Introduction CyberSecurity Malaysia | An Agency Under MOSTI

e-Security | Vol: 36-12014 © CyberSecurity Malaysia 2014 - All Rights Reserved 9 ISOIEC 27001 was revised and only recently published on 1st October 2013. The revised version, known as ISOIEC 27001:2013 Information Security Management System ISMS - Requirements, replaces the old ISO IEC 27001:2005 ISMS - Requirements which has been the main reference since 2005. To ensure continuous compliance to ISOIEC 27001, it is necessary for organisations with existing ISOIEC 27001:2005 certiication to migrate to the revised ISOIEC 27001:2013. This article provides an overview of the changes in ISOIEC 27001 since 2005, and guidance for organisations to migrate to ISOIEC 27001:2013. 2. Whats new in ISOIEC 27001:2013? The first major change is the structural change. This is to align the standard to other management system standards published by ISO. The new structure of ISOIEC 27001:2013 mirrors the high level structure of the management system standards. Thus, the four mandatory clauses in ISOIEC 27001:2005 have now been increased to eight clauses refer Table 2. The new structure will make it easy for organisations that have achieved ISOIEC 27001 certification to achieve other management system standard certifications such as ISO 9001, ISO 14001, etc. Table 2: Mandatory clauses in ISOIEC 27001 Mandatory clauses in ISOIEC 27001:2005 Mandatory clauses in ISOIEC 27001:2013 Clause 4 Information Security Management System Clause 4 Context of the organisation Clause 5 Management responsibility Clause 5 Leadership Clause 6 Internal ISMS audits Clause 6 Planning Clause 7 Management review of ISMS Clause 7 Support Clause 8 ISMS improvement Clause 8 Operation Clause 9 Performance evaluation Clause 10 Improvement In addition, the risk assessment approach in this standard is more flexible as compared to the previous version. Requirement for risk assessment in ISO IEC 27001:2013 does not require that assets, threats and vulnerabilities to be identified. Thus, organisations are free to select whichever risk assessment methodology that suits them. As organisations may have an existing enterprise risk management approach, this will allow organisations to have a common risk assessment methodology even for information security risk assessment. The other significant change to ISO IEC 2700:2013 is in Annex A. Annex A defines information security controls and the control objectives. This annex remains in ISOIEC 27001 but the number of controls is reduced from 133 to 114 due to several controls being combined together. The number of control areas is now 14. They are: A.5 Information security policies, A.6 Organisation of information security, A.7 Human resources security, A.8 Asset management, A.9 Access control, A.10 Cryptography, A.11 Physical and environmental security, e-Security | Vol: 36-12014 © CyberSecurity Malaysia 2014 - All Rights Reserved 10 A.12 Operations security, A.13 Communications security A.14 System Acquisition, development and maintenance, A.15 Supplier relationships, A.16 Information security incident management, A.17 Information security aspects of business continuity, and A.18 Compliance. Refer to Figure 1 for the overall view of the new ISMS requirements and information security controls in ISO IEC 27001:2013. Figure 1: Requirements and information security controls in ISOIEC 27001:2013 And lastly, the contents of standard has been revised and improved overall in the hope that it is better understood by organisations. For example, in ISO IEC 27001:2005 version, the topics for conducting ISMS review were scattered in various clauses, but in this new standard, the topics were grouped together under Clause 9 Performance Evaluation. 3. How to migrate to the new ISOIEC 27001:2013? Firstly, organisations are recommended to send their relevant personnel for training sessions. Personnel who are in charge of ISMS should attend relevant training sessions to have a better understanding of these new requirements in ISOIEC 27001:2013. Examples of the relevant training programmes are Introduction to ISO IEC 27001:2013 and Migration to ISO IEC 27001:2013. Next, organisations which have implemented ISOIEC 27001:2005 are advised to conduct a thorough gap analysis. This is due to several requirements and controls that have been added, reviewed or deleted in the revised ISOIEC 27002:2013. By conducting a thorough gap analysis, the organisation will be able to assess the gap between the current implemented ISMS and the new ISOIEC 27001; and understand additional actions that are needed to be taken to comply with the new ISOIEC 27001. They will also be able to develop a detailed plan with timeline for the ISOIEC 27001:2013 migration. Furthermore, organisations should review their current documents; as most probably they need to change and update their documents to suit to ISO IEC 27001:2013. One document that must be updated is the Statement of Applicability SOA. An SOA is a document describing the control objectives and controls that are relevant and applicable to the organisations ISMS. SOA lists all information security controls that organisations have implemented and should be implementing. If there are new information security controls from ISOIEC 27002:2013 that should be implemented, the SOA should be updated to reflect this change. Furthermore, there are also a possibility for organisations to develop new policy