Today I’ve slogged my way through a stack of ~50 ISO/IEC JTC1/SC27 emails, updating a few ISO27001security.compages here and there on ongoing standards activities.
The most significant thing to report is that the project to revise the 3rd (2013) edition of ISO/IEC 27002 appears on-track to reach final draft stage soon and will hopefully be approved this year, then published soon after (during 2022, I guess).
The standard is being extensivelyrestructured and updated, collating and addressing about 300 pages of comments from the national standards bodies at every stage. The editorial team are doing an amazing job!
The new ‘27002 structure will have the controls divided into 4 broad categories or types i.e.
For comparison, the standard is currently structured into 13 security domains:
‘27002 will nearly double in size, going from 90 to 160 pages or so, thanks to new controls and additional advice including areas such as cloud and IoT security. Virtually all of the original controls have been retained but most have been reworded for the new structure and current practice … and there’s an appendix mapping the old clauses to the new.
‘27001 Annex A is being updated to reflect the changes, and a new version of that standard is due to be published in the 2nd quarter of 2022.
I presume other standards based on ‘27002 (such as ‘27011 and ‘27799) will also be revised accordingly, at some point.
No comments:
Post a Comment
The floor is yours ...