ISO/IEC 27001:2022

This download includes the ISO/IEC 27001:2022 mandatory requirements only so there are no mapped questions. Use this download if you just want the provisions and you want to create your own question set.

ISO 27001 (ISO/IEC 27001:2022) is the international standard that provides the specification for an information security management system (ISMS). The latest version was published in October 2022.

This standard has been licensed from ISO for use internally in the 6clicks platform only. This content is made available on a view only basis for the purpose of linking to questions (in an Assessment) and controls (in a Control Set). Use or reproduction of this content outside of the 6clicks platform must be in accordance with your own Standards Australia License.

As a condition of use for the download of this particular marketplace item, we request that you hold your own suitable license from the relevant body for your use of this content.

The Standard is designed to help organisations manage their information security processes in line with international best practice while optimising costs. It is technology and vendor neutral and is applicable to all organisations - irrespective of their size, type or nature.

The Standard takes a risk-based approach to information security, requiring organisations to identify threats to their organisation and select appropriate controls to tackle them.

The mandatory requirements are outlined in sections 4-10 of the Standard. There are 30 clauses in total, each with multiple sub-requirements, and are summarised below:

4. Context of the organisation

5. Leadership

6. Planning

7. Support

8. Operation

9. Performance evaluation

10. Improvement

Key Changes

• Clause 4.3 has point c) inserted to clarify which requirements of interested parties will be addressed through the ISMS. This helps in defining the scope and context of the ISMS.
• Clause 6.2 has been updated to confirm that information security objectives and planning to achieve them must be specifically "monitored". Clause 6.3 has been added to confirm that when an organisation determines the need for changes to the ISMS, the changes are carried out in a planned manner.
• Clause 9.2 has been split into 9.2.1 (General) and 9.2.2 (Internal audit programme) and Clause 9.3 has been split into 9.3.1 (General), 9.3.2 (Management review inputs) and 9.3.3 (Management review results). These changes appear to be largely typographical. Although 9.3.2 (c) clarifies changes in needs and expectations of interested parties that are relevant to the ISMS should be covered in management review.
• 10.1 and 10.2 have been switched around

Business Case

6clicks marketplace is a platform that allows organizations to identify, assess and manage their cyber risks. It provides a comprehensive view of an organization's attack surface, identifying potential vulnerabilities and threats, and enabling proactive measures to protect their networks and data. 6clicks also allows organizations to demonstrate their compliance with various regulatory requirements such as ISO/IEC 27001:2022, PCI DSS, HIPAA and others.

By using 6clicks, organizations can automate and streamline the process of demonstrating compliance with the standard, including continuous monitoring of the controls in place and regular assessments. 6clicks also provides a detailed reporting and analytics, which enables businesses to track their progress over time and identify areas where they need to improve. In addition, 6clicks has a built-in compliance library which includes ISO/IEC 27001:2022 controls, allowing organizations to easily map their implemented controls to the standard and quickly identify any gaps in their controls and take appropriate action to address them.