ISO 27001-compliant UK organisations have just over four months to transition to ISO 27001:2013
Accredited certificates issued to ISO 27001:2005 will no longer be valid after 30 September 2015, in accordance with timescales set by accreditation authorities.
Director of IT Governance Steve Watkins says, “Now is the time to act for those that have not already had their certificate transitioned. The deadline for UKAS-accredited ISO 27001:2005 certificates to complete the change is 30 September 2015 and, with a limited number of auditors at certification bodies’ disposal, it is not as if all certifications can be accommodated at the last moment.”
The ISO/IEC 27001:2013 standard was published in October 2013, replacing ISO 27001:2005 as the international standard defining an effective information security management system.
Some of the major changes include:
• A heightened emphasis on leadership, interested parties, competence and performance metrics.
• Changes to the requirements for scope, the risk assessment methodology and continual improvement.
• Changes to the structure of the Standard and the adoption of core text that will be common across all management system standards in the future.
• Changes to the requirements for record keeping and documentation.
• Changes to the requirements for the Statement of Applicability (SOA).
• The restructuring of Annex A into fewer controls spread across a larger number of categories.
Professionals tasked with transitioning to ISO 27001:2013 will make the most of their preparation if they attend a one-day online ISO 27001 transitioning training course (www.itgovernance.co.uk/shop/p-1464.aspx).
Organisations that require expert support to tackle their transition project in time for their next audit can take advantage of IT Governance’s ISO 27001:2013 Transition Consultancy (www.itgovernance.co.uk/shop/p-1675.aspx).
Desi Aleksandrova
IT Governance
+44 (0) 845 070 1750
email us here
