Why the 2022 revision matters

ISO/IEC 27001:2022 is the version every certified organisation now operates against — the transition window for 2013 certificates closed on 31 October 2025. The clauses that define the management system (4 to 10) changed only slightly. The real work sits in Annex A, which now aligns with ISO/IEC 27002:2022.

Annex A at a glance

The old 114 controls in 14 domains were consolidated into 93 controls grouped into four themes:

  • Organisational controls — 37 controls covering policies, roles, supplier relationships and incident management
  • People controls — 8 controls for screening, awareness, discipline and remote working
  • Physical controls — 14 controls for premises, equipment and media
  • Technological controls — 34 controls for access, cryptography, logging, development and networks

Many controls were merged rather than removed, so a mature 2013 ISMS already covers most of the intent.

The 11 new controls

These are where most organisations find genuine gaps:

  1. Threat intelligence
  2. Information security for use of cloud services
  3. ICT readiness for business continuity
  4. Physical security monitoring
  5. Configuration management
  6. Information deletion
  7. Data masking
  8. Data leakage prevention
  9. Monitoring activities
  10. Web filtering
  11. Secure coding

A practical update plan

1. Re-map your Statement of Applicability

Map every existing control to its 2022 equivalent and record the justification for inclusion or exclusion. Auditors expect the SoA to reference the new numbering and themes.

2. Close the new-control gaps first

Prioritise by risk. Cloud services, configuration management and data leakage prevention usually carry the most exposure for Indian BFSI and SaaS organisations.

3. Update the risk treatment plan

Link each new control to the risks it treats. Clause 6.1.3 requires the comparison against Annex A to remain explicit.

4. Refresh evidence, not just documents

Policies alone will not pass a surveillance audit. Show operating evidence: threat intelligence feeds being reviewed, configuration baselines enforced, deletion logs retained.

Common pitfalls

  • Treating the update as a document exercise instead of a control-effectiveness review
  • Excluding cloud controls because "the provider handles it" — the shared-responsibility model still leaves you accountable
  • Forgetting to brief internal auditors on the new control set

Key takeaways

  • Annex A now has 93 controls in four themes; most 2013 controls were merged, not removed.
  • The 11 new controls — especially cloud, configuration management and data leakage prevention — are where gaps usually sit.
  • Update the Statement of Applicability and risk treatment plan, then prove the controls operate.

Frequently asked questions

Is ISO 27001:2013 certification still valid?

No. The three-year transition period ended on 31 October 2025, so certificates must now be issued against ISO/IEC 27001:2022.

Do we have to implement all 93 controls?

No. You include the controls that treat your identified risks and justify every exclusion in the Statement of Applicability. Auditors check that the reasoning is sound and the included controls work.

How long does an ISMS update for 2022 take?

For an organisation with a working 2013 ISMS, a focused update typically takes a few weeks to a few months, depending on how many of the new controls need real implementation rather than documentation.

Certification is a by-product of a working ISMS, not the goal itself.

Need help aligning your ISMS? Our ISO 27001 services cover gap assessment, SoA rework and audit readiness.