ISO/IEC 27001:2022 Information Security Management System

ISO/IEC 27001 – the international standard for an ISMS (information security management system) – has been increasingly implemented by organisations in the private, public and third sectors over the last two decades. The Standard has been at the forefront of the war on security threats as the digital landscape evolves. Organisations have also been faced with a growing number of information and cyber security regulations, such as the GDPR (General Data Protection Regulation), the NIS (Network and Information Systems) Regulations and DORA (Digital Operational Resilience Act), all of which require ongoing compliance to safeguard digital assets, information, organisations and people.

Organisations need qualified professionals who can apply the theoretical teachings of the Standard to ensure conformity to its framework and maintain strong information security. ISO 27001:2022 is the latest version of the Standard, though its universal structure, practices and learnings will be familiar to specialists in the data environment. People wanting to enter the field are encouraged to start by reading Nine Steps to Success – An ISO 27001 Implementation Overview, which explains the requirements of the Standard and provides a guide to implementing an ISO 27001-compliant ISMS.

19 years of ISO/IEC 27001

The 1980s and 1990s saw an unprecedented rise in cyber crime against, and security negligence by, organisations and people. To address these growing challenges, the UK government’s Department of Trade and Industry requested the CCSC (Commercial Computer Security Centre) to develop a group of assessment measures for verifying the security measures of IT products. Parallel to this, the CCSC began establishing best practices for information security, the result being a document titled DISCPD003 that was later split into two key components: BS7799-1 and BS7799-2.

By the late 1990s, the objectives of BS7799-1 and BS7799-2 varied. BS7799-1 comprised ten sections defining a series of controls and their control objectives, and BS7799-2 established a formal standard for the development of an ISMS. By 2000, BS7799-1 was assumed by the ISO (International Organization for Standardization) as the foundation for creating the ISO/IEC 17799 standard. An official version of ISO 17799 was published in 2005, later being renamed ISO/IEC 27002, remaining a support system for implementing information security controls. Also in 2005, the ISO formally adopted BS7799-2 as ISO/IEC 27001:2005 as the first internationally recognised ISMS standard.

The Standard has seen two revisions since 2005: the first in September 2013 and the latest in October 2022. The first revision amended several sections, including the following:

The clause structure increased from 5 to 7. The 2005 version approached an ISMS from a managerial perspective, whereas the 2013 version did not require the clauses to be implemented in order.
The standard processes also differed: the 2005 version followed a PDCA (Plan-Do-Check-Act) model, whereas the 2013 edition is more agile in its approach and receptiv to improvements.
In terms of governance changes, ISO 27001:2013 removed the board as a component of the management system because in small organisations the board and senior management may overlap. The most notable amended area was risk assessment:
- Assigning baseline controls based on contractual, business and regulatory requirements before the risk assessment.
- The risk assessment is not asset-based.
- Risk treatment and the acceptance of residual risk are handled by the risk owner.

The key advantages of ISO 27001:2013 were its agility; the interconnectedness of risk assessment, information security risk management and corporate risk management approaches; and the space for continual improvement of an ISMS. Although the improvement was substantial, the Standard was updated again to ISO/IEC 27001:2022, giving organisations a transition period of three years to conform before the deadline of 31 October 2025.

The changes forming the 2022 version are minor to moderate. At its core, the Standard focuses on the ten clauses; the text of Clauses 4 to 10 has been amended slightly to align with other ISO management standards, namely ISO 9001 and ISO 1400, as well as ISO Annex SL. The controls of Annex A were reduced from 114 to 93 and categorised into 4 sections rather than the previous 14. This may seem substantial, but 35 of the controls have remained unchanged, 23 have been renamed and 57 were merged into 22, resulting in the decrease. Furthermore, 1 control was separated into 2 controls, but the requirements continued unaltered and 11 new controls were added to account for developments within the IT and security industries.

Central to ISO 27001 is its ability to adapt, with amendments allowing for improvement rather than restructuring. Security professionals anticipated broader changes, but updates to documentation and processes have been slight. The Standard has been revised to the highest quality in 19 years, which also means certification bodies such as IBITGQ must develop, maintain and improve their ISO 27001 qualifications.

IBITGQ ISO/IEC 27001 ISMS certifications

IBITGQ was established in 2011 and has since certified more than 14,000 professionals in the fields of IT governance, information security, cyber security and privacy. IBITGQ is renowned for establishing in-demand compliance and framework-specific qualifications, including the first-to-market ISO/IEC 27001:2013 ISMS qualifications (now ISO/IEC 27001:2022 ISMS).

IBITGQ offers the following ISO/IEC 27001 ISMS qualifications:
ISO/IEC 27001:2022 Certified ISMS Foundation (CIS F)
ISO/IEC 27001:2022 Certified ISMS Lead Implementer (CIS LI)
ISO/IEC 27001:2022 Certified ISMS Lead Auditor (CIS LA)
ISO/IEC 27001:2022 Certified ISMS Internal Auditor (CIS IA)
ISO/IEC 27001:2022 Certified ISMS Transition (CIS TN)

IBITGQ has been at the forefront of ISO/IEC 27001 ISMS qualification development in the last decade. In response to the Standard’s first revision in 2011, IBITGQ developed the first ISO/IEC 27001:2013 ISMS qualifications within the same year, nearly two years before the deadline. Similarly, the second revision amended the syllabi of the qualifications to account for the developments of the controls of Annex A and clauses, again nearly two years before the deadline.

The qualifications are developed by SMEs (subject matter experts) in the fields of information security, risk, compliance, governance, resilience and business continuity. Qualifications certify professionals from knowledgeable to specialist depending on their role, with the aim of honing skills or providing opportunities for new practitioners.

ISO/IEC 27001:2022 Certified ISMS Lead Implementer and ISO/IEC 27001:2022 Certified ISMS Lead Auditor comply with ISO/IEC 17024:2012, achieving this accreditation through the International Accreditation Service. ISO/IEC 17024:2012 is regarded as the gold standard for IT qualifications and specifies that accredited examination bodies meet the global industry standards, are consistent, are internationally comparable, possess the required knowledge and experience, and are validated to ensure recognition by employers and peers.

Strong competition within the business environment has increased the demand for professional certifications such as ISO/IEC 27001:2022 ISMS. Ongoing compliance with the Standard demonstrates an organisation’s commitment to the highest security standards and procedures to ensure the protection of digital assets. ISO/IEC 27001:2022 ISMS is also a pivotal starting point for conforming to regulations such as the GDPR, the NIS Regulations and DORA.

Who should obtain an ISO/IEC 27001:2002 ISMS qualification?

Our ISO/IEC 27001:2002 ISMS certifications typically appeal to managers and professionals within the information security sector, or those who are dedicated to continued professional development with a focus on high-quality information and cyber security practices. Our courses are ideal for people in the following roles:

ISO/IEC 27001:2022 Certified ISMS Foundation: This qualification is designed for people who are developing a career in information security. It is also for those working for an organisation that uses ISO 27001 or that is seeking certification or recertification to the 2022 version of the Standard.

Below are the key groups of professionals who would benefit from obtaining this qualification:

Information security professionals
Internal auditors
External auditors
Risk management professionals
Quality management professionals
IT managers and professionals
Compliance officers
Non-specialists from non-IT business functions
Data privacy and GDPR compliance professionals
Consultants and advisors

ISO/IEC 27001:2022 Certified ISMS Lead Implementer: This qualification is designed for people involved in information security management, for example:

IT/information security consultants
IT/information security managers
IT/information security officers
IT/information security project managers
Cyber security consultants
Heads of IT
CISOs (chief information security officers)
GDPR consultants
Information security analysts
ISMS managers
Network managers

ISO/IEC 27001:2022 Certified ISMS Lead Auditor: This qualification is aimed at those who want a globally recognised ISO 27001 lead auditor qualification to further their careers. It is also designed for managers responsible for implementing and maintaining an ISO 27001-compliant ISMS, such as:

IT/information security managers
Compliance auditors
GDPR consultants
IT/information security consultants
Cyber security consultants
Heads of IT
Information and risk managers
Information security analysts
Information security officers
Internal auditors
ISMS managers

ISO/IEC 27001:2022 Certified ISMS Internal Auditor: This qualification is designed for people who are involved in, or aspiring to be involved in, the internal audit process for an ISMS based on the ISO 27001:2022 standard.

Below are the key groups of professionals who would benefit from obtaining this qualification:

Information security professionals
Internal auditors
Risk management professionals
Quality management professionals
IT managers and professionals
Compliance officers
People involved in ISO 27001 implementation
GDPR compliance professionals
Consultants and advisors

ISO/IEC 27001:2022 Certified ISMS Transition: This qualification is suitable for people who hold any of the following IBITGQ qualifications and who want to comply with ISO 27001:2022:

ISO/IEC 27001:2022 Certified ISMS Foundation (CIS F)
ISO/IEC 27001:2022 Certified ISMS Lead Implementer (CIS LI)
ISO/IEC 27001:2022 Certified ISMS Lead Auditor (CIS LA)
ISO/IEC 27001:2022 Certified ISMS Internal Auditor (CIS IA)

The benefits of IBITGQ’s ISO 27001:2022 qualifications

Developing expertise in ISO/IEC 27001 equips individuals to implement, assess and manage an ISMS. This comprehensive skillset encompasses understanding risk management, controls and compliance obligations. It further empowers individuals to continually improve the ISMS and effectively audit its implementation. This proficiency makes them highly sought after in the information security field.

For people

Each year, more than 70,000 ISO 27001 certificates are issued across more than 150 countries, acknowledging the Standard’s relevance and demand. Professionals in the information security field and people wanting to enter will get the following benefits from gaining an ISO 27001:2022 qualification from IBITGQ:

Increased knowledge: An enhanced understanding of the framework’s security procedures, management systems and compliance requirements.
Skills development: Skills to address security scenarios and increased critical thinking abilities to identify, assess, respond to and resolve security negligence and threats.
Career progression: Increased marketability and career advancement to fill the skills gaps in the information security sector, and opening doors to leadership roles and diverse career opportunities.
Earning potential: Higher earning potential.
Professional reputation: An enhanced reputation as an expert, at ISO 27001 levels ranging from foundational to lead auditor and implementer.
Added value: An opportunity to expand your role and scope within an organisation and the information security field.
Global recognition: An internationally recognised qualification, enabling migration into international business environments.
Regulatory compliance: Demonstration of a pivotal step in compliance with regulations such as the GDPR and DORA, showing commitment to regulatory mandates.
Expansion of frameworks: A platform to explore other domains of learning that complement the Standard, such as ISO 27002 and ISO 22301.
Commitment to security: Assurance to employers of integrity and reliability.
Networking opportunities: Connection to a network of other qualified professionals to share information, knowledge, practices, cultural exchanges and industry developments.

For organisations

Employing ISO 27001-certified professionals offers a range of significant benefits for organisations. These benefits can be broadly categorised into four key areas:

Competitive advantage: ISO 27001 compliance helps organisations gain a competitive edge by demonstrating strong security practices. This not only improves relationships with existing clients but also opens doors to new business opportunities. With ISO 27001-certified professionals, organisations can confidently showcase their security measures in tenders and stand out from the competition.
Reduced costs and improved reputation: Cyber security threats are a constant concern, and data breaches can be financially devastating. Implementing an ISO 27001-certified ISMS significantly reduces this risk, potentially saving organisations millions in data breach penalties. Furthermore, ISO 27001-certified professionals demonstrate an organisation’s commitment to data protection, minimising the reputational damage that can occur from security incidents.
Compliance and regulations: The information security landscape is constantly evolving, with new regulations emerging all the time. ISO 27001 is designed to ensure organisations have adequate security controls in place to meet these evolving requirements, including those outlined in the GDPR and NIS Regulations.
Improved structure and efficiency: As organisations grow, information security responsibilities can become unclear, leading to inefficiencies. ISO 27001 helps organisations improve productivity by clearly defining who is responsible for safeguarding information assets. This eliminates duplication of effort, ensures everyone understands their role and allows for better decision-making around information security risks.