Jusletter IT

ISO 27001 is a standard for an information security management system (ISMS). It helps organisations keep their assets secure¹ by establishing, implementing, maintaining and improving their ISMS.² This article covers some of the differences as compared to first edition of the standard (ISO 27001:2005).

1. ISO 27001:2013 has been restructured.³ It follows the 10-section structure of the new ISO Annex SL.⁴ Annex SL harmonizes structure, text, terms, and definitions.

2. Consequently, the former definition section has been removed. The terms are now standardised and referenced in the updated definitions stipulated in ISO 27000:2012.

3. The most apparent change is the omitted plan-do-check-act (PDCA) cycle of ISO 27001:2005. Hence, the new ISO structure is open for other ISMS improvement methods. The following match to the PDCA cycle crystallises the new open approach:⁵

Graph 1: Matching ISO 27001:2013 to 27001:2005.

3.1 Plan: The first element of the cycle is now distributed over four sections: Context of the organisation, where the organisation determines its issues, needs and expectations

for an ISMS; Leadership, where the organisation’s management demonstrates commitment to an ISMS and establishes an ISMS policy; Planning, where the organisation addresses risks and opportunities, and establishes security objectives; and Support, where the organisation shall provide resources, determine competent personnel, create awareness among the staff, and define a communication strategy.

3.2 Do: The second element of the cycle comprises the operation. The organisation plans and controls the process for the security objectives, performs risk assessments, and implements a risk treatment plan.

3.3 Check: The third element comprises the performance evaluation. The organisation evaluates the security performance and effectiveness of the ISMS, and performs an internal audit. The ISMS is reviewed regularly.

3.4 Act: The last element of the PDCA cycle now comprises the improvement. The organisation takes corrective actions if any non-conformity occurs, and continuously improves suitability, adequacy and effectiveness of the ISMS.

4. Annexes B (OECD principles) and C (standard correspondence) of ISO 27001:2005 have been removed. Annex A (control objectives) of ISO 27001:2013 has been restructured and revised. With qualified data protection officers⁶ our law firm also provides legal support on security issues.

Daniel Ronzani