ISO 27001:2022 — What Changed and What It Means for Certified Organisations
ISO 27001:2022 introduced significant changes to the standard. Certified organisations must transition by October 2025. Here is what you need to know.
The ISO 27001:2022 Update
ISO 27001:2022 was published in October 2022, replacing the 2013 version. Organisations certified to ISO 27001:2013 were required to complete transition to the 2022 standard by October 2025. The update reflected the evolution of the information security landscape — cloud computing, remote work, supply chain attacks, and the maturation of threat intelligence and operational security practices.
Main Changes in the 2022 Version
Annex A Control Structure Reorganisation
The 2013 version contained 114 controls in 14 domains. The 2022 version contains 93 controls in 4 themes:
- Organisational Controls (37) — Policies, roles, processes, and organisational security practices
- People Controls (8) — Personnel security, awareness, and training
- Physical Controls (14) — Physical and environmental security
- Technological Controls (34) — Technical security measures
The reorganisation merged similar controls, split some covering multiple topics, and introduced 11 new controls reflecting contemporary security practices.
New Controls in ISO 27001:2022
Eleven new controls address areas not adequately covered in 2013:
Threat intelligence (5.7) — Formalises collection and analysis of threat intelligence relevant to information security risks.
Information security for use of cloud services (5.23) — Governing acquisition, use, management, and exit from cloud services.
ICT readiness for business continuity (5.30) — Explicit requirements for ICT continuity planning integrated with broader business continuity management.
Configuration management (8.9) — Formal configuration management for hardware, software, services, and networks.
Data leakage prevention (8.12) — DLP measures to prevent unauthorised disclosure of sensitive information.
Monitoring activities (8.16) — Monitoring networks, systems, and applications for anomalous behaviour.
Secure coding (8.28) — Applying secure coding principles to software development.
Plus data masking (8.11), information deletion (8.10), web filtering (8.23), and physical security monitoring (7.4).
Transition Programme Implications
Organisations needed to assess their controls and Statement of Applicability against the new Annex A structure, identify which new controls are applicable and implement them, and update their Statement of Applicability to reflect the 2022 control structure.
The transition effort varies significantly. Organisations already with mature threat intelligence, cloud security, DLP, and secure coding practices primarily needed documentation updates. Organisations without these capabilities needed to implement new controls — in some cases requiring significant programme investment.
Gap assessment against the new controls, followed by a prioritised implementation programme and updated documentation, is the standard transition approach.