ISO 28000:2022 for CISOs

ISO 28000:2022 specifies requirements for a security management system including the aspects critical to the security assurance of the supply chain, on the harmonized structure and the PDCA model: context including the supply chain's requirements, interested parties, a process for legal, regulatory and other security requirements, eight security management principles aligned with ISO 31000 (leadership, a structured process approach, customization, inclusive engagement, integration, dynamic improvement, human and cultural factors, relationship management), scope with control of externally provided processes; leadership and a security policy that allocates accountability and provides for review on merger or acquisition; planning through a proactive risk assessment of failures and malicious acts, environmental and cultural factors, security equipment, information management, threat and vulnerability information and supplier interdependencies, security objectives and planned change; support through resources, competence with security clearance, awareness, communication with sensitivity checks, and documented information whose value, integrity and access are determined; operation through operational control, identification of security processes including for the supply chain, risk assessment and treatment, controls over personnel and security equipment with pre-implementation risk review of organizational, procedural, technological and supplier changes and assurance of external suppliers, security strategies, procedures, processes and treatments selected from vulnerability and threat analysis, and security plans with a response structure, warning and communication procedures that are exercised, plan contents and recovery; performance evaluation through monitoring, risk-based internal audit that verifies the deployment of security equipment and personnel, and management review; and improvement through continual improvement and corrective action with investigation of failures, near misses and false alarms and risk review before implementation. Under ISO 28000:2022, which defines 43 controls, a CISO's work is deciding which controls you own outright, which you share and which belong to another team, then holding the evidence for the first group.