ISO 27001:2022: Your guide to the changes
In October 2025, the deadline for transitioning from ISO 27001:2013 to ISO 27001:2022 took place, following a major restructure of the standard and a raft of updates. The updated standard is transforming how organisations approach information security, risk management and data protection. With streamlined controls, new compliance expectations, and greater board-level accountability, the update calls for a sharper, more proactive strategy. We’ll help you understand what’s changed and how our expert ISO lead auditors can help you adapt with confidence.
The changes in ISO 27001:2022
ISO 27002:2013 describes 114 controls split among 14 control objectives. The updated 2022 standard now uses 93 controls, split more simply into 4 categories:
- Section 5. Organisational Controls (37 controls)
- Section 6. People Controls (8 controls)
- Section 7. Physical Controls (14 Controls)
- Section 8. Technological Controls (34 Controls)
While the overall number of controls has decreased, it is important to note that none of the ISO 27002:2013 controls have been excluded or removed. Instead, existing controls have been merged, renamed, or split into new controls:
- 57 ISO 27002:2013 controls have now been merged into 24 controls
- 23 controls have been renamed
- 1 control has been split into 2 sub-controls
- 11 new controls have been defined
Each control in the new version of ISO 27002 also has two new elements to its structure: an attribute table that presents a set of attributes associated with that control, and the purpose or rationale for applying the control.
The control attributes are intended to help ease the integration of 27002 controls with other similar security frameworks. Control attributes describe the control type, information security properties, cybersecurity concepts, operational capabilities and security domains associated with each control.
This structure is designed to make it easier for those choosing or analysing the control set to better understand how to select and justify the use of a control. The second new element shows the purpose of each control, intended to help organisations understand the rationale behind each control and its adequacy to treat specific risks.
Another new Annex has also been added to 27002:2022 – Annex B. Annex B maps the controls in the new 2022 version with the controls from the 2013 iteration. By reducing the number of sections, adding an annex for backward compatibility and including control and attribute matrices, the standard hopes the applicability of controls will be easier to understand and implement.
What will stay the same?
It is important to note that the structure and initial clauses of the standard are not expected to change:
- Clauses 4 – 10 are expected to stay the same
- 35 controls are expected to stay the same
- 27001 will remain the main standard, with 27002 providing supporting implementation guidance
What are the new controls in ISO 27002?
While the controls in ISO 27002:2022 have generally been either modified or consolidated, some new additions must be considered. Among these are controls covering the following:
- Threat intelligence
- Information security for the use of cloud services
- ICT readiness for business continuity
- Physical security monitoring
- Configuration management
- Information deletion
- Data masking
- Data leakage prevention
- Monitoring activities
- Web filtering
- Secure coding
Many ISO 27002:2022 controls are similar to the 2013 version. They have simply been renamed or consolidated, so they are more appropriate for and relevant to our modern world. Take, for example, the 2013 control ‘teleworking’. In the 2022 version, this has been named ‘remote working’.
How Evalian can help you certify to ISO 27001
Our consultants will help you set out a clear roadmap for your ISO 27001 journey. This will include the key steps:
Conduct a Gap Analysis: We’ll compare your current ISMS against ISO 27001:2022 and identify areas for improvement.
Develop an Action Plan: We’ll work with you to create a timeline addressing identified gaps
Engage with Certification Bodies: We will do the heavy lifting for you and engage with a certification body that suits your organisation. We will then schedule assessments and ensure resources are confirmed in preparation for your audit and certification.
MYCOM OSI recently upgraded to ISO 27001:2022 with the support of Evalian’s ISO team:
“The Evalian team’s expertise in all aspects of information security management was evident and incredibly reassuring. They were adept at tailoring their strategies to our specific organisational needs, demonstrating not only their deep understanding of the ISO standards but also an impressive ability to apply them effectively across different business contexts.
It was their guidance and thorough preparation that led us to successfully upgrade to the ISO 27001:2022 certification. The level of detail and diligence they brought to our project was instrumental in enhancing our overall security posture and compliance.”
CRMT Digital also recently successfully upgraded to the new ISO 27001 standard with support from our consultants:
“We used Evalian to upgrade from ISO27001:2013 to the 2022 standard and to conduct our internal audit. The team were professional and knowledgeable. Very impressed.”
If you’re just starting on your ISO 27001 journey, read about the business benefits of ISO 27001. Or if you would like to get a fast quote from our expert team, contact us today.
Image by storyset on Freepik
