A Closer Look at the Role of ISO 27001 Controls in Information Security – Updated for 27001:2022

The 2022 ISO® 27001 Controls

ISO®27001:2022 is the latest version of the ISO®/IEC 27001 Information Security Management standard, released to help organizations protect their data and assets from cyber threats. The changes in this version are mostly cosmetic, including restructuring and refining existing requirements.

The new version comes with 93 controls, including 11 new ones. 24 controls were merged, and 58 controls were revised to align with current cybersecurity and information security requirements.

While the core management processes of ISMS remain the same, the control set in Annex A has been revised to address contemporary risks and their corresponding controls.

The controls are now categorized into four groups: 

• Organizational

• People

• Physical

• Technological

An attribution taxonomy now accompanies each control.

Attributes

The ISO® 27001:2022 update also introduces a new structure for security controls, consisting of five attribute categories:

• Control types: Preventive, Detective, and Corrective.

• Cybersecurity concepts: Identify, Protect, Detect, etc.

• Security domains: Governance and Ecosystem, Protection, Defense, etc.

• Properties of information security: Confidentiality, Integrity, and Availability.

• Operational capabilities: Governance, Asset Management, Information Protection, etc.

These five attributes assign one or more values to each security control. The purpose of this change is to enhance the grouping and sorting of controls, making it easier for users to find the relevant controls based on their specific needs. 

For instance, if you are interested in implementing controls related to governance, you can simply filter the controls by this attribute and access a list of relevant controls to choose from.

Now, let's delve into each control and its practical applications:

Organizational (37 Controls)

Organizational controls categorized as ISO 27001 Annex A 5.1 to 5.37 cover various aspects of data protection and govern an organization’s overall approach. They consist of policies, rules, processes, procedures, and organizational structures, among other measures.

New controls included are: 

• 5.7: Threat Intelligence

• 5.23: Information security for use of cloud services 

• 5.30: ICT readiness for business continuity 

Threat intelligence is a valuable control addition in this context. It goes beyond simply identifying malicious domain names and helps organizations gain a deeper understanding of potential targeting methods. By leveraging this threat intelligence information, organizations can enhance their information security approach and make more informed decisions.

Practical Application:

• Identify patterns and trends in cyber threats to proactively protect against potential attacks.

• Share threat intelligence with other organizations to create a collective defense against common threats.

• Use threat intelligence to prioritize security efforts and allocate resources effectively.

• Continuously monitor and update threat intelligence to stay ahead of emerging threats.

People (8 Controls)

ISO 27001 Annex A 6.1 to 6.8 comprise the People Controls. They play a crucial role in helping organizations manage the human element of their information security program, including processes for onboarding and offboarding, as well as responsibilities for incident reporting. They establish guidelines for how employees interact with data and each other. 

This theme addresses the practical application of remote work, confidentiality, nondisclosure, and screening to effectively manage how employees interact with sensitive information in their day-to-day roles.

It is worth noting that ISO 27001:2022 does not introduce any new controls specifically related to this theme. However, organizations can still utilize the existing controls to ensure the secure handling of sensitive information in remote work environments.

Physical  (14 Controls)

Numbered ISO 27001 Annex A 7.1 to 7.13, physical controls refer to protective measures put in place to ensure the security of tangible assets. These safeguards can include entry systems, protocols for granting guest access, procedures for disposing of assets, protocols for storing sensitive data, and policies regarding keeping work areas clear of confidential information. These measures are crucial for maintaining the confidentiality of important data.

This category specifically addresses measures taken to guard against physical and environmental risks, including natural disasters, theft, and intentional damage. One of the new additions to the physical controls is 7.4, which pertains to physical security monitoring.  This involves utilizing surveillance systems, access controls, and security personnel to monitor and protect physical assets, ensuring the safety and integrity of the environment. 

By actively monitoring for unauthorized access, suspicious activities, or potential security breaches, organizations can proactively respond to threats and mitigate risks in real-time. This helps to maintain a secure and protected physical environment, minimizing the potential for damage or loss due to external threats.

Technological (34 Controls)

Specifically ISO 27001 Annex A 8.1 to 8.34, technological controls define the regulations and processes that corporations should follow to establish a secure and compliant IT infrastructure. It encompasses authentication, encryption, and preventing data leakage. This includes implementing authentication methods, configuring settings, developing BUDR strategies, and maintaining information logs.

The new technological controls include:

• 8.1: Implementation of data masking 

• 8.9: Management of configurations 

• 8.10: Deletion of information 

• 8.12: Prevention of data leakage 

• 8.16: Monitoring of activities 

• 8.23: Application of web filtering

• 8.28: Adoption of secure coding practices

Data leakage prevention is a significant addition to this category, requiring substantial time and financial investment for initial implementation. 

Another noteworthy control is web filtering, which outlines how organizations should filter web traffic to prevent users from accessing malicious websites.