itSMF Switzerland - Blog #ISOitSMF Switzerland - Blog #ISOhttps://www.itsmf.ch/blogs/tag/isoThu, 10 Sep 2026 21:41:04 +0200http://zoho.com/sites/<![CDATA[The ISO 27002:2022 standard: the new information security controls]]>https://www.itsmf.ch/blogs/post/the-iso-27002-2022-standard-the-new-information-security-controlsISO released its new 27002:2022 standard updating also the information security controls: let's take a closer look at all the news.]]>

Reading time: ~ 4 min.

The Information Security: the controls set by the new ISO 27002:2022 standard

The International Organization for Standardization (ISO) has recently released the updated version of the guideline for the application of the operational controls for the ISO/IEC standard 27002:2022, also known as the «Information security, cybersecurity and privacy protection - Information security controls».


The new edition of ISO 27001:2022 Information Security Management Systems standard that the worldwide known Organization released some weeks ago – we gave you an update on our post here – refers to Annex A controls of ISO 27002 standard.


The ISO 27002 standard recognizes 4 large groups (clauses or themes) of operational controls:

  1. Organization Controls (aspects related to the organization)
  2. People Controls (details on single individual)
  3. Physical Controls (objects and aspects related to physical & environmental matters)
  4. Technological Controls (aspects related to the technology)
For each single control, the ISO 27002:2022 standard recognizes five attributes that constitute different ways you can adopt on considering the control.

In particular, 5 different views are defined which represent different categorizations of the controls seen from different perspectives:

  • The control type («when and how control changes risk» perspective);
  • The information security properties (integrity, availability and confidentiality perspectives);
  • The cybersecurity concepts (application of controls to information security perspective);
  • The operational capabilities (information security operations perspective);
  • The security domains (governance, protection, defense and resilience perspectives).


To better understand the way ISO 27002:2022 standard refers to the controls, you can take a look at this infographic:

by Andrea Leonardi (VP of Minerva Group Service, MP of Alpemi Consulting & itSMF Swizerland board member).

A closer look at attributes of the controls set by the ISO 27002:2022 standard on Information Security

As we already suggested on the previous paragraph, the new ISO 27002:2022 standard on Information security, cybersecurity and privacy protection - Information Security Controls sets 4 macroscopic groups of operational controls.


Let's take a closer look at each of which, considering the 5 attributes and how they affect the way you can put them in perspective.

1. The Control Type attribute on ISO 27002:2022 standard

The first ISO 27002:2022 standard control attribute we are going to analyse - according to our infographic - is the «Control Type» one.


This one sets the way you can look at the controls from a perspective of «when and how the control modifies the risk» with regard to the occurence of an information security incident.


The «Control Type» attribute values consist of:

  • Preventive (the control that is intended to prevent the occurrence of an information security incident);
  • Detective (the control acts when an information security incident occurs);
  • Corrective (the control acts after an information security incident occurs).

2. The Information Security Properties controls attribute according to ISO 27002:2022 standard

The second of the controls attributes set by the ISO 27002:2022 standard we take into consideration is the «Information Security Properties» one.


In this case, the attribute set a point of view of the controls according to the perspective of

«which characteristic of information the control will contribute to preserving».


The attribute values consist of:

  • Confidentiality;

  • Integrity;

  • Availability.

3. The cybersecurity concepts controls attribute set by ISO 27002:2022 standard

The third of all the controls attributes recognised by the ISO 27002:2022 standard we are considering is the «Cybersecurity concepts» one.


This attribute suggests the way you can view the controls from a perspective of «the association of controls to cybersecurity concepts», as defined in the cybersecurity framework described in the ISO/IEC TS 27110.


In this case, the attribute value consist of:

  • Identify;
  • Protect;
  • Detect;
  • Respond;
  • Recover.

4. The ISO 27002:2022 operational capabilites controls attribute

The fourth attribute of the updated version of ISO 27002:2022 standard we are going to consider is the «operational capabilities» one.


This attribute helps us to view the controls from a «practioner's perspective of information security capabilities».


In this case, the attribute values are:

  • Governance;
  • Asset Management;
  • Information Protection;
  • Human Resource Security;
  • Physical Security, System and Network Security;
  • Application Security;
  • Secure Configuration;
  • Identity and Access Management;
  • Threat and Vulnerability Management;
  • Continuity;
  • Supplier Relationships Security;
  • Legal and Compliance;
  • Information Security Event Management;
  • Information Security Assurance.

5. The security domains controls attribute according to ISO 27002:2022 standard

The last of all the ISO 27002:2022 standard controls attributes we are going to mention is the one known as «Security domains».


This attribute provides us a controls view according to the «perspective of four information security domains», which are:

  1. «Governance & Ecosystem» that includes the «Information System Security Governance & Risk Management» and the «Ecosystem cybersecurity management» (considering also the internal & external stakeholders);
  2. «Protection» that considers all these topics: «IT Security Architecture», «IT Security Administration», «Identity and access management», «IT Security Maintenance» and «Physical and environmental  security»;
  3. «Defence»that contains the «Detection» and «Computer Security Incident Management» matters;
  4. «Resilience» that includes «Continuity of operations» and «Crisis management».
The attribute values consist of:
  • Governance_and_Ecosystem
  • Protection;
  • Defence and Resilience.

Our «breakdown» on ISO 27002:2022 Organizational, People, Physical and Technological Controls

At the ending stage of our overview on the new ISO 27002:2022 standard on «Information security, cybersecurity and privacy protection - Information security controls» we'd like to provide you our breakdown on Organizational, People, Physical and Technological controls.

Our breakdown document on the Organizational, People, Physical and Technological controls.

If you want to download our breakdown document, subscribe to our newsletter. Every month we update you with all the most relevant topics for our ICT Service Management professional community and we give you some preview of «what is happening behind the scenes».

SUBSCRIBE TO OUR NEWSLETTER TO GET THE ISO 27002:2022 DOCUMENT

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter
CONTACT US TO SEND YOUR MESSAGE
DISCOVER OUR EVENT CALENDAR
Get the benefits of Membership Program
]]>Wed, 23 Nov 2022 00:04:32 +0100<![CDATA[Software as a Medical Device (SWaaMD) and the ISO Management Systems]]>https://www.itsmf.ch/blogs/post/software-as-a-medical-device-swaamd-and-the-iso-management-systemsLet's check out more details about Software as a Medical Device & ISO Management Systems and the compliance with EU regulations.]]>

Reading time: ~ 4 min.

Software as a Medical Device: a booming market

Several reports on Software as a Medical Device (SWaaMD) market highlights very interesting growth trends. If you take a look at the last one issued by Industry Research you won't be disappointed by the forecasts on 2022-28 global sales you're going to find on it.


The Global Software as a Medical Device Market Size in 2021 valuation was at 1048 million USD and according to this report it will reach 10190 million USD in 2028, with a CAGR of 38.39%.


In particular, the European SWaaMD market was about 5,430 USD million in 2019 in 2019 and it is expected to reach 24,898 UDS million in 2027, with a Compound Annual Growth Rate of 21.6% (2020-27).


If you think about the reasons why this market shows this promising growing trends you will find probably the memories of the first COVID-19 pandemic wave and the shortage of empty beds in hospital wards worldwide.


The public health systems had to strengthen their digitalization to provide therapies to patients in particular due to the overload of the healthcare infrastructure.

The European SWaaMD market and the compliance with EU regulations

Even if to someone it could seems to be useless to remember, we want to remark that ALL the medical devices you plan to sell on the EU market must be CE marked.


Moreover software can also be classified as medical devices pursuant to EU Regulation 745/2017. In this case, we usually refer to «Software as a Medical Device» (SWaaMD) as outlined by the guidelines «MDCG 2019-11: Guidance on Qualification and Classification of Software in Regulation (EU) 2017/745 - MDR and Regulation (EU) 2017/746 - IVDR».


The exact evaluation on which are the laws you have to make sure you're compliant with to market your SWaaMD in EU it is critical to grant you the access to a growing market that is also regulated with restrictive privacy regulation (GDPR) in particular with sensitive personal data (e.g. the health condition of people).

Software as a Medical Device and the ISO Management Systems

As many other digital solutions, also on the Software as a Medical Device market we find some standards that are useful to define the main references you have to follow to develop products that are going to meet the needs and the expectations of the healthcare industry.


One of the most relevant standard is the IEC 62304:2006 known as a technical international standard about «Medical device software - software life cycle processes». But let focus a little bit more on the relationships you're going to find between ISO management systems and the mandatory requirements.

The ISO management systems and mandatory requirements

If we focus in particular on the correlations between some of the most important ISO management systems and the mandatory requirements (compliance management), we can't forget to mention these ones:
  • IT Service ISO20000-1 about «Software life cycle»
  • ISO9001 and ISO13485about «Quality for SW design and development»
  • ISO/IEC25010:2011about «Models for SW quality»
  • ISO27001 about «Information security for integrity, availability and confidentiality requirements»
  • GDPR (as stated before) and LPD-DSG-LPD (Federal Act on Data Protection) for Switzerland, to be compliant with the privacy requirements refereed to by MDR 745/2017 itself.

To give you a better view on Software as a Medical Device, ISO Management Systems and Compliance, take a look at our infographic.

We will for sure come back on this hot topic in the next posts we are going to publish on our posts.


If you have any question for us, feel free to drop us a line on our contact page.


See you soon again with more relevant content :) and don't forget to follow us on our social media channels.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter
CONTACT US TO SEND YOUR MESSAGE
DISCOVER OUR EVENT CALENDAR
Get the benefits of Membership Program
]]>Wed, 20 Jul 2022 07:00:00 +0200