When ISO/IEC 27001 was revised in 2022, much of the commentary focused on the restructuring: the old 114 controls in Annex A were consolidated into 93 and regrouped into four themes, organizational, people, physical and technological. The more important change was easier to miss. Among the new controls are several that can’t be satisfied with a policy document. They require operations that actually run.
As an organization certified to ISO/IEC 27001:2022, we think that’s the right direction, and it’s why we treat compliance as a byproduct of running security well.
A policy document can’t prove you monitor your systems. Only operations can.
The new controls that test day-to-day operations
- Threat intelligence: collecting and using information about threats relevant to you
- Information security for the use of cloud services
- ICT readiness for business continuity
- Physical security monitoring
- Configuration management
- Information deletion
- Data masking
- Data leakage prevention
- Monitoring activities: watching networks, systems and applications for anomalous behavior
- Web filtering
- Secure coding
Look at that list from an auditor’s point of view. “Monitoring activities” can’t be evidenced with a policy. You need logs, alerts, someone reviewing them and records of what they did. The same goes for threat intelligence and configuration management. The 2022 revision is, in effect, asking whether your security program operates day to day.
Build controls once, satisfy many frameworks
ISO 27001, SOC 2, NIST CSF and many industry regulations overlap heavily. A single, well-run control for access reviews, logging or incident response can provide evidence for all of them. Map one control set to every framework you need instead of running parallel programs that ask the same people for the same evidence.
Let evidence come from operations
The healthiest audits we see are the ones where evidence is retrieved, not created. Access reviews recorded in the identity platform, changes tracked in the ITSM tool, security events and investigations recorded by the SOC, and vulnerability remediation tracked against deadlines. If your team spends weeks before each audit assembling screenshots, the controls are probably being performed for the audit rather than for security.
Give every control a named owner
A control owned by “IT” is owned by nobody. Name an individual who understands what good looks like and checks the control on a schedule. Owners finding their own control failures before the auditor does is one of the best signs a program is real.
Ask the same of your providers
Your compliance boundary includes every provider with access to your systems or data. Ask for their certificates, and read what’s actually in scope; a certification can cover one entity, location or service and not others. We hold ourselves to that standard and are always happy to walk clients through exactly what our ISO/IEC 27001:2022 certification covers.
Signs your program is real
- Audit evidence comes straight from your systems
- Control owners find failures before auditors do
- One control satisfies several frameworks
- The new 2022 controls are backed by processes that run every day
Done well, certification is simply an independent confirmation that your security works the way you say it does.