What Changed in ISO 27001:2022
The 2022 revision updates the information security standard to address modern threats and align with current best practices. Organizations with existing certifications must transition by October 2025.
Major Changes
- Annex A Restructuring: Controls reorganized from 14 to 4 categories
- New Controls: 11 new controls addressing cloud, threat intelligence, and data protection
- Updated Controls: Many existing controls revised for clarity and relevance
- Removed Controls: Some redundant controls eliminated
New Control Categories
- Organizational Controls: Policies, responsibilities, threat intelligence
- People Controls: HR security, awareness, access management
- Physical Controls: Physical security, equipment protection
- Technological Controls: Technical security measures
Migration Timeline
Existing certified organizations have a three-year transition period. Plan your gap analysis and remediation activities well in advance of the deadline.
Migration Steps
Conduct a gap analysis against the new requirements, update your Statement of Applicability, implement any new controls, and coordinate with your certification body for the transition audit.