What changed in ISO 27001:2022 compared with the 2013 edition
Annex A of ISO/IEC 27001:2022 fell from 114 controls in 14 clauses to 93 controls in 4 themes, and the 2013 certifications had to expire or be withdrawn by 31 October 2025. If a customer or regulator now asks for the 2022 edition, or an existing 2013 certificate has lapsed, the first question is whether your organization still holds a valid certificate. The answer decides the work. An organization with a live 2013 certificate was expected to move through a transition audit; one whose certificate has lapsed is in effect starting a new certification, and should confirm its position with its certification body. ISO does not certify organizations. Only an accredited certification body can issue or confirm a certificate.
Either way, the working document is the Statement of Applicability. Its control list has to be rebuilt against the 2022 numbering, since many 2013 controls were merged, updated or moved, and 11 controls are new. Under IAF MD 26:2023, a certified organization moving from the 2013 edition had to run a gap analysis of these changes, which the certification body reviewed in the transition audit alongside the updated Statement of Applicability. Ask your certification body what it will expect to see, and whether your current scope, risk assessment and treatment plan still hold under the new control set. The ISO/IEC 27001:2022 preview shows the clause structure and the changes to the main text, which is the place to start a clause-by-clause comparison.
Compare your existing evidence with the new attributes too. ISO/IEC 27002:2022 gives each control a purpose and attributes such as control type and security concept, and its correspondence annex maps the 2013 controls to the 2022 set. Use that mapping to find where each old control landed, which controls now need evidence you may not collect today, and which ones your organization may need to add to its Statement of Applicability. Whether an organization needs outside help with this rebuild depends on how many controls it has to re-document and how much of its existing evidence can be reused.
How Annex A moved from 114 controls to 93
IAF MD 26:2023 records 11 controls as new in the 2022 edition. These are controls with no direct predecessor in the 2013 set, so an organization that has not already covered their subject matter will have no existing control, procedure or evidence to point to. Assessors will test them in the same way as any other Annex A control, which means the Statement of Applicability must state whether each one applies and, if so, how it is implemented.
- Count to confirm: the 11 new controls are the ones to check first in any gap analysis, because nothing in the 2013 Statement of Applicability maps to them.
- Typical subjects: the new set covers areas such as threat intelligence, cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring, web filtering and secure coding.
- Evidence gap: a new control often needs a new record, such as a threat intelligence source list or a deletion log, rather than an update to an old one.
- Applicability decision: an organization may exclude a new control with justification, but the exclusion must appear in the Statement of Applicability and survive the risk assessment.
Check whether each of the 11 new controls is marked applicable, implemented or excluded in your own Statement of Applicability, and attach the evidence that supports that status.
IAF MD 26:2023 counts 24 controls as merged, meaning that two or more controls from the 2013 edition were combined into one control in 2022. Because the merged control covers the scope of several predecessors, a single old control number can now sit under a different title, and the old evidence may be spread across several records. Mapping is the step that prevents gaps or double counting.
- Many-to-one mapping: an old control that was split or combined may now be satisfied by one new control, so the same evidence should be cited once and referenced consistently.
- Scope creep risk: a merged control can be broader than either predecessor, so the implementation must cover the wider subject, not just the part the old control addressed.
- Old references: policies, procedures and risk treatment records that cite 2013 control numbers need updating so the audit trail stays readable.
- Correspondence table: the correspondence between the two editions is set out in the annex of ISO/IEC 27002:2022, and the CISO Assistant library includes a mapping between the two editions of ISO/IEC 27001.
Use the correspondence table as a starting point, then confirm each merged control against your own records, not against the published mapping alone.
The largest group is the 58 controls that IAF MD 26:2023 describes as updated. These keep their subject but change wording, scope, purpose or attributes, so an organization can often reuse existing controls while still needing to confirm that the updated text is fully met. This group carries the most risk of silent drift, because a control that looks familiar may now expect something it did not require before.
- Attributes and purpose: each control now has a purpose and attributes instead of group-level control objectives, so a review should check the purpose statement against what the control actually does.
- Wording changes: updated controls may add expectations such as explicit testing, documented review or specific technical measures. Compare the 2013 and 2022 text side by side for each control.
- Evidence refresh: existing evidence may still be valid, but the records may need to show the updated requirement, for example a dated review or a test result.
- Attribute selection: ISO/IEC 27002:2022 lets an organization filter controls by attributes such as control type, security property and cybersecurity concept, which helps when building reports.
For each updated control, record what changed in your own words, the evidence that now satisfies it and the date you verified it.
Controls that were not new, merged or updated carry over unchanged in substance. The 2022 Annex A groups all 93 controls into four themes: organizational controls (clause 5, 37 controls), people controls (clause 6, 8 controls), physical controls (clause 7, 14 controls) and technological controls (clause 8, 34 controls). Seeing the themes helps an organization assign owners and plan audit sampling, even though the theme counts do not show how many controls changed.
- Organizational: 37 controls, the largest theme, covering policies, roles, supplier relationships, incident management and continuity.
- People: 8 controls across the employment life cycle, from screening through training and discipline.
- Physical: 14 controls for sites, secure areas, equipment and storage media.
- Technological: 34 controls for endpoints, access, cryptography, logging, networks and secure development.
- Carried over: the number of unchanged controls is not a published figure, so derive it from your own mapping after the new, merged and updated groups are sorted.
Assign each theme an owner, then confirm that every 2013 control has been traced to a 2022 control, merged into one, or documented as removed.
What control attributes and purpose statements add to each control
The 2022 edition moved guidance from group-level control objectives to individual controls, each with a purpose and a set of attributes. These cards cover what that structure changes for the ISMS team and for the assessor who tests it, and where to check the current wording before planning evidence.
From objectives to per-control purpose
The 2013 guidance grouped controls under control objectives. The 2022 guidance gives each control its own purpose statement, so the reason a control exists is stated next to the control itself. An assessor can read the purpose and then ask whether the implemented measure actually serves it. Teams writing their Statement of Applicability should quote the purpose when justifying inclusion or exclusion of a control, instead of relying on the old objective headings.
Control type attribute
The control type attribute classifies each control as preventive, detective or corrective. It tells the reader where in the event timeline the control acts. A team that owns a detective control such as log review needs evidence that the detection ran, not just that a preventive tool was installed. Use the type to check that the control set covers all three timings, since a list of only preventive controls is easy to build and hard to defend.
Security properties and concepts
Each control carries security property attributes, such as confidentiality, integrity and availability, and cybersecurity concept attributes that map to functions like identify, protect and detect. These attributes let an assessor filter the 93 controls by the property an auditor is testing. Confirm the attribute values in the current edition, because the value sets are the part of the taxonomy most likely to be read differently by different teams.
Operational capabilities and security domains
Operational capability attributes name the practical area a control serves, such as asset management, identity management or incident management. Security domain attributes group controls into governance, protection, defence or resilience. Together they let an ISMS owner assign each control to a named person and a single evidence source. This is the planning view that decides which evidence repository, log source or ticket queue a control feeds.
Attributes as a filtering tool
Assessors commonly sort the control set by attribute before sampling, for example pulling every control tagged with a particular capability to test across the organization at once. Organizations can use the same filters to plan evidence collection by owner and by system. Filtering works only when the attributes in the internal register match the current published values, so keep the register tied to the edition in force.
Check the current edition for changed values
A correction to ISO/IEC 27002:2022 in March 2022 moved the attribute value #information_security_assurance for control 5.22 from the Security domains column to the Operational capabilities column. An internal register copied from an early draft or a third-party template could carry the old placement. Before building filters or evidence plans, compare every attribute value against the current published text and record the edition and date used.
How a 2013 certification moves to the 2022 edition
The transition sequence under IAF MD 26:2023 turns an existing ISO/IEC 27001:2013 certification into a 2022 certification by showing, in writing and in an audit, how each change was handled. The certification body decides the outcome, and the organization keeps ownership of its controls throughout.
Compare the 2013 and 2022 requirements
The organization, usually its ISMS owner with input from control owners, reads the 2022 edition against its current ISMS. The work covers the revised clauses and the reorganized Annex A, including the 11 new controls, the 24 merged controls and the 58 updated controls recorded in IAF MD 26:2023. The output is a working list of every point where the existing ISMS differs from the 2022 text. You know this step is done when every change has an owner and a noted disposition.
Perform the gap analysis of changes
The organization runs a formal gap analysis of those changes against its current documentation, controls and records. For each change it records whether the existing control already meets the requirement, needs a new or revised control, or needs new evidence. The IAF rule requires this analysis for certified organizations moving to the 2022 edition. The output is a dated gap analysis report that the certification body will review. It is complete when each gap has an action, an owner and a status.
Close gaps and update the controls
Control owners implement the actions from the gap analysis. Typical work includes revising the information security policy and topic-specific policies, adding controls for new areas such as threat intelligence or cloud services, and mapping retained controls to their 2022 identifiers. Each change is recorded in the ISMS documentation with its approval. The output is an updated set of policies, procedures and control records. The step is done when the gap list shows no open items, or when remaining items are documented with an accepted plan.
Update the Statement of Applicability
The organization rewrites its Statement of Applicability against the 2022 Annex A. Each of the 93 controls is marked as applicable or not applicable, with a justification, and linked to the risk treatment decisions and the evidence that supports it. Exclusions that existed under the 2013 edition must be re-justified, since control numbering and attributes changed. The output is a dated 2022 Statement of Applicability, approved by management, and a crosswalk showing which 2013 control each entry replaces. It is done when every control has a status and a traceable reason.
Confirm the transition audit arrangement
The organization agrees the transition audit with its certification body. IAF MD 26:2023 allows the transition audit to be combined with a surveillance or recertification audit. It needs at least 0.5 extra auditor days when combined with a recertification audit and at least 1.0 extra auditor days when combined with a surveillance audit. Ask the certification body to confirm the day count, the combined audit plan and the scope in writing. The output is a signed audit plan that names the documents the auditor will review. Confirm these terms with the certification body, since its quote and plan govern the work.
Undergo the transition audit review
The certification body's auditor reviews the gap analysis, the updated Statement of Applicability and the evidence behind the changed controls, then tests selected controls in operation. The auditor checks that the gap analysis is accurate and that the changes work in practice, not only on paper. Any nonconformities are recorded and must be addressed before the transition is accepted. The output is the auditor's transition audit report. The step is complete when the certification body accepts the transition with no open nonconformities.
Receive the 2022 certification decision
Once the certification body has reviewed the transition audit findings and any corrective actions, it makes its certification decision and issues a certificate referencing ISO/IEC 27001:2022. Under IAF MD 26:2023, certifications to the 2013 edition had to expire or be withdrawn by 31 October 2025, so an organization that has not transitioned no longer holds a valid 2013 certificate. Check the new certificate and its scope against the certification body's register and the IAF CertSearch database. The output is a valid 2022 certificate, and the organization owns the continuing obligation to maintain its ISMS.
What the 31 October 2025 deadline means for an existing certificate
The transition period for moving from ISO/IEC 27001:2013 to the 2022 edition has ended. Under IAF MD 26:2023, every certification to the 2013 edition had to expire or be withdrawn by 31 October 2025, the end of the 36-month transition period. A certificate that still names the 2013 edition is no longer valid evidence of certification to the current standard, so any customer, contract or regulator that asks for ISO 27001 now expects a 2022 certificate.
If your organization held a 2013 certificate, the first decision is whether it was transitioned or lapsed. A transition audit could be combined with a surveillance or recertification audit, and it required a gap analysis of the 2022 changes plus an updated Statement of Applicability reviewed by the certification body. Confirm the status of your certificate directly with your certification body and check it in the IAF CertSearch database, since ISO itself points to that database for accredited certificates. Do not rely on an internal record or an older copy of the certificate.
If you do not hold a 2022 certificate, you are starting a new certification path, not renewing an old one. That path covers readiness, the Stage 1 and Stage 2 audits and the certification decision, and the ISO 27001 certification audits guide walks through it. Where an organization let its certificate expire and wants to return to certification, the rules for recertification after expiry in European Accreditation FAQ 47.5 apply, and the exact steps depend on how your certification body applies them. Ask it in writing what it will require before you commit budget.
How to check whether an existing ISMS is ready for the 2022 edition
An ISMS built on the 2013 edition needs more than a renumbered Statement of Applicability. Each check below maps to a question an assessor is likely to ask, and to the records that answer it. Work through them in order, because the gap analysis and risk treatment plan depend on the Statement of Applicability being correct first.
Statement of Applicability uses 2022 numbering
Confirm the Statement of Applicability lists the 93 Annex A controls under the 2022 numbering, with the four themes (organizational, people, physical, technological) and the 2022 control titles. Each control should state whether it is applicable and why, and any exclusion should have a documented justification. Check that the 2013 numbers were mapped, not just retitled, so an assessor can trace every old control to its new one. Ask whether the SoA was reviewed and approved again after the change.
Eleven new controls have owners
The 2022 edition added 11 controls that the 2013 set did not contain. For each one, confirm a named owner, a documented implementation and at least one piece of operating evidence, such as a threat intelligence report, a configuration baseline or a data leakage prevention rule log. An assessor will ask who runs the control and how often it runs, so a policy alone is not enough. Where a new control is marked not applicable, the exclusion must still be justified.
Merged controls keep their original intent
Twenty-four 2013 controls were merged into other controls. The risk is that a merge quietly drops a requirement, for example when an access review and a privileged access review become one control. Compare each merged control against the old control text and your own risk register, and record what the merged control now covers. Assessors often sample the older requirement, so the evidence for it must still exist and still be produced.
Risk treatment plan reflects new controls
Check that the risk treatment plan selects controls from the 2022 Annex A and that every risk treated by a new or changed control points to it. Look for risks still linked to retired control numbers, and for new controls that appear in the SoA but do not treat any risk. The gap analysis performed for the transition should be traceable to this plan. Confirm that the risk owners approved the revised treatment decisions.
Evidence for 58 updated controls
Fifty-eight controls were updated in wording or scope, so older evidence may no longer prove the current requirement. Sample the updated controls and check that the evidence matches the 2022 control purpose and attributes, not the 2013 objective. Records such as access reviews, supplier reviews and backup restoration tests should show dates within the current cycle. Gaps found here are typical findings in transition audits, so resolve them before the audit rather than during it.
Certification body transition plan
Ask the certification body in writing how it will run the transition, including whether the transition audit will be combined with a surveillance or recertification audit and how many extra auditor days it expects. Under IAF MD 26:2023, a 2013 certificate had to expire or be withdrawn by 31 October 2025, so confirm the status of your certificate today. Confirm that the certification body applies ISO/IEC 27006-1:2024 for your audit. The organization owns this decision, and the certification body issues the outcome.
Who owns the gap analysis, the SoA and the transition audit
The organization remains accountable for its information security management system, including the decisions that the 2022 edition forces. Management must decide which Annex A controls apply, accept the residual risk, and sign off on the changes. No outside party can make those decisions on the organization's behalf, and an auditor will look for evidence that the people named in the policies actually made them.
- Control decisions: Confirm which of the 93 controls in Annex A apply, and record the reasons for any exclusion in the Statement of Applicability.
- Gap analysis ownership: The internal team identifies how each new, merged and updated control differs from its 2013 counterpart and documents the result.
- Risk treatment: Decide how each risk is treated and who accepts the residual risk.
- Approval and records: Keep signed, dated versions of the updated Statement of Applicability and the gap analysis.
Confirm that a named owner in the organization can explain every control decision without relying on a consultant.
An implementation partner can prepare the technical and documentary material that the internal team uses in the transition. DeployOpen works on self-hosted open-source platforms inside the client's own infrastructure, so its role is to configure systems, collect configuration evidence and map existing controls to the new attributes. The partner does not own the controls, decide applicability or write the conclusions of the gap analysis.
- Configuration evidence: Produce exports, settings records and logs from the systems that support controls such as logging, access management and backups.
- Mapping documents: Prepare a worksheet that links existing controls to the 2022 control identifiers, for the internal team to review.
- Gap analysis support: Help the internal team run the comparison, track open items and organize the findings.
- Scoped deliverables: Agree the list of documents, systems and evidence in writing before work starts.
Check that the partner's deliverables are labelled as drafts for the organization's review, and that no partner statement is presented as an auditor's finding.
Only an accredited certification body performs the transition audit and issues or maintains the certificate. Under the IAF transition rules, the certification body reviews the gap analysis and the updated Statement of Applicability during that audit. Its findings, not the partner's work, determine whether the certificate continues.
- Transition audit: The certification body reviews the gap analysis and the updated Statement of Applicability as part of the audit.
- Certificate decisions: Only the certification body issues, maintains or withdraws the certificate.
- Independence: The certification body must remain independent of the firm that helped prepare the system, so check that the same people are not both implementing and auditing.
- Transition deadline: The 2013 certifications had to expire or be withdrawn by 31 October 2025, so any organization still holding a 2013 certificate should confirm its status with its certification body.
Ask the certification body in writing which evidence it expects and how the transition audit will be scheduled, and confirm that it is accredited for ISO/IEC 27001.
Hiring a partner does not guarantee a certificate, a clean audit or any particular result. The certification body may find nonconformities, request additional evidence or reject a Statement of Applicability that does not match the organization's actual controls. DeployOpen does not issue audit reports, attestations or certifications, and it does not promise that its preparation work will satisfy any certification body.
- No certificate from the partner: DeployOpen prepares systems, controls and evidence for assessment. It does not issue reports or certificates.
- Findings remain open: Nonconformities raised in the transition audit are resolved by the organization, sometimes with support from the partner.
- Scope of the fee: Confirm in the written scope which tasks are included and which remain with the internal team.
- Ongoing duties: Surveillance and recertification audits continue after the transition, and the organization must maintain its controls throughout.
Request the written scope and the list of responsibilities before engaging any partner, and keep the organization's own owners named in the document.
Questions buyers ask about the 2022 changes
Is my ISO 27001:2013 certificate still valid?
No. Under IAF MD 26:2023, all ISO/IEC 27001:2013 certifications had to expire or be withdrawn by 31 October 2025, the end of the 36-month transition period. A 2013 certificate is only valid today if the organization completed a transition to the 2022 edition and the certification body issued a new certificate against it. Check the status of your certificate in the IAF CertSearch database and ask your certification body in writing which edition the certificate references. If the certificate is not on the 2022 edition, the organization needs a new certification audit against ISO/IEC 27001:2022 rather than a transition.
How many new controls does ISO 27001:2022 add?
ISO/IEC 27001:2022 adds 11 new controls to Annex A. The full change, as summarized in IAF MD 26:2023, is that Annex A fell from 114 controls in 14 clauses to 93 controls in 4 clauses. Of the 2013 controls, 24 were merged into other controls and 58 were updated. The total count drops even though 11 controls are new, so a control count comparison alone will mislead you. Map each 2013 control to its 2022 successor and review the wording of the updated controls, not only the new ones.
Does the climate change amendment change Annex A?
No. The climate amendment, ISO/IEC 27001:2022/Amd 1:2024, published on 23 February 2024, changes clauses 4.1 and 4.2 rather than Annex A. Clause 4.1 now requires the organization to determine whether climate change is a relevant issue for its ISMS. A note to clause 4.2 explains that interested parties can have climate-related requirements. Your Statement of Applicability does not gain new controls because of this amendment, but your context and interested party analysis should record a documented decision on climate change.
What does a transition audit need from my team?
A transition audit needs evidence that the organization has moved its ISMS to the 2022 structure. Under IAF MD 26:2023, the organization performs a gap analysis of the changes, and the certification body reviews that gap analysis during the transition audit together with an updated Statement of Applicability. Prepare the following:
- A gap analysis that maps each 2013 control to its 2022 equivalent, with notes on merged and updated controls
- An updated Statement of Applicability referencing the 2022 Annex A
- Evidence that the new controls, such as threat intelligence and secure coding, are implemented or excluded with justification
- Updated clause 4 to 10 records, including the climate assessment under clause 4.1
A transition audit can be combined with a surveillance or recertification audit. It needs at least 0.5 extra auditor days with a recertification audit or 1.0 extra auditor days with a surveillance audit, according to IAF MD 26:2023.
Can my team do the 2013 to 2022 control mapping ourselves?
Yes, an internal team can prepare the mapping, and the standard does not require an outside party to do it. The certification body does not prepare the mapping for you; it reviews the gap analysis you produce. The mapping needs someone who knows both the 2013 control set and your current controls, along with the ISO/IEC 27002:2022 guidance that explains the attributes and purpose of each 2022 control. ISO/IEC 27002:2022 contains a correspondence annex with the 2013 controls, which is a useful starting point. Open-source framework libraries, including CISO Assistant's ISO/IEC 27001:2022 library with its 2013 mapping, can help you check your work. Confirm the library content against the published standard before relying on it.
What drives the effort of moving to 2022 for a small versus large organization?
The main drivers are the number of controls you have implemented, how many systems and sites are in scope, and how well your existing evidence is organized. A small organization with a narrow scope and a few cloud accounts usually has fewer controls to re-map and fewer evidence sources to update. A large or multi-site organization must check each site, business unit and supplier process against the changed controls, and the transition audit days grow with scope. In both cases, ask your implementation partner and certification body for a written scope and a quote that separates gap analysis, evidence updates, the Statement of Applicability revision and the audit days. Retainer support for ongoing evidence collection is a separate, recurring cost.
How DeployOpen prepares systems and evidence for the 2022 edition
DeployOpen starts this work with a written scope that names the ISMS documents, the systems and the Annex A controls to be reviewed, and the deliverables the organization will receive. Before any change is made, the team reviews the existing ISMS against the 2022 Annex A, including the 11 new controls, the 24 merged controls and the 58 updated controls that IAF MD 26:2023 records. The review produces a gap analysis of the changes, which is the document IAF MD 26:2023 expects an organization to bring to its certification body. Ask the partner to show how the gap analysis maps each 2013 control to its 2022 successor and which owner is accountable for each gap.
For the technical controls, the work focuses on configuration baselines, access and identity settings, logging and monitoring, and the other systems that produce evidence for the new and updated controls. Typical outputs are hardened configuration files kept under version control, logging and retention settings, and exported configuration records that show the setting in force on a given date. Those files are stored inside the client's own infrastructure, so the organization keeps control of its evidence. Confirm with the partner which evidence is generated automatically, which needs a manual export, and who signs off each artifact.
At handover, the organization receives the updated Statement of Applicability, the control-to-evidence mapping, the evidence files and a record of the decisions made during the work. DeployOpen prepares systems and evidence but does not issue audit reports, attestations or certifications. Those outcomes come only from an independent certification body, which applies ISO/IEC 17021-1 and ISO/IEC 27006-1 and decides whether to certify. The organization owns its controls and its Statement of Applicability, and it remains responsible for showing the certification body that those controls operate as described.
