ISO 27001: what changes?

The world of information security does not stand still, and neither does ISO 27001 . In October 2022, a new version of the standard was published. You can buy it from NEN , the Dutch standards body. The IAF  has published international guidance for the transition. If you are already certified to the old version, you need to take action.

The ISO 27001:2022 transition deadline

Organisations certified to ISO 27001:2013 must have moved to ISO 27001:2022 by 31 October 2025 at the latest. After that date, old certificates are no longer valid.

What does this mean for you?

If you are already certified to 2013:

• Plan a transition audit with your certification body
• Update your Statement of Applicability to the new Annex A
• Check whether you have addressed the 11 new controls
• Do this well before October 2025. Do not wait until the last moment

If you are starting certification now:

• You automatically work with the 2022 version
• Make sure your adviser and tools are up to date
• Buy the current standard from NEN 

If your certificate expires soon:

• Combine the recertification with the transition
• This is more efficient than two separate audits

Transition audit: what does it involve?

The transition audit is not a full recertification. The auditor focuses on:

1. Your updated Statement of Applicability: Have you assessed all 93 controls?
2. The new controls: How have you addressed the 11 new measures?
3. Changes to your ISMS: Have the changes been implemented in your documentation?

The audit usually takes 1 to 2 days, depending on the size of your organisation. The costs are between €2,000 and €5,000.

What changed in 2022?

The ISO 27001:2022 version contains two types of changes: changes to the main text (the management requirements) and a fully revised Annex A (the controls).

Changes to the main text

The management requirements in chapters 4 to 10 have largely stayed the same. There are clarifications and small adjustments:

These changes do not require major adjustments if you already have a working ISMS.

The new Annex A

The biggest change is in Annex A. Its structure has been completely revised:

The four new categories are:

• Organisational (37 controls): policies, processes, roles
• People (8 controls): people and awareness
• Physical (14 controls): buildings and equipment
• Technological (34 controls): IT and systems

Read more about the new structure on the Annex A page.

The 11 new controls

ISO 27001:2022 introduces eleven new controls that respond to modern threats and technologies:

A.5.7 Threat intelligence

You must actively gather information about threats that are relevant to your organisation. This means consulting sources such as the NCSC  (the Dutch National Cyber Security Centre), Z-CERT  (for healthcare), or commercial threat feeds.

In practice, subscribe to relevant newsletters, follow security updates from your suppliers, and discuss threat information regularly in your security meetings.

A.5.23 Information security for cloud services

If you use cloud services (and who doesn’t?), you need specific security measures for them. This includes:

• Assessing cloud providers
• Configuring cloud environments
• Monitoring cloud use
• An exit strategy

A.5.30 ICT readiness for business continuity

Your ICT must be prepared for disruptions. This goes further than backups alone: do you have a plan if your cloud service goes down? Can you keep working if your office is not accessible?

A.7.4 Physical security monitoring

Physical access must be monitored. Think of camera surveillance, access logs, or alarm systems. This was already implicitly part of physical security, but it is now explicit.

A.8.9 Configuration management

System configurations must be documented, managed and checked. You must know how your systems are configured, and changes must go through a controlled process.

A.8.10 Information deletion

Information that is no longer needed must be deleted securely. This applies to digital data (secure wiping) and to physical media (shredding).

A.8.11 Data masking

Sensitive data in test or development environments must be masked. You do not test with real customer data, but with anonymised or fictitious data.

A.8.12 Data leakage prevention

You must have measures in place to prevent unauthorised data leaks. This can be technical (DLP tools) or organisational (a policy on sharing information).

A.8.16 Monitoring activities

Activities in your systems must be monitored to detect unusual behaviour. Think of SIEM systems, log analysis, or anomaly detection.

A.8.23 Web filtering

Access to harmful or inappropriate websites must be restricted. This can be done through DNS filtering, a web proxy, or endpoint protection.

A.8.28 Secure coding

If you develop software, you must apply secure coding practices. This includes a secure development lifecycle, code reviews, and security testing.

Attributes in ISO 27001:2022

ISO 27001:2022 also introduces “attributes” for each control. These are characteristics you can use to categorise and filter controls:

These attributes are optional, but they can help with:

• Structuring your security approach
• Gap analyses
• Reporting to management
• Mapping to other frameworks such as the NIST CSF 

Practical tips for the transition

1. Start with your Statement of Applicability

Map your current SoA to the new Annex A. The ISO 27002:2022  contains a mapping table that shows how old controls relate to new ones.

2. Focus on the gaps

Identify which of the 11 new controls are relevant to your organisation. There is a good chance you have already implemented some of them, at least in part, without calling them by these names.

3. Update your documentation

Adjust your procedures and work instructions where needed. Most changes are terminological or structural, not substantive.

4. Train your people

Make sure employees who work with the ISMS know about the changes. This does not need to be extensive training. A short update session is usually enough.

5. Plan the audit well in advance

Certification bodies get busy as the deadline approaches. Plan your transition audit at least 3 to 6 months ahead.

Frequently asked questions about the transition

Do I need to buy the new standard? Yes. If you have the 2013 version, you must buy the 2022 version. The standard is available from NEN .

Can I combine the transition with my surveillance audit? Often, yes, but check this with your certification body. It can be more efficient.

What if I miss the deadline? Your certificate expires. You then need a full recertification audit, which is more expensive and takes more time.

Is the transition difficult? For most organisations, it is manageable. The fundamental approach stays the same. Most of the time goes into updating the Statement of Applicability.

More information

• Annex A controls: the 93 controls explained
• Requirements of the standard: all chapters explained
• The ISMS: the heart of ISO 27001
• NEN ISO 27001 : buy the official standard
• IAF transition information : international guidance