ISO 27001:2022 is the latest version of the international standard for information security management systems. The update introduces important changes that affect both new implementations and existing certified organisations.
New control structure
The previous control annex (Annex A) with 14 categories and 114 controls has been restructured into 4 themes and 93 controls:
- Organisational controls (37)
- People controls (8)
- Physical controls (14)
- Technological controls (34)
New controls
11 entirely new controls have been added, including:
- Threat intelligence
- Information security for use of cloud services
- ICT readiness for business continuity
- Physical security monitoring
- Configuration management
- Data masking
What does this mean for you?
If you are already certified, you need to update your Statement of Applicability (SoA) and ensure that the new controls are addressed. The transition period expires in October 2025.
If you are planning a new certification, you should base it directly on the 2022 version.
Need support with the transition to ISO 27001:2022? Contact us and we will help you.
More insights
Related articles
Resilience becomes law. What Sweden's new CER law means for you
Sweden's CER law is set to take effect on 1 January 2027, adding resilience requirements for essential services. Here is how to prepare in time.
The CRA gets real in September. How to prepare your reporting
On 11 September 2026 the CRA's reporting obligations take effect and cover every product with digital elements already on the market. Here's how to prepare in time.
The quantum threat is a leadership question, not a technical one
The quantum threat isn't about when the quantum computer arrives, but how long your information must stay secret. Here's how to begin the move to post-quantum cryptography.