Taking into account the rapidly changing cybersecurity environment, ISOs are updating information security standards. Earlier this year, the new version of ISO/IEC 27002:2022 was published. The ISO/IEC 27001 standard, which provides requirements for establishing, implementing, maintaining and continuously improving an information security management system (ISMS), is currently in effect as of 2013, excluding the 2014 and 2015 amendments. ISO/IEC 27001 is one of the most widely used standards worldwide, certification according to its requirements is accepted in 168 countries around the world, and the delay is somewhat surprising - it has not been updated for almost a decade. In the current year 2022, the International Organization for Standardization (ISO) is expected to release a new version of the ISO/IEC 27001 standard.

What is changing
Regarding the critical elements required for ISO 27001:2013 certification – clauses 4 to 10, no changes are expected in the upcoming 2022 version. ISO 27002:2022, published in February this year, essentially reflects all controls from Annex A in ISO 27001 and provides very detailed guidance on their implementation. In the new version of ISO/IEC 27001, the controls in Annex A are expected to match those in ISO 27002:2022. So ISO/IEC 27002:2022 can be seen as a useful guide to what is expected.
By performing a risk assessment, organizations can determine which controls should be relevant to their scope and should be implemented. The choice is driven by the need to reduce risks from the analysis described in clause 6 in ISO/IEC 27001:2013, which is not changing.
Changes to ISO/IEC 27001 controls have been made to bring the standard into line with the current needs of technology industries.

Schedule of changes to ISO 27001
The new version of the ISO/IEC 27001 standard is expected in October 2022.
Assuming the change follows the typical pattern of new versions of the ISO standard, accreditation bodies will provide 12 – 24 months grace period to allow time to update processes and documentation, conduct staff training, etc.
This means that if your ISMS is already certified, the surveillance audits planned for 2022 will be according to the 2013 version. If you are currently planning for initial certification and ISMS certification in 2022 or early 2023, the 2013 version will be applied during audits.
Organizations should plan to implement the elements of the new standard as early as 2023 and fully transition to the new version from mid to second half of 2023, depending on certification dates. The 2013 standard is likely to be phased out entirely in 2024.