ISO/IEC 27001:2022 — A Complete Transition Guide
The October 2022 publication of ISO/IEC 27001:2022 introduced the most substantial revision to the information security management standard in a decade. Organisations certified to the 2013 version had until October 2025 to complete their transition — but the implications of the new structure extend far beyond a simple recertification exercise.
The Restructured Annex A
The headline change is the reorganisation of Annex A controls:
| Version | Controls | Sections |
|---|---|---|
| ISO 27001:2013 | 114 controls | 14 sections |
| ISO 27001:2022 | 93 controls | 4 themes |
The 4 New Themes
- Organisational Controls (37 controls) — policies, information security roles, threat intelligence, asset management
- People Controls (8 controls) — screening, terms of employment, training, disciplinary process
- Physical Controls (14 controls) — physical security perimeters, clear desk/screen, equipment security
- Technological Controls (34 controls) — endpoint security, network filtering, DLP, SIEM, data masking
11 New Controls in 2022
The 2022 revision introduced 11 entirely new controls, including:
- 5.7 Threat Intelligence — monitoring and analysing threat information
- 5.23 Information Security for Cloud Services — policies for cloud acquisition and use
- 5.30 ICT Readiness for Business Continuity — aligned with ISO 22301
- 7.4 Physical Security Monitoring — CCTV, intrusion detection
- 8.9 Configuration Management — hardware, software, and network configurations
- 8.10 Information Deletion — secure deletion across media types
- 8.11 Data Masking — in compliance with PDPA and privacy obligations
- 8.12 Data Leakage Prevention (DLP)
- 8.16 Monitoring Activities — anomaly detection and SIEM
- 8.23 Web Filtering
- 8.28 Secure Coding
What ISMS Holders Must Update
If you are certified to ISO/IEC 27001:2013, your transition checklist includes:
- ✅ Map existing controls to the new Annex A structure
- ✅ Conduct gap analysis for the 11 new controls
- ✅ Update your Statement of Applicability (SoA)
- ✅ Revise relevant policies and procedures
- ✅ Brief your internal audit team on the new requirements
- ✅ Engage your certification body for a transition audit
ICPL offers a structured ISO 27001:2022 Transition Package covering gap analysis, SoA revision, and full certification body liaison. Contact us to begin.
