Information security management: a fuzzy DEMATEL analysis of the new ISO/IEC 27001:2022 controls

Purpose This paper aims to analyze the cause-and-effect relationship and the level of influence between the 11 new information security controls proposed by ISO/IEC 27001:2022. Design/methodology/approach A survey with 22 experts, all chief technology officers, was conducted, to assess the influences between each of these controls by means of a pairwise comparison. Then, the fuzzy Decision-making Trial and Evaluation Laboratory (DEMATEL) method was applied to evaluate the relationships and the influence degree between controls. Findings The most influential and impacted controls were identified through the Causal Diagram and the Influence Relationship Map. “Threat Intelligence” and “Secure Development” emerged as the main influencing factors, serving as core components in the evaluation system. This finding aligns with the growing emphasis on protecting data stored in cloud services and addressing emerging threats, highlighting their importance in Information Security Management Systems. Furthermore, the central, driving, independent and impactful controls were identified, as well as their priority in allocating resources for their integration and management. This allows for a strategic and efficient distribution of resources, directing them according to the priority and impact of each control on the security system. Originality/value This study presents an original approach, applying the fuzzy DEMATEL method to analyze the cause-and-effect relationships between the 11 new controls in ISO/IEC 27001:2022. Unlike previous studies, this research reveals the causal structure and prioritization of these updates. By identifying central and influential controls, such as “Threat Intelligence” and “Secure Development,” this study offers strategic insights for managing these new controls, highlighting those that provide strategic leverage in the practical integration of security measures, as well as which should be targets for resource allocation. This new analytical perspective contributes to a deeper understanding of the evolution of the standard in addressing contemporary cybersecurity challenges, offering practical insights to information security managers, enabling proactive risk management, optimized resource allocation and alignment with regulatory compliance frameworks.