{"id":929,"date":"2013-10-14T22:13:08","date_gmt":"2013-10-14T21:13:08","guid":{"rendered":"http:\/\/www.halkynconsulting.co.uk\/a\/?p=929"},"modified":"2013-12-30T20:22:34","modified_gmt":"2013-12-30T20:22:34","slug":"isms-new-version-isoiec-27001","status":"publish","type":"post","link":"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/","title":{"rendered":"ISMS: New version of ISO\/IEC 27001 – Time to update?"},"content":{"rendered":"
\"An<\/a>
An ISMS is fundamental to how you make sure your business is properly protected.<\/figcaption><\/figure>\n

As you may be aware, the ISO\/IEC 27001 standard for Information Security Management Systems (ISMS) was updated and the 2013 version became the “official” version at the start of October 2013. The previous version for ISMS requirements was ISO\/IEC 27001:2005, and for eight years now, organisations have been working towards, and achieving, certification to that standard.<\/p>\n

ISMS Requirements – Changes?<\/h2>\n

The change between the 2005 version and the current 2013 standard is more than just cosmetic and there is a lot of improvements for your ISMS. There are some areas where controls have been regrouped within Annex A, but there are also new controls for project management, outsourcing, design & engineering and information security events. Additionally the risk management approach has been brought more in line with ISO 31000.<\/p>\n

What should you do?<\/h2>\n

Overall, the main impact is that a lot of existing ISMS document will need to be reviewed (and possibly references changed) and anyone working towards certification needs to make a decision as to which path they will go down.<\/p>\n

    \n
  • If you are close to completing your implementation and will be able to get through all the required visits by the assessors no later than the end of September 2014, then you can opt to certify your ISMS against ISO\/IEC 27001:2005.<\/li>\n
  • Alternatively you can make the changes required to realign your ISMS to ISO\/IEC 27001:2013 now and work towards certification that way. If your are more than 12 months away from full implementation of your ISMS, this is your only option.<\/li>\n<\/ul>\n

    Unless you really are very, very close to finishing your ISMS certification against the 2005 standard, we would strongly recommend you use the new 2013 version.<\/p>\n

    If your ISMS is currently certified to the 2005 version of the standard, your certification will remain valid until the end of your 3 year renewal cycle. However once you come up for re-certification you will need to work against the 2013 standard.<\/p>\n

    As far as we are aware, it is not possible to recertify against the 2005 during the twelve month “grace period” that has been offered for new certifications.<\/p>\n

    Supply chain ISMS certification<\/h2>\n

    When it comes to your supply chain, one of the benefits of ISO\/IEC 27001 certification is that it allows you to develop a level of trust. If your supplier has managed to achieve and maintain certification, then you have a reasonable level of assurance that they have implemented a working ISMS and will protect your data to at least some degree.<\/p>\n

    It is of critical importance that as part of this assurance you get access to copies of the documentation sets provided for certification, evidence that the ISMS is properly implemented and a good understanding of the scope submitted for certification audit. If you can tick these three boxes, you can have quite a good level of assurance around your supplier.<\/p>\n

    Now that the 2013 standard is official, you should also make sure that your supply chain move to meet the new requirements in a timely fashion. As mentioned above, any certifications currently valid will remain so, but it will help for you to engage your suppliers and find out what their plans for the transition are. By October 2016 all your suppliers should have had to recertify and it is unlikely that any ISO\/IEC 27001:2005 certifications will be valid.<\/p>\n

    Coming Soon<\/h2>\n

    To assist you with moving towards the 2013 standard, we will be providing a free downloadable checklist document that you can use to self-assess your ISMS compliance. Hopefully this will be ready before 25 October 2013.<\/p>\n

    Following on from that, we will also look to update our Security Policy Framework (SPF) mapping to assist suppliers to the Government \/ MOD. That is likely to be ready by the end of the year.<\/p>\n","protected":false},"excerpt":{"rendered":"

    As you may be aware, the ISO\/IEC 27001 standard for Information Security Management Systems (ISMS) was updated and the 2013 version became the “official” version at the start of October 2013. The previous version for ISMS requirements was ISO\/IEC 27001:2005, and for eight years now, organisations have been working towards, and achieving, certification to that […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"footnotes":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true},"categories":[5,3,21],"tags":[6,105,106,140],"class_list":["post-929","post","type-post","status-publish","format-standard","hentry","category-security","category-securitynews","category-security-risk-management","tag-infosec","tag-isms","tag-iso27001","tag-security","entry"],"jetpack_publicize_connections":[],"yoast_head":"\nISMS: New version of ISO\/IEC 27001 - Time to update?<\/title>\n<meta name=\"description\" content=\"ISMS news: with the release of the 2013 version of the ISO27001 standard, organisations need to decide how they will seek accreditation.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ISMS: New version of ISO\/IEC 27001 - Time to update?\" \/>\n<meta property=\"og:description\" content=\"ISMS news: with the release of the 2013 version of the ISO27001 standard, organisations need to decide how they will seek accreditation.\" \/>\n<meta property=\"og:url\" content=\"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/\" \/>\n<meta property=\"og:site_name\" content=\"Halkyn Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2013-10-14T21:13:08+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2013-12-30T20:22:34+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2013\/10\/1336892_40263449-300x217.jpg\" \/>\n<meta name=\"author\" content=\"Halkyn Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@HalkynSecurity\" \/>\n<meta name=\"twitter:site\" content=\"@HalkynSecurity\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Halkyn Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/#article\",\"isPartOf\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/\"},\"author\":{\"name\":\"Halkyn Security\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/3cfcd2267f12bbcce6a10159022c3df2\"},\"headline\":\"ISMS: New version of ISO\/IEC 27001 – Time to update?\",\"datePublished\":\"2013-10-14T21:13:08+00:00\",\"dateModified\":\"2013-12-30T20:22:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/\"},\"wordCount\":640,\"commentCount\":0,\"publisher\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#organization\"},\"keywords\":[\"Information Security\",\"ISMS\",\"ISO27001\",\"Security\"],\"articleSection\":[\"Security\",\"Security News\",\"Security Risk Management\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/\",\"url\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/\",\"name\":\"ISMS: New version of ISO\/IEC 27001 - Time to update?\",\"isPartOf\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#website\"},\"datePublished\":\"2013-10-14T21:13:08+00:00\",\"dateModified\":\"2013-12-30T20:22:34+00:00\",\"description\":\"ISMS news: with the release of the 2013 version of the ISO27001 standard, organisations need to decide how they will seek accreditation.\",\"breadcrumb\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Halkyn Security\",\"item\":\"http:\/\/www.halkynconsulting.co.uk\/a\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security\",\"item\":\"http:\/\/www.halkynconsulting.co.uk\/a\/category\/security\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"ISMS: New version of ISO\/IEC 27001 – Time to update?\"}]},{\"@type\":\"WebSite\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#website\",\"url\":\"http:\/\/www.halkynconsulting.co.uk\/a\/\",\"name\":\"Halkyn Security Blog\",\"description\":\"Specialist Security & Risk Management Consultants\",\"publisher\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\/\/www.halkynconsulting.co.uk\/a\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#organization\",\"name\":\"Halkyn Consulting\",\"url\":\"http:\/\/www.halkynconsulting.co.uk\/a\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2011\/07\/Untitled-1.png?fit=990%2C170&ssl=1\",\"contentUrl\":\"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2011\/07\/Untitled-1.png?fit=990%2C170&ssl=1\",\"width\":\"990\",\"height\":\"170\",\"caption\":\"Halkyn Consulting\"},\"image\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/2329571\",\"https:\/\/twitter.com\/HalkynSecurity\"]},{\"@type\":\"Person\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/3cfcd2267f12bbcce6a10159022c3df2\",\"name\":\"Halkyn Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4126abc936773e5e8bd38e030d54306e161190a7d6166dba7edadb6caf13b504?s=96&d=retro&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4126abc936773e5e8bd38e030d54306e161190a7d6166dba7edadb6caf13b504?s=96&d=retro&r=g\",\"caption\":\"Halkyn Security\"},\"description\":\"Halkyn Security Consultants.\",\"sameAs\":[\"http:\/\/www.halkynconsulting.co.uk\/\"],\"url\":\"http:\/\/www.halkynconsulting.co.uk\/a\/author\/halkyn-consulting\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ISMS: New version of ISO\/IEC 27001 - Time to update?","description":"ISMS news: with the release of the 2013 version of the ISO27001 standard, organisations need to decide how they will seek accreditation.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/","og_locale":"en_GB","og_type":"article","og_title":"ISMS: New version of ISO\/IEC 27001 - Time to update?","og_description":"ISMS news: with the release of the 2013 version of the ISO27001 standard, organisations need to decide how they will seek accreditation.","og_url":"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/","og_site_name":"Halkyn Security Blog","article_published_time":"2013-10-14T21:13:08+00:00","article_modified_time":"2013-12-30T20:22:34+00:00","og_image":[{"url":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2013\/10\/1336892_40263449-300x217.jpg"}],"author":"Halkyn Security","twitter_card":"summary_large_image","twitter_creator":"@HalkynSecurity","twitter_site":"@HalkynSecurity","twitter_misc":{"Written by":"Halkyn Security","Estimated reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/#article","isPartOf":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/"},"author":{"name":"Halkyn Security","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/3cfcd2267f12bbcce6a10159022c3df2"},"headline":"ISMS: New version of ISO\/IEC 27001 – Time to update?","datePublished":"2013-10-14T21:13:08+00:00","dateModified":"2013-12-30T20:22:34+00:00","mainEntityOfPage":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/"},"wordCount":640,"commentCount":0,"publisher":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#organization"},"keywords":["Information Security","ISMS","ISO27001","Security"],"articleSection":["Security","Security News","Security Risk Management"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/#respond"]}]},{"@type":"WebPage","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/","url":"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/","name":"ISMS: New version of ISO\/IEC 27001 - Time to update?","isPartOf":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#website"},"datePublished":"2013-10-14T21:13:08+00:00","dateModified":"2013-12-30T20:22:34+00:00","description":"ISMS news: with the release of the 2013 version of the ISO27001 standard, organisations need to decide how they will seek accreditation.","breadcrumb":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/"]}]},{"@type":"BreadcrumbList","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/10\/isms-new-version-isoiec-27001\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Halkyn Security","item":"http:\/\/www.halkynconsulting.co.uk\/a\/"},{"@type":"ListItem","position":2,"name":"Security","item":"http:\/\/www.halkynconsulting.co.uk\/a\/category\/security\/"},{"@type":"ListItem","position":3,"name":"ISMS: New version of ISO\/IEC 27001 – Time to update?"}]},{"@type":"WebSite","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#website","url":"http:\/\/www.halkynconsulting.co.uk\/a\/","name":"Halkyn Security Blog","description":"Specialist Security & Risk Management Consultants","publisher":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/www.halkynconsulting.co.uk\/a\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#organization","name":"Halkyn Consulting","url":"http:\/\/www.halkynconsulting.co.uk\/a\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2011\/07\/Untitled-1.png?fit=990%2C170&ssl=1","contentUrl":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2011\/07\/Untitled-1.png?fit=990%2C170&ssl=1","width":"990","height":"170","caption":"Halkyn Consulting"},"image":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/2329571","https:\/\/twitter.com\/HalkynSecurity"]},{"@type":"Person","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/3cfcd2267f12bbcce6a10159022c3df2","name":"Halkyn Security","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4126abc936773e5e8bd38e030d54306e161190a7d6166dba7edadb6caf13b504?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4126abc936773e5e8bd38e030d54306e161190a7d6166dba7edadb6caf13b504?s=96&d=retro&r=g","caption":"Halkyn Security"},"description":"Halkyn Security Consultants.","sameAs":["http:\/\/www.halkynconsulting.co.uk\/"],"url":"http:\/\/www.halkynconsulting.co.uk\/a\/author\/halkyn-consulting\/"}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9yHvD-eZ","jetpack_likes_enabled":true,"_links":{"self":[{"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts\/929","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/comments?post=929"}],"version-history":[{"count":10,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts\/929\/revisions"}],"predecessor-version":[{"id":960,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts\/929\/revisions\/960"}],"wp:attachment":[{"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/media?parent=929"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/categories?post=929"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/tags?post=929"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}