Operating under ISO/IEC 27001:2022: what the restructure changed in practice

The transition window closed on 31 October 2025 under IAF MD 26. Certificates issued against ISO/IEC 27001:2013 expired at that point, and all certification now proceeds against the 2022 edition. The immediate compliance question is settled. The more useful question is what the revision changed about running the system.

The clauses moved less than the noise suggested

Clauses 4 to 10 — context, leadership, planning, support, operation, performance evaluation and improvement — received modest amendments. If your management system was well built against the 2013 clause requirements, the clause-level work in transition was small. The substance of the revision is in Annex A.

Annex A: fewer controls, different structure

Annex A was restructured from 114 controls across 14 domains into 93 controls across four themes: organisational, people, physical and technological. Most of the reduction came from merging controls that had always been operated together, not from removing requirements. Very little was genuinely dropped.

The eleven new controls

These are where implementation effort concentrated, because most of them describe practices organisations were already performing without a control mandating them:

• Threat intelligence — collecting and using information about threats relevant to your environment
• Information security for use of cloud services — acquisition, use, management and exit
• ICT readiness for business continuity — technology recovery capability derived from continuity requirements
• Physical security monitoring — detection of unauthorised physical access
• Configuration management — defining, documenting and enforcing secure configuration
• Information deletion — removing data no longer required, in line with retention rules
• Data masking — limiting exposure of sensitive data in non-production and analytical use
• Data leakage prevention — detecting and preventing unauthorised disclosure
• Monitoring activities — monitoring networks, systems and applications for anomalous behaviour
• Web filtering — managing access to external websites
• Secure coding — secure development practices applied to software you build

Three of these — cloud services, ICT readiness for business continuity, and configuration management — routinely produce findings, because informal practice is not the same as a defined, evidenced control. An organisation that patches diligently but has never documented a configuration baseline will struggle to evidence configuration management.

Attributes: the part most organisations skipped

The 2022 edition attaches attributes to each control — control type, information security property, cybersecurity concept, operational capability and security domain. Attributes are not mandatory, and many transitions ignored them entirely. That is a missed opportunity.

Attributes let you view your control set through lenses other than the Annex A ordering. You can report on preventive versus detective coverage, or view controls by the NIST-style identify/protect/detect/respond/recover concepts, or filter by operational capability when scoping an assessment. For organisations mapping ISO to other frameworks, attributes give a structured bridge that clause numbering does not.

What to prioritise now

1. Verify that each of the eleven new controls has operating evidence, not only documented intent
2. Review the Statement of Applicability for exclusions justified against the 2013 structure and never re-argued
3. Populate control attributes and use them in your internal audit planning and management reporting
4. Re-examine controls merged in the restructure — a merged control sometimes inherited scope nobody re-tested
5. Check that ICT readiness for business continuity traces back to actual recovery objectives from a business impact analysis, rather than to an IT assumption

The revision was, on balance, a simplification. Organisations that treated it as a re-mapping exercise got a smaller, better-structured control set. Organisations that treated it as a documentation update generally still have the eleven new controls sitting on paper.