ISO 27001:2013 is an information security standard published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) under the joint ISO and IEC subcommittee. It is a specification for an information security management system (ISMS).

The recent standard ISO 27001:2013 replaced the ISO 27001:2005 standard.

Mentioned below are the significant changes:

Section 4: Context of the Organisation

More importance has been laid on the Internal and external factors which affect the organization’s ability to achieve security objectives

Section 5: leadership

Enhanced rigorous expectation from management
Top Management needs to ensure integration of ISMS requirements into the organization’s processes for various functions

Section 8: Operations

Risk assessment simplified and aligned to ISO 31000
Risk can now be determined based on process ,technology etc. without mapping them with assets, threats and vulnerabilities

General Changes

More emphasis on measuring and evaluating how good organisations ISMS is performing
Preventive action is now part of PLAN phase and integrated with IS risk assessment
Controls in Annex A have been modified to reflect the changing threat scenarios, duplications removed and are better grouped
Separate section for cryptography
More emphasis on outsourcing. Thus a new section on Supplier relationship

Annex A – New Controls