When ISO/IEC 27001 was revised and published in 2022, the changes were smaller than many expected in the management system clauses but more visible in Annex A, the catalogue of reference controls. Organisations certified to the 2013 edition were given a transition period to move to the 2022 version, and that period has now ended. Certificates issued under the old edition are no longer valid, so any organisation still describing its ISMS in terms of the 2013 Annex A should check its status with its certification body without delay.

This article summarises what changed, what stayed the same, and what a sound ISMS should look like today.

The big picture

ISO/IEC 27001:2022 retains the same management system approach, with clauses 4 to 10 covering context, leadership, planning, support, operation, performance evaluation and improvement. The core requirements, such as the risk assessment, risk treatment plan, Statement of Applicability, internal audit and management review, remain.

The main changes were:

  • Annex A restructured. The reference control set aligned with ISO/IEC 27002:2022.
  • Controls reorganised into four themes.
  • Some controls merged, some removed, and new controls added.
  • Minor clarifications in the main clauses, such as planning of changes to the ISMS and defining processes and criteria for operational planning.

From 14 domains to 4 themes

The 2013 edition grouped 114 controls into 14 domains. The 2022 edition groups 93 controls into four themes:

  1. Organisational controls (37 controls). Policies, roles, asset management, access control, supplier relationships, incident management, continuity, legal and compliance and similar governance-focused topics.
  2. People controls (8 controls). Screening, terms of employment, awareness and training, disciplinary process, responsibilities after termination, confidentiality agreements, remote working and reporting of events.
  3. Physical controls (14 controls). Secure areas, physical entry, equipment security, clear desk and screen, secure disposal, cabling security and related protections.
  4. Technological controls (34 controls). Endpoint security, privileged access, authentication, malware protection, vulnerability management, configuration, backup, logging, monitoring, network security, cryptography, secure development and similar technical safeguards.

The reduction from 114 to 93 mostly reflects consolidation of overlapping controls, not removal of whole areas of protection.

The 11 new controls

The 2022 edition introduced eleven controls not present in the earlier set:

  • Threat intelligence.
  • Information security for use of cloud services.
  • ICT readiness for business continuity.
  • Physical security monitoring.
  • Configuration management.
  • Information deletion.
  • Data masking.
  • Data leakage prevention.
  • Monitoring activities.
  • Web filtering.
  • Secure coding.

These reflect how technology and threats have evolved: wide cloud adoption, stronger privacy expectations and an emphasis on detection and secure development.

Attributes and flexibility

ISO/IEC 27002:2022 introduced attributes for each control, such as control type (preventive, detective, corrective), security properties (confidentiality, integrity, availability), cybersecurity concepts, operational capabilities and security domains. These attributes help organisations filter, group and report on controls in ways that suit them. They are guidance, not mandatory requirements, but they can make risk treatment and reporting more precise.

What a transition involved

For organisations moving from 2013, the typical steps were:

  1. Gap analysis between the old and new control sets, identifying new controls and changed wording.
  2. Updating the risk assessment and risk treatment plan to reflect the revised control set.
  3. Revising the Statement of Applicability, with justification for each control's inclusion or exclusion and its implementation status.
  4. Implementing missing controls, especially the new ones, such as threat intelligence, data masking and secure coding practices.
  5. Updating documentation, training and internal audit programmes.
  6. Completing a transition audit with the certification body.

Organisations that did this well used it as an opportunity to improve their security, not merely to rename controls.

How to check your ISMS today

Even if your certification is current under the 2022 edition, it is worth verifying quality:

  • Does your Statement of Applicability reference the 2022 controls correctly, with clear implementation status and rationale?
  • For each of the eleven new controls, can you show how you have addressed it or why it is not applicable?
  • Do your risk treatment decisions actually drive the controls in the SoA?
  • Have internal audits covered the new and changed controls?
  • Do policies and procedures reflect current practices, particularly for cloud services, secure development and monitoring?

Where organisations often stumble

  • Marking new controls as "not applicable" without sound justification, for example excluding secure coding while developing software.
  • Treating data masking and data leakage prevention as tool purchases instead of risk-based decisions about where they are needed.
  • Overlooking cloud service governance, even though most organisations rely heavily on cloud providers.
  • Failing to define how threat intelligence is collected, analysed and used, resulting in feeds nobody acts on.
  • Not updating training to reflect new expectations.

Impact on other frameworks

The 2022 control set is often used as a backbone for unified compliance frameworks. Mapping to SOC 2, sector regulations and data protection requirements is generally straightforward, and many organisations find that the new technological controls align well with expectations in those frameworks.

Request a gap analysis

If you are unsure whether your ISMS fully reflects the 2022 edition, or you are preparing for a surveillance or recertification audit, a focused review can reveal the gaps. F9 Infotech offers ISO 27001:2022 gap analyses with prioritised actions. Request a 2022 transition gap analysis.

This article summarises publicly known features of ISO/IEC 27001:2022 and 27002:2022. Consult the standards and your certification body for authoritative requirements.