How does the ISO 27001 revision impact your risk management?
1. What else is new in ISO 27001? Is it only about risk?
No, there are plenty of other changes. For example, management will have an increased responsibility in IT Risk Management. There will also be increased flexibility in your choice of risk method.
The revision is still only a draft, so changes can still occur.
2. Will it take a great amount of effort to shift to the new ISO 27001?
No, quite the contrary. ISO 27001 is not filled with technical demands for your security, internal audit, or other. The 2013 draft has the same main content as the 2005 version; The purpose and many activities are the same.
The main difference is that the way it is presented has been altered, creating sharper formulations, and some areas are given more flexibility.
A transition would therefore not require lots of extra effort on your part.
Further, you have absolutely nothing to fear if your company is already ISO 27001 certified.
3. Are there any consequences for the management (risk owner) if you do not live up to the compliance?
There will be consequences for the risk owner only if your company has decided that they should exist. It can, however, have consequences for your ISO 27001 certification and may result in a reprimand during an audit.
4. Is there a good mapping between NIST SP 800-53 controls and ISO 27001?
Yes, the National Institute of Standards and Technology has published a paper on the issue. You can find it here.
5. When will the platform reflect the new ISO 27001 standard?
Shortly after, the new ISO 27001 changes will be finalised and made public.
6. Is there already a paper about risk management in the new ISO 27001?
To my knowledge, there are currently no specific papers available on this topic.
