Bilgi güvenliği yönetimi standardı ISO 27001 ilk olarak 2005 yılında yayınlanmıştır. 2013 yılında revize edilmiş ve 2022 yılında tekrar güncellenmiştir ve Ek A'da önemli değişiklikler yer almaktadır. Şirketiniz ISO 27001 sertifikasına sahipse, bu güncellemelerin Ek A'da yer alan güvenlik kontrollerine yansıdığını göreceksiniz.

ISO 27001'DE NE DEĞİŞTİ?

ISO 27001 – Ek A'nın yapısı tamamen elden geçirilmiştir. ISO 27001'in güncellenmiş versiyonu yeniden yapılandırılmış ve revize edilmiştir. İlk olarak, değiştirilmiş ISO 27001, yaygın olarak kullanılan "uygulama kuralları" ifadesi ile tanımlanmaz. Bu, bilgi güvenliği kontrolleri seti aracılığıyla amacının ana hatlarını çizmeye yardımcı olur.

İkinci olarak, ISO 27001'in yeni sürümünde kontrol sayısı 114'ten 93'e düşürülmüştür. Bu güvenlik kontrolleri, önceki 14 bölüm yerine şimdi dört bölüme ayrılmıştır. ISO 27002:2022'nin yeni etki alanları şunlardır:

Bölüm 5: Organizasyonel (37 kontrol)
Bölüm 6: İnsanlar (8 kontrol)
Bölüm 7: Fiziksel (14 kontrol)
Bölüm 8: Teknoloji (34 kontrol)

2022 DEĞİŞİKLİKLERİ MEVCUT ISO 27001 SERTİFİKAMI NASIL ETKİLEYECEK?

Yeni güncellemeler, ISO 27001 standardına göre mevcut sertifikanızı etkilemez. Bunun yerine, akreditasyon kuruluşları, ISO 27001 sertifikasına sahip kuruluşların daha yeni sürüme verimli bir şekilde geçmelerini sağlamak için bir geçiş döneminde belgelendirme şirketleri ile ortaklaşa çalışacak.

Yine de, ISO 27001'in güncellenmiş versiyonu yayınlanmış olsa bile, Uygulanabilirlik Beyanınız (SoA), ISO 27001:2013 Ek A'da yer alan kontrollere atıfta bulunmalıdır. ISO 27002:2022, yalnızca diğer kontrollere referans olarak ve değişiklikleri anlamak için kılavuz olarak kullanılmalıdır.

ISO 22000:2005 certificate will be invalid in 3 years after publication of new standard. 3 years period was provided for transition to have ISO 22000:2005 certified companies and deadline was determined as  29.06.2021.  After that date ISO 22000:2005 certificates will be invalid.

Companies can make transition to new ISO 22000:2018 FSMS during initial certification audit and surveillance or re-certification audit.

INSPECT expect some preparations related with transition to ISO 22000:2018 from companies who have ISO 22000:2005 FSMS certificate. It will be effective and good application to make some regulations to update and continued documents. To proceed transition period properly;

       a.Please inform us in advance that you will be audited for ISO 22000:2018 version

       b. Prepare your implementation plan

       c. Meet ISO 22000:2018 requirements (training and provision of awareness etc.)

       d. Close nonconformities after audit within period which defined by INSPECT rules

Initial certification process will be applied to customers who didn’t make transition up to June 2021 by surveillance audit and/or re-certification audit or extra audit.

It is strongly recommended that start to do necessary Works to companies who has ISO 22000:2005 Food Safety Management System for continuity of certificate and not to encounter unwanted situations.  

GENERAL RULES FOR COMPANIES RECEIVED CERTIFICATE FOR THE FIRST TIME

Initial certification audit according to ISO 22000:2018 will be started after accreditation audit of INSPECT at 2019.

Audits of companies want to take ISO 22000:2018 certificate prior to INSPECT accreditation audit will be performed, certificates will be published without accreditation.  
Initial certification applications done for ISO 22000:2005 will be accepted up to 28.01.2021, since 29.01.2021  initial certification applications will be accepted only ISO 22000:2018.

 PRE-CERTIFIED COMPANIES

All organizations certified by our organization in accordance with ISO 22000: 2005 will have their own management systems compatible with the new version and will be carried out with supervision and re-certification audits. If the transition is to be carried out by the surveillance audit, the duration of the surveillance audit shall be applied as long as the re-certification audit. Since 29.01.2021 surveillance and re-certification audits will be performed according to only ISO 22000:2018, ISO 22000:2005 certificates will be invalid since 30.06.2021.

FSSC Ver 5.1 version was released in December 2020. Top 3 key factors in the release of this update; • Inclusion of GFSI benchmarking requirements version 2020

• Strengthening the licensing process and Integrity Program
• Minor changes and corrections to V5 Foundation requirements. Certification from FSSC22000 Ver 5.1 will continue as of April 1, 2021.

Transition audits of all certified organizations must be completed between April 1, 2021 and March 31, 2022.

It is possible to upgrade in re-certification or surveillance audits. In addition, if you are in a year when an unannounced audit is required, the upgrade audit can also be performed unannounced.

It is not possible to directly upgrade to Ver 5.1 in FSSC22000 Ver 4.1. Organizations applying for certification for the first time after April 1, 2021 have received their Stage 1 and Stage 2 audits for Ver 5.1 Stage 1 audit will be performed according to Ver 5 when performed before April 2021.

Stage 2 auditing continues with Ver 5.1. Due to Corona, the certificate period has been extended until April 1, 2021, and after April 1, 2021, an organization that is in the re-certification year can be transitioned to 5.1 in Ver 4.1. In this case, the first surveillance audit of the organization is carried out in 2021.

INSPECT is about to complete the necessary preparations for the SABER SALEM program made by the Saudi Arabian standard organization SASO.

Based on this, it has passed the ISO 17065 audit in October 2021 and will become a Notified Body as soon as possible and will be included in the list of authorized organizations.