27th January 2025, Serdang – Universiti Putra Malaysia (UPM) is in the process of implementing the migration to a new standard for the Information Security Management System (ISMS) from MS ISO/IEC 27001:2013 to MS ISO/IEC 27001:2022. In relation to this, the Documentation Section, Office of the Deputy Director of Service Quality Assurance, Centre for Quality Assurance  has prepared the work plan for the migration during the 2024/2025 period. One of the tasks that need to be carried out is the refinement of the operation and risk documents for the Information Security Management System (ISMS). Therefore, the Centre for Quality Assurance  held a series of workshops titled " Bengkel Pemurniaan Dokumen Dan Risiko Sistem Pengurusan Keselamatan Maklumat (ISMS) MS ISO/IEC 27001:2022" on 12th December 2024 at Putra Future Classroom (PFC), Faculty of Educational Studies, UPM. This workshop was attended by 25 UPM officers, including members of the UPM ISMS Committee and the UPM ISMS Risk Assessment Committee. Centre for Quality Assurance  invited Puan Wan Noor Asiah Binti Wan Mohamad Nawi, a Training Consultant from the Digital Technology Training Section, School of Information Technology and Technology Development (IMATEC), Intan Main Campus, to be the speaker for the workshop. The workshop began with an opening address by Puan Haslida Hassan, Deputy Director of Service Quality Assurance, Center for Quality Assurance followed by a short briefing on the objectives and goals of the workshop presented by Puan Nurainakmal Kamal Bahrin, ISMS Coordinator at UPM. Puan Wan Noor Asiah, the workshop facilitator, also shared insights and explanations regarding the changes between the old ISMS standard, MS ISO/IEC 27001:2013, and the new standard, MS ISO/IEC 27001:2022. One of the key changes shared was in the Statement of Applicability (SOA), where the old standard involved 114 controls, while the new standard reduced this to 93 controls, which are categorized into four main control areas: Organizational Controls, People Controls, Physical Controls, and Technological Controls. Subsequently, each ISMS team/process leader discussed and reviewed the updated SOA list in alignment with the new standard requirements. Additionally, the UPM ISMS team identified a new method for ISMS risk assessment, as the existing system, MyRAM, no longer can be used due to the changes in the new standard. Overall, participants provided feedback on the effectiveness of the workshop, rating it between 4 and 5 on a scale of 5. The update of the SOA documents will continue with several workshops scheduled for early 2025 to ensure all ISMS controls and reference documents are ready in preparation for the MS ISO/IEC 27001:2022 Internal Audit Course and the UPM ISMS Internal Audit, which will take place between April and June 2025.

Date of Input: 31/01/2025 | Updated: 02/02/2025 | aidawati