ISO 27001:2022 - What Changed and Why It Matters

The core of the standard, clauses 4 to 10, keeps the same shape. The visible change is in Annex A, which now follows ISO/IEC 27002:2022. Amendment 1 (2024) then added a requirement to consider whether climate change is a relevant issue when understanding the organisation and its interested parties.

Annex A went from 114 controls in 14 domains to 93 controls in four themes: • Organisational controls: 37 • People controls: 8 • Physical controls: 14 • Technological controls: 34 Of the 93 controls, 11 are new, 24 merge earlier controls and the remainder are updated.

• Threat intelligence • Information security for use of cloud services • ICT readiness for business continuity • Physical security monitoring • Configuration management • Information deletion • Data masking • Data leakage prevention • Monitoring activities • Web filtering • Secure coding

Clause 6.3 adds planning of changes to the management system. Clause 8.1 asks for criteria for processes and for controlling outsourced processes. The Statement of Applicability still has to show which controls apply, why, and whether they are implemented, now against the 2022 control set.

If you were certified to the 2013 edition, the transition is complete or overdue, so confirm the status of your certificate with your certification body. Practical steps for any organisation maintaining ISO 27001: 1. Update the risk treatment plan and the Statement of Applicability to the 93-control set 2. Check that the 11 new controls have an owner, a policy or procedure and evidence 3. Review cloud, deletion, masking and monitoring practices, where most gaps tend to appear 4. Keep evidence against each control so the next surveillance audit does not start from a blank page