ISO/IEC 27001:2022: A Restructured Set of Information Security Controls
The 2022 edition of ISO/IEC 27001 was published in October 2022. The management system clauses change little; the list of controls in Annex A is reorganised and updated.
Key points
- ISO/IEC 27001:2022 was published in October 2022, with a three-year transition to 31 October 2025.
- Annex A now has 93 controls in four themes, in place of 114 controls in 14 groups.
- Eleven controls are new, including threat intelligence, cloud services and data leakage prevention.
What changed
Clauses 4 to 10 were aligned with the current ISO common structure, with small additions such as planning of changes. The larger change is in Annex A, which now mirrors ISO/IEC 27002:2022.
The four themes
- Organisational controls
- People controls
- Physical controls
- Technological controls
What certified organisations should do
Map the existing statement of applicability to the new controls, assess the eleven new controls against your risks, and update the risk treatment plan. Organisations that integrate information security with ISO 9001 or ISO 22301 can review shared processes at the same time.