New developments in cyber security threats have pushed companies to look for new ways to protect themselves and their data. Attackers behind threats look for opportunities to breach networks, take advantage of organizations' information assets or attack software. Attacks vary, from malicious software targeting disruption of activities, through stealing sensitive data and causing financial damage, to seriously harming computer systems and causing companies to shut their doors. In order to respond to this new cyber threat landscape, ISO has published a new, revised version of ISO/IEC 27001 (ISO/IEC 27001:2022) to assist companies in finding new strategies to heighten information security.

Successful cyber-attacks are carefully planned and carried out. According to IT experts, seven stages can be identified before the attack is completely realized. In the first place, research of the company is done. Publicly available information is researched through its website and social media profiles and a weak and vulnerable place is looked for. The vulnerability would determine the "weapon" for the attack – fishing emails, malware, etc. The ultimate goal is to find an entry point and gain access to the company's inner network. Once into the network, the attackers have access to the most valuable and sensitive data of the company and are also able to disrupt operations. They often manage to hide their presence until the desired results, (stealing intellectual property, disabling computer systems), have been attained.

Just as threats have developed, so companies need to develop new means to protect themselves. This is where ISO 27001:2022 can really make a difference. The new version of the standard responds to the new challenges in the field of information security. It introduces some new and revised controls in terms of information security properties and cyber security concepts, such as threat intelligence, data masking and secure coding, in order to respond to new threats. Following the steps to successful certification in accordance with ISO/IEC 27001:2022 is the best way to secure in place a strong information security management system. In order to acquire certification, the information security management system needs to meet the requirements of the standard, and that in turn ensures the company has taken all the measures to protect its systems and safeguard its information assets in the best possible way. Thus, companies could face both current threats and address future risks to its information security system, by means of addressing continual development – a requirement of the standard. The constantly evolving cyber threat landscape means that organizations and companies need to evolve their information security systems and build resilience in order to prevent disruption to their operations or financial losses, caused by cyber-attacks.