Apart
from the updating of controls to bring them more in line with today’s
technology and threats, the key areas of change have been:
§ The organisation (it’s context,
the business contractual and regulatory requirements) should be much more in
centre stage in terms of determining what types of information security
controls they have in place
§ The role of the board is much
more of a governance role than a management role, and they should not get
involved with the day-to-day running of the organisation
§ PDCA is no longer the required
continual improvement process
ISO/IEC
27001:2013 is the first revision of ISO/IEC 27001. First and foremost, the
revision has taken account of practical experience of using the standard: there
are now over 17,000 registrations worldwide. However, there have been two other
major influences on the revision. The first is an ISO requirement that all new
and revised management system standards must conform to the high level structure
and identical core text defined in Annex SL to Part 1 of the ISO/IEC
Directives. Conformance to these requirements will have a tendency to make all
management system standards look the same, with the intention that management
system requirements that are not discipline-specific are identically worded in
all management system standards. This is good news for organizations that
operate integrated management systems, i.e. management systems that conform to
several standards, such as ISO 9001 (quality), ISO 22301 (business continuity)
as well as ISO/IEC 27001. The second influence was a decision to align ISO/IEC
27001 with the principles and guidance given in ISO 31000 (risk management).
Again, this is good news for integrated management systems as now an
organization may apply the same risk assessment methodology across several disciplines.
User questions & answers