ISO 27001:2022 Changes Explained — What Shifted from the 2013 Edition

This article explains the most impactful ISO 27001:2022 changes, what they mean for monitoring and evidence, and how to avoid surveillance findings when legacy documentation still describes 2013 Annex A numbering.

Structural changes in the management system clauses

ISO 27001:2022 adopts the Harmonized Structure used across ISO management standards, making integration with ISO 22301, ISO 9001, or environmental programs easier. Notable clause-level updates include:

• Clause 4.2 — interested-party requirements must be addressed through the ISMS, not as a static stakeholder list.
• Clause 6.3 — new Planning of changes requirement for deliberate ISMS modifications.
• Clause 6.1.3 — Statement of Applicability wording clarifications tying risk treatment to control implementation descriptions.
• Annex A — entirely new control catalog structure; the 2013 control IDs no longer apply.

Certification bodies issued transition guidance through IAF MD 26; organizations that delayed SoA rewrites or risk assessments surfaced major nonconformities during the first 2026 surveillance visits.

Review the ISO 27001 compliance hub for CyberSilo mapping between Annex A themes and monitoring solutions.

Annex A 2022: four themes, 93 controls

Controls now group into organizational, people, physical, and technological themes. Several controls merged or reframed topics such as threat intelligence, cloud services, ICT readiness for business continuity, and secure coding. Teams must rewrite control narratives — copying 2013 text into 2022 SoA rows is an audit red flag.

Technological controls still encompass logging, monitoring, privileged access, malware defenses, and secure authentication — the operational areas where SIEM evidence remains central.

What did not fundamentally change

ISO 27001 still certifies the ISMS — not individual tools. Risk assessment, internal audit, management review, corrective action, and continual improvement remain the backbone. Organizations with strong 2013 programs transitioned smoothly when they treated 2022 as a control catalog upgrade plus clause refinements, rather than a rebranding exercise.

Evidence expectations for operating effectiveness intensified in practice because consolidated controls expect broader proof — for example, combining monitoring themes that were previously scattered across multiple 2013 controls.

Monitoring and logging implications under 2022

Threat detection, event logging, clock synchronization, and administrator activity review still appear — now with wording aligned to modern cloud and hybrid environments. Practical evidence includes:

• SIEM coverage reports tied to the asset inventory used in risk assessment.
• Retention and integrity controls for security logs.
• Alert handling records with defined roles and escalation paths.
• Periodic review of detection rules after major architecture changes (supporting Clause 6.3 change planning).

ThreatHawk SIEM provides centralized correlation and investigation timelines; Compliance Standards Automation helps maintain SoA rows linked to log sources, benchmarks, and exported audit packs so surveillance audits do not depend on manual scrapes.

SoA and risk treatment refresh checklist

1. Re-run risk assessment with current threat scenarios (supply chain, ransomware, SaaS compromise).
2. Map each applicable Annex A 2022 control to owner, implementation summary, and evidence type.
3. Document justified exclusions with risk acceptance approval.
4. Align internal audit plans to sample 2022 control themes across departments.
5. Update supplier contracts when outsourced monitoring or MSSP services support technological controls.

ISO 27001:2022 and other frameworks in 2026

Organizations map 2022 controls to SOC 2 trust criteria, NIST CSF Subcategories, and CIS Controls for unified reporting. The technological theme overlaps CIS Safeguards for inventory, secure configuration, and continuous monitoring — teams can feed CIS benchmark results and SIEM metrics into the same governance review cadence.

Common surveillance findings after transition

Auditors report recurring gaps: SoA referencing obsolete control numbers; risk treatment plans not updated for merged controls; missing evidence for new organizational controls on threat intelligence consumption; and change management records absent for major cloud migrations despite Clause 6.3 expectations.

Closing gaps requires GRC and SOC collaboration — not a last-minute document refresh.

Documentation updates beyond the SoA

Update employee-facing policies, supplier security schedules, and internal audit checklists to reference 2022 control themes explicitly. Training materials for developers and help desk staff should mention renamed controls around secure development and user endpoint devices so operational interviews match the SoA during Stage 2 and surveillance visits.

Our conclusion

ISO 27001:2022 changes are substantive in Annex A structure and meaningful in clause-level planning expectations, but they reward programs that already operated the ISMS honestly. Use the ISO 27001 hub, automate mappings with Compliance Standards Automation, and instrument monitoring with ThreatHawk SIEM. Contact CyberSilo for transition reviews before your next surveillance audit.