The 2022 revision of ISO 27001 brought the most significant changes to the standard in nearly a decade. While the core management system requirements remain largely intact, the Annex A controls — the heart of your security program — got a complete restructuring.
If you're already certified, you need to transition. If you're pursuing certification for the first time, you're working with the new structure from day one.
What Actually Changed
The Control Restructure
The old 14-category, 114-control structure is gone. Annex A now has:
- 4 themes instead of 14 categories
- 93 controls instead of 114
- 11 new controls addressing modern threats
The four themes are:
- Organizational controls (37 controls)
- People controls (8 controls)
- Physical controls (14 controls)
- Technological controls (34 controls)
New Controls Worth Noting
The 11 new controls reflect how security has evolved:
- Threat intelligence (5.7): Proactive collection and analysis of threat information
- Information security for cloud services (5.23): Specific cloud security requirements
- ICT readiness for business continuity (5.30): Technology-specific BC requirements
- Physical security monitoring (7.4): Surveillance and monitoring of physical spaces
- Configuration management (8.9): Managing system configurations securely
- Information deletion (8.10): Proper data disposal processes
- Data masking (8.11): Protecting data through masking techniques
- Data leakage prevention (8.12): DLP controls
- Monitoring activities (8.16): Security monitoring and alerting
- Web filtering (8.23): Internet access controls
- Secure coding (8.28): Secure software development practices
Control Attributes
Each control now has five attributes for classification:
- Control type: Preventive, Detective, or Corrective
- Information security property: Confidentiality, Integrity, Availability
- Cybersecurity concept: Identify, Protect, Detect, Respond, Recover
- Operational capability: Governance, Asset Management, etc.
- Security domain: Governance and Ecosystem, Protection, Defence, Resilience
These attributes make it dramatically easier to map ISO 27001 controls to other frameworks — a direct nod to the reality that most organizations manage multiple compliance requirements simultaneously.
Transitioning from 2013 to 2022
If you're already certified to ISO 27001:2013, here's the practical transition path:
Step 1: Gap Analysis
Map your existing controls to the new structure. Most of your existing controls map directly — the content hasn't changed as much as the organization. But you'll find gaps where new controls were added.
Step 2: Update Your Statement of Applicability (SoA)
Your SoA needs to reflect the new 93-control structure. For each control, document whether it applies, your justification, and your implementation status.
Step 3: Implement New Controls
For the 11 new controls, assess which apply to your organization and implement them. Most organizations will find that several of these new controls codify practices they already follow (like threat intelligence and cloud security).
Step 4: Update Documentation
Policy documents, risk assessments, and process documentation need to reference the new control numbering and themes.
Step 5: Internal Audit
Conduct a thorough internal audit against the 2022 standard before your transition audit.
Making Multi-Framework Compliance Easier
The new attribute system in ISO 27001:2022 is a game-changer for organizations managing multiple frameworks. The cybersecurity concept attribute aligns directly with NIST CSF, making cross-mapping between ISO 27001 and NIST straightforward.
When combined with SOC 2, HIPAA, GDPR, and other frameworks in a unified control matrix, organizations can identify common controls and implement them once while satisfying multiple requirements.
This is where automated compliance platforms earn their keep. Maintaining cross-framework mappings manually is theoretically possible but practically unsustainable as frameworks evolve and your environment changes.
Aristiun provides automated ISO 27001:2022 compliance with cross-framework mapping across 340+ frameworks. Explore compliance automation.