ISO 27001:2022 — What Changed from 2013 and How to Transition

Annex A Restructure (Locked Counts)

IAF MD 26 Note 2: compared with the prior edition, ISO/IEC 27002:2022 decreases from 114 controls in 14 clauses to 93 controls in 4 clauses (11 new, 24 merged, 58 updated).

ISMS Clause Highlights

• 4.2 c) — determine which interested-party requirements are addressed through the ISMS
• 6.1.3 — SoA / risk-treatment wording clarified; compare necessary controls to Annex A
• 6.3 — Planning for changes (new subclause)
• Documented-information evidence wording aligned in Clauses 9 and 10

If You Still Hold or Reference 2013

• Update the Statement of Applicability to the 2022 Annex A structure
• Gap-analyze new/changed controls (including A.5.7, A.8.9, A.8.15, A.8.16 among others)
• Complete a transition or initial certification path with an IAF-accredited CAB against 2022

Frequently Asked Questions

When did the 2013 to 2022 transition end?

IAF MD 26 required CAB transitions of certified clients to be completed by 31 October 2025 (36 months from the publication month of ISO/IEC 27001:2022). Certifications based on ISO/IEC 27001:2013 were to expire or be withdrawn at the end of that period.

How many Annex A controls are in the 2022 edition?

93 controls in 4 themes, aligned to ISO/IEC 27002:2022 (down from 114 controls in 14 clauses in the prior edition).

What management-system clauses changed?

Notable items include 4.2 c) interested-party requirements addressed through the ISMS, new 6.3 Planning for changes, SoA wording clarifications in 6.1.3, and Harmonized Structure alignment (see IAF MD 26 summary).

Related ISO 27001 Resources

ISO 27001 hub · 93 controls · SoA · CSA · Certification timeline