ISO/IEC 27001:2022: what changed and how audits treat it

Where things stand

ISO/IEC 27001:2022 replaced the 2013 edition in October 2022. The International Accreditation Forum gave certified organisations a three-year transition period, which has now closed, so every accredited ISO 27001 certificate should reference the 2022 edition.

That does not make the changes old news. Many organisations moved across by renaming controls in a spreadsheet rather than by changing how they work, and surveillance audits are now testing whether the new controls operate in practice. If you are certifying for the first time, or picking up an ISMS someone else built, it helps to know which parts of the standard are newer and where auditors tend to probe.

Changes in the main clauses

Clauses 4 to 10 follow the harmonised structure shared by ISO management system standards, and most of the 2022 changes came from aligning with that structure. Individually they are small. Together they push the ISMS towards defined processes, measurable objectives and controlled change.

An amendment published in 2024 also added climate change to clauses 4.1 and 4.2. You are asked to decide whether climate change is a relevant issue for your ISMS and whether interested parties have requirements related to it; for many organisations the honest answer is brief, but it needs to be considered and recorded.

• 4.2 asks which interested party requirements will be addressed through the ISMS.
• 4.4 expects the processes needed by the ISMS and their interactions to be established.
• 6.2 adds that information security objectives are monitored and made available as documented information.
• 6.3 is new: changes to the ISMS are to be carried out in a planned manner.
• 8.1 asks you to set criteria for processes and control them against those criteria.
• 9.2 and 9.3 are split into sub-clauses, and management review now covers changes in the needs and expectations of interested parties.

Annex A: 93 controls in four themes

The 2013 Annex A listed 114 controls in 14 domains. The 2022 version has 93 controls grouped into four themes: organisational, people, physical and technological. Most of the reduction came from merging controls that overlapped, not from removing requirements.

Annex A mirrors ISO/IEC 27002:2022, which gives each control a purpose and guidance and tags it with attributes such as control type and security property. You do not have to use the attributes, but some organisations find them helpful for filtering controls by audience, for example handing the technological theme to the infrastructure team.

• Organisational controls: 37, covering policies, roles, suppliers, incidents and compliance.
• People controls: 8, covering screening, awareness, terms of employment and remote working.
• Physical controls: 14, covering perimeters, entry, equipment and secure disposal.
• Technological controls: 34, covering access, cryptography, logging, development and networks.

The 11 new controls

Eleven controls have no direct counterpart in the 2013 edition. They reflect how most organisations now operate: on cloud services, with large volumes of data, and against threats that change quickly. Auditors usually ask to see each one working, not only a policy statement.

For each new control, decide whether it applies, who owns it and what evidence shows it operating. Threat intelligence, for instance, is easier to evidence with a short monthly note of what was received and what was done about it than with a policy paragraph.

Several of the new controls connect to other standards. Data masking and information deletion support privacy obligations under ISO/IEC 27701, and secure coding and configuration management matter to organisations building AI systems under ISO/IEC 42001. Where you hold more than one certification, design the evidence once and reference it from each system.

• 5.7 Threat intelligence and 5.23 Information security for use of cloud services.
• 5.30 ICT readiness for business continuity and 7.4 Physical security monitoring.
• 8.9 Configuration management and 8.10 Information deletion.
• 8.11 Data masking and 8.12 Data leakage prevention.
• 8.16 Monitoring activities, 8.23 Web filtering and 8.28 Secure coding.

Rework the Statement of Applicability properly

The Statement of Applicability is where weak transitions show. A mapping table from old control numbers to new ones is a useful working document, but the SoA itself should state, for each of the 93 controls, whether it is included, why, and whether it is implemented.

Justifications should trace back to your risk assessment and to legal, contractual or business requirements. If a control is excluded, the reason should be specific to your organisation; "not applicable" on its own rarely satisfies an auditor. Check that your risk treatment plan references the new control numbers, so the two documents tell the same story.

Annex A is a reference list, not a ceiling. If your risk assessment identifies a need for a control that Annex A does not describe, add it to the SoA as an additional control and manage it like any other.

How audits treat it now

With the transition period over, auditors assess the 2022 requirements as normal requirements. A missing new control, a stale SoA or no evidence of planned change under 6.3 is raised as a nonconformity in the usual way, graded by its effect on the ISMS.

Surveillance audits sample, so not every new control is examined each year. Over the three-year cycle, expect all of them to be covered, with more attention on the ones that matter most to your risks. Organisations that also hold ISO/IEC 27701 or ISO/IEC 42001 will find the auditor checking that the 27001 changes are reflected where those systems depend on it.

A practical order of work

If you are tightening an ISMS that moved across in a hurry, work from the foundations outward. Changes to scope and context affect the risk assessment, which affects the SoA, which drives the controls.

None of this needs to happen at once. Spread the work over a few months, record what you changed and why, and the change record itself becomes evidence for clause 6.3.

• Revisit context and interested parties, including the climate change question.
• Re-run the risk assessment against the current Annex A and record the result.
• Rebuild the SoA with a justification for every control.
• Assign owners and evidence for the 11 new controls.
• Set up a simple change record to show 6.3 working.
• Run an internal audit and a management review against the 2022 text before your next surveillance.