security (IS) management systems standard, in particular, focuses on securing information assets.

The standard itself is part of the ISO 27000 series of IS management standards. These standards all share a focus on Information Systems Management (ISM), with ISO 27001, originally dubbed BS7799, included in this family of ISO standards when the organization officially began adding ISMS standardsⁱ. 

So, what does ISO 27001 do, exactly? 

The standard suggests methods and practices of implementing information security in organizations. It provides flexible guidelines – targeted at all companies, irrespective of sector or size – for how methods and practices should be implemented. 

What’s more, ISO 27001 also provides a means of enabling secure, reliable communications of security risk.

Included in the standard are concrete requirements ISMS’s must fulfill to achieve certification. Although concrete, the specifications are broad. Specific requirements aren’t provided in the generic standard, so it can remain suitable to all organizations. 

Indeed, requirements, as they are in all other ISO standards, are left to individual companies to develop and implement – in the case of the ISO 27000 series, ISO 27002 establishes supplementary guidelinesⁱⁱ. 

What ISO 27001 does outline, though, are the broad requirements for planning, implementation, operation, and continuous monitoring and improving of a process oriented ISMS. To this end, the standard calls on all organizations to identify and assess their risks, as well as define control objectives (for physical security among other matters). 

That’s not all. The standard also emphasizes the necessity of adequate training as a prerequisite for implementing then communicating security procedure. That procedure must be continuously monitored, checked on, and improved upon, to ensure the effectiveness and efficiency of the ISMS. 

Who’s responsible?

Here, the standard tasks senior management – not just top executives but business line owners, as well – with the control of the end-to-end certification and implementation process. 

That process, in its entirety, consists of determination of security policy, definition of roles and responsibilities, recruitment and preparation of necessary personnel and material resources, as well as decisions on risk management. 

The 2013 standard gets an update

ISO 27001 was originally published in 2012. Of course, much has changed in the information management space since then. And this vertiginous pace of change prompted experts to update the standard and establish a more modern information security assessment framework.

So, what are some of the key changes?

For one, the new ISO/IEC 27001:2022 more clearly emphasizes process orientation in information security management^iii. 

Another change in emphasis is the increased centrality of risk management – the latter demonstrated by the below:

• Adaptation to the so-called Harmonized Structure
• Emphasis on best practices for managing various information security vulnerabilities
• Highlighting the significance of process orientation, a feature shared by all HS-based management systems

Security management is all about execution, though. That’s where controls come in.

The original standard included an appendix replete with detailed security controls for multiple security risk points. The updated standard does, as well, revising many of the earlier controls for an era of increased security risk. 

Specifically, the updated standard adds 11 new controls. Meanwhile, 24 existing controls get combined, and 58 controls get modifications.

Focus on changes to physical security controls

Where do physical security controls (including people) factor among these changes? Information assets, as is known, exist in physical space, manipulated by personnel. Those facts leave assets vulnerable despite the most stringent (purely) information security measures. 

Like the original, the updated standard dedicates time to discussing physical and environmental security control objectives and controls as well as the role of people. But unlike the original, the updated standard singles out physical security monitoring. 

The recommended control to effect serious physical security monitoring is to continuously monitor all premises for unauthorized physical access. 

What are some other controls for physical assets and people, recycled from the original or otherwise? The full list includes: 

Changes to organizational controls in ISO 27001:2022

Organizational controls often fall within the category of physical controls, as well. Changes occurred in these controls, as well.

For instance, the updated standard adds a new threat intelligence control. This control mandates the collection and analysis of all information relating to information security threats with the intent of producing complete threat intelligence.

Another significant addition: the updated standard tacitly emphasizes the impact of information assets on an organization’s larger business continuity. As a result, a new ICT readiness for business continuity control was added. 

So, what’s the timeline for transition? For organizations currently certified, the transition from the 2013 standard will take three years. 

To get started, though, organizations should examine the new controls, update their analysis and assessment of risk, and then choose the most appropriate controls to reduce risk, while updating their ISMS policy as is necessary. 

The larger point, however, is that the revised standard sheds light on the deteriorating security risk picture. All organizations, previously certified or not, should be paying attention. Besides pursuing or updating certification, these organizations should also be considering the right operational security management software platform to manage all aspects of security operations from anywhere, on any device. That way, in the face of stark security threats, organizations can deploy resources effectively and efficiently when incidents happen.

Sources

^i. Varun Arora, Carnegie Mellon University: Comparing different information security standards: COBIT vs. ISO 27001. Available at https://s3.amazonaws.com/academia.edu.documents/31868881/CPUCIS2010-1.pdf?response-content-disposition=inline%3B%20 filename%3DCPUCIS2010_1.pdf&X-Amz-Algorithm=AWS4-HMAC SHA256&X-Amz-Credential=AKIAIWOWYYGZ2Y53UL3A%2F20200226%2Fuseast-1%2Fs3%2Faws4_request&X-Amz-Date=20200226T212220Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X Amz-Signature=a9b785 daecd2dacc383fbedf95d42e76c9eeb6ebca0ce79459de4a86864e63aa

^ii. Georg Disterer, Journal of Information Security: ISO/IEC 27000, 27001 and 27002 for Information Security Management. Available at https://serwiss.bib.hs hannover.de/frontdoor/deliver/index/docId/938/file/ISOIEC_27000_27001_and_27002_for_Information_Security_ Management.pdf.

^iii. Deepti Sachdeva, Security Boulevard: ISO/IEC 27001 – What’s new in Pipeline. Available at https://securityboulevard.com/2022/11/iso-iec-27001-whats-new-in-pipeline/