Everything You Need to Know About the ISO 27001: 2022 Standard Update

A new and improved version of ISO/IEC 27001 was published last week to address growing global cybersecurity challenges and improve digital trust. The world’s best-known standard on information security management helps organisations secure their information assets – which is vital in today’s increasingly digital world. 

If you’re responsible for information security, the new ISO/IEC 27001: 2022 standard update requires you to implement the changes to ensure you remain compliant and align your infosec posture with the digitisation of business practices and accompanying threats. 

What Has Changed In The ISO/IEC 27001: 2022 Standard  

The good news is that many changes are editorial, for example, changing ‘international standard’ to ‘document’ throughout and rearranging phrases to allow for better international translation. 

There are also changes to align with the ISO harmonised approach: 

• Numbering re-structure 
• The requirement to define processes needed for implementing the ISMS and their interactions 
• The explicit requirement to communicate organisational roles relevant to information security within the organisation 
• New clause 6.3 – Planning of Changes 

• A new requirement to ensure the organisation determines how to communicate as part of clause 7.4 
• New requirements to establish criteria for operational processes and implement control of the processes

The core changes, however, apply to updates to the current controls in Annex A to align the standard better with the recent changes to ISO/IEC 27002 – Information security, cybersecurity and privacy protection.

The changes to ISO/IEC 27001: 2022 also consider that risk management increasingly spreads across more organisational functions. Therefore the updates are intended to make it more straightforward for more people to map and implement the proper security controls. 

What Are The Core Changes to Annex A Controls in ISO/IEC 27001: 2022 

The number of controls has reduced from 114 to 93

Some controls have been deleted, 24 controls have been merged, and 58 have been revised. 11 new security controls have been added, designed to address the evolving information security and cybersecurity landscape; these are: 

A.5.7 Threat intelligence  

A.5.23 Information security for use of cloud services  

A.5.30 ICT readiness for business continuity  

A.7.4 Physical security monitoring  

A.8.9 Configuration management  

A.8.10 Information deletion  

A.8.11 Data masking  

A.8.12 Data leakage prevention  

A.8.16 Monitoring activities  

A.8.23 Web filtering  

A.8.28 Secure coding  

As a result, you need to update your management system to optimise any existing ISMS and better align with the context of your information security risks and your organisation. 

The structure has been consolidated into four key areas

• Organisational 

• People
• Physical  
• Technological  

This contrasts with the 14 areas that formed the previous version of the standard.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

The concept of attributes has been introduced

Aligned with the common terminology used within digital security, five attributes have been introduced:  

• Control type 
• Information security properties 
• Cybersecurity concepts 
• Operational capabilities 
• Security domains

These should enable organisations to understand their current security posture better and encourage the adoption of security practices and processes that will lead to more effective business operations. 

Additional Guidance for ISO/IEC 27001: 2022 

Download our helpful ‘Summary of Changes’ worksheet that outlines all the critical changes to controls from the current version and offers a roadmap to achieving ISO/IEC 27001: 2022.  

Download Guide

Strengthen your Information Security Posture Today 

Organisations that adopt cyber resilience quickly emerge as leaders in their industry and achieve a competitive advantage. The updated ISO/IEC 27001 ensures the entire organisation is covered, not just your infosec team and supports your digitisation strategy, reduces the risks of breaches, and builds trust in your brand and your organisation’s information resilience.  

The ISMS.online platform and tools are ready to support you now, from helping you understand the changes, checking the impact on your organisation’s security objectives, implementation guidance, and transitioning your certification. Unlock your compliance advantage today!  

Book A Demo