ISO 27001 and ISO 27002: 2022 updates

The information security management standard ISO 27001 and its companion standard ISO 27002 were updated in 2022.

 Buy your copy of ISO 27001:2022 here

 Buy your copy of ISO 27002:2022 here

This page explains the notable changes introduced by the new versions of ISO 27001 and ISO 27002, and how these changes affect organisations that are certified or planning to certify to ISO 27001.

What’s changed in ISO 27001?

ISO 27001:2022 is not significantly different from ISO 27001:2013, but there are some notable changes that align it better to other recent ISO management system standards:

• Context and scope

  You must now identify the “relevant” requirements of interested parties and determine which will be addressed through the ISMS (information security management system).

  The ISMS now explicitly includes the “processes needed and their interactions”.

• Planning

  Information security objectives must now be monitored and “be available as documented information”.

  There is a new subclause on planning changes to the ISMS. This does not specify any processes that must be included, so you should determine how you can demonstrate that changes to the ISMS have indeed been planned.

• Support

  The requirements to define who will communicate, and the processes for effecting communication, have been replaced by a requirement to define “how to communicate”.

• Operation

  The requirement to plan how to achieve information security objectives has been replaced by a requirement to establish criteria for processes to implement actions identified in Clause 6, and to control those processes in line with the criteria.

  Organisations are now required to control “externally provided processes, products or services” relevant to the ISMS rather than just processes.

• Annex A

  Annex A has been revised to align it with ISO 27002:2022. The Annex A controls are discussed in the section below.

What’s changed in ISO 27002?

First, the phrase “code of practice” has been dropped from the title of the updated ISO 27002 standard. This better reflects its purpose as a reference set of information security controls.

The 2022 Standard itself is significantly longer than the 2013 edition, and the controls themselves have been reordered and updated. Some controls have been merged, while 11 have been added:

• Even though no controls have been removed, ISO 27002:2022 only lists 93 controls rather than ISO 27002:2013’s 114. This is due to the large number of merged controls (56 into 24).
• These controls are grouped into 4 ‘themes’ rather than 14 clauses. They are:
  • People (8 controls)
  • Organisational (37 controls)
  • Technological (34 controls)
  • Physical (14 controls)
• The completely new controls are:
  • Threat intelligence
  • Information security for use of Cloud services
  • ICT readiness for business continuity
  • Physical security monitoring
  • Configuration management
  • Information deletion
  • Data masking
  • Data leakage prevention
  • Monitoring activities
  • Web filtering
  • Secure coding
• In ISO 27002, the controls now also have five types of ‘attribute’ to make them easier to categorise:
  1. Control type (preventive, detective, corrective)
  2. Information security properties (confidentiality, integrity, availability)
  3. Cybersecurity concepts (identify, protect, detect, respond, recover)
  4. Operational capabilities (governance, asset management, etc.)
  5. Security domains (governance and ecosystem, protection, defence, resilience)

When can I achieve certification to ISO 27001:2022?

Certification bodies are already offering certification to ISO 27001:2022, and must offer certification to only the 2022 edition of ISO 27001 from 30 April 2024.

This means that you can achieve certification against ISO 27001:2013 until 29 April 2024. However, all ISO 27001:2013 certificates will expire or be withdrawn on 31 October 2025 irrespective of how long they have been in place.

The IAF (International Accreditation Forum) confirms this timescale in its revised guidance document.

Can I implement the ISO 27001:2022 controls now?

Yes. In fact, we recommend you do, as we believe ISO 27002:2022 to be an improvement on the 2013 edition. For a start, it’s – unsurprisingly – better suited to today’s security landscape. It’s also much more comprehensive and provides clearer guidance on control selection and implementation.

Furthermore, because the 2022 controls are identifiable by attribute, it is easier to focus your selections. This could reduce the compliance burden or help you see how to better integrate your security processes, thereby making your ISMS easier to implement and manage.

If you still want to implement ISO 27001:2013, you can use the new control set instead of the old Annex A. However, you will need to compare the 2022 set against the 2013 set in your SoA (Statement of Applicability). This should be relatively straightforward to do, because ISO 27002:2022 has an annex that compares its controls with the 2013 iteration of the Standard.

We have everything you need to implement an ISO 27001-compliant ISMS and achieve certification to either edition of the Standard.

 Learn more about implementing ISO 27001