What are the biggest changes to ISO 27001: 2022?

There are a number of changes in the 2022 update of the ISO 27001 standard. This includes some reformatting of controls that were already required in the 2013 version but there are also some completely new thematic areas that organizations will now need to demonstrate their compliance against.

These additional requirements include (but are not limited to) data leak prevention, web filtering, business continuity of ICT systems, physical security monitoring, management of configuration changes, secure coding, and threat intelligence.

I’m going to focus on the threat intelligence requirement (Annex A, Control 5.7), which may be a completely new area for some organizations that don’t already have processes in place to collect and analyze information about threats.