When ISO/IEC 27001:2022 was published in October 2022, it gave certified organisations a three-year window to transition from the 2013 version. That window closed on 31 October 2025. Certificates issued against ISO/IEC 27001:2013 are no longer valid.
For most organisations, the transition itself was achieved: the Statement of Applicability was updated, new policies were written and the certification body issued a new certificate. But the audits now taking place, surveillance audits in the first and second years after transition, and the recertification audits that follow, ask a harder question. Not "have you documented the new controls?" but "are they operating effectively, and can you prove it?"
This article summarises what changed in the 2022 revision, explains why the changes matter, and sets out where we see organisations falling short as auditors look beyond the paperwork.
The structural changes
The body of the standard (clauses 4 to 10, which define the requirements of the information security management system (ISMS) itself) changed relatively modestly. The more visible change was to Annex A, the reference set of information security controls, which was realigned with ISO/IEC 27002:2022.
The headline figures are straightforward:
- The number of controls fell from 114 to 93, largely through consolidation of related controls.
- The previous 14 control domains were replaced by four themes: organisational (37 controls), people (8), physical (14) and technological (34).
- 11 controls are entirely new.
- Each control in ISO/IEC 27002 now carries attributes, such as control type, cybersecurity concept and operational capability, that allow organisations to filter and view controls in different ways.
The reduction in control numbers does not mean a reduction in expectations. Most of the consolidation merged controls that were always closely related. Organisations that simply remapped their old controls to the new numbering found the transition straightforward; those that used it as an opportunity to review whether their controls were effective generally found more to do.
The 11 new controls
The new controls reflect how the threat landscape and technology environment have changed since 2013. They are where auditors are focusing most attention, because they are where organisations have the least operating history.
5.7 Threat intelligence
Organisations must collect and analyse information about threats relevant to them and use it to inform their security decisions. The key word is "use". A subscription to a threat feed is not sufficient; auditors expect to see evidence that intelligence has changed something: a risk rating, a detection rule, a patching priority.
5.23 Information security for use of cloud services
Processes for acquiring, using, managing and exiting cloud services must be defined. This includes understanding the shared responsibility model for each service and having a credible exit strategy, which many organisations have not considered.
5.30 ICT readiness for business continuity
ICT continuity must be planned, implemented, maintained and tested based on business continuity objectives. The emphasis on testing is significant: plans that have never been exercised rarely satisfy an auditor.
7.4 Physical security monitoring
Premises must be continuously monitored for unauthorised physical access. For organisations with offices, data centres or other facilities, this typically means CCTV, alarms or access monitoring, with evidence that alerts are reviewed.
8.9 Configuration management
Configurations of hardware, software, services and networks, including security configurations, must be established, documented, implemented, monitored and reviewed. In practice, this means defined secure baselines and a way of detecting drift from them.
8.10 Information deletion
Information must be deleted when no longer required. This intersects directly with data protection obligations and requires organisations to know what data they hold, where, and for how long it should be retained.
8.11 Data masking
Data masking must be used in line with access control policies, business requirements and legal obligations. Common applications include masking personal data in test environments and limiting the display of sensitive fields to authorised users.
8.12 Data leakage prevention
Measures to prevent data leakage must be applied to systems, networks and devices that process sensitive information. This does not necessarily require a dedicated DLP product, but it does require a considered set of technical and procedural measures proportionate to the risk.
8.16 Monitoring activities
Networks, systems and applications must be monitored for anomalous behaviour, with appropriate action taken to evaluate potential incidents. Logging alone is insufficient; auditors look for evidence of monitoring, alerting and response.
8.23 Web filtering
Access to external websites must be managed to reduce exposure to malicious content. This is often already in place through secure web gateways or DNS filtering, but it must be documented and its effectiveness reviewed.
8.28 Secure coding
Secure coding principles must be applied to software development. For organisations that develop software, auditors expect to see defined standards, developer training, code review and security testing integrated into the development lifecycle.
Changes to the management system clauses
The clause changes were subtler but still important:
- Clause 4.2 now requires organisations to determine which requirements of interested parties will be addressed through the ISMS, making the link between stakeholder expectations and the ISMS more explicit.
- Clause 4.4 requires the processes needed for the ISMS, and their interactions, to be established, reinforcing a process-based view of the management system.
- Clause 6.2 adds explicit requirements for information security objectives to be monitored and made available as documented information.
- Clause 6.3 is new, requiring changes to the ISMS to be carried out in a planned manner.
- Clause 9.3 adds changes in the needs and expectations of interested parties as an input to management review.
In 2024, an amendment to the standard added a further requirement to clauses 4.1 and 4.2: organisations must determine whether climate change is a relevant issue for their ISMS, and whether interested parties have requirements related to it. For most organisations, this is a short, documented consideration rather than a major change, but it must be addressed.
Where organisations are falling short
In the surveillance and recertification audits we have supported since the transition deadline, the same weaknesses appear repeatedly.
Controls implemented on paper only
The most common finding is a control that is documented in a policy but has no operating evidence. A threat intelligence procedure exists, but nobody can show a decision that intelligence informed. A configuration management standard exists, but there is no mechanism to detect drift from it. Auditors are now well past the transition period and are testing for evidence of operation.
Risk assessments not refreshed
Many organisations updated their Statement of Applicability for the new controls without revisiting the risk assessment that is supposed to justify control selection. The result is an SoA whose inclusions and exclusions are not traceable to identified risks, a fundamental weakness in an ISO 27001 system.
Cloud services treated as someone else's problem
Control 5.23 exposes a common gap: organisations that rely heavily on cloud services but have never documented which security responsibilities sit with them and which with the provider, or how they would exit a critical service. Supplier assurance for cloud providers is often limited to collecting a certificate.
Monitoring without response
Organisations frequently collect logs but cannot demonstrate that anyone reviews the resulting alerts or that anomalies lead to investigation. Control 8.16 requires both monitoring and action.
Business continuity plans that have never been tested
ICT continuity plans that have never been exercised, or that were tested once years ago, rarely satisfy control 5.30. Auditors look for a testing schedule, test results and evidence that lessons learned were acted on.
The question has moved on from "is the control in your Statement of Applicability?" to "show me the last three times it worked".
A practical plan for the next audit cycle
For organisations preparing for their next surveillance or recertification audit, we recommend focusing on five activities:
- Refresh the risk assessment and confirm that every control included or excluded in the Statement of Applicability is justified by it.
- Build an evidence register for each of the 11 new controls, identifying what evidence of operation exists, how often it is produced, and who owns it.
- Run an internal audit focused on operating effectiveness, not documentation, and sample evidence as an external auditor would.
- Test continuity and incident response plans through realistic exercises, and record the outcomes and improvements.
- Review supplier and cloud service arrangements against control 5.23, including exit plans for critical services.
Why it matters beyond certification
It is tempting to treat ISO 27001 as a certificate to be maintained. But the 2022 revision genuinely reflects how organisations are attacked today: through cloud misconfiguration, data leakage, insecure code and threats that were visible in advance to anyone watching. The new controls are a reasonable description of what a modern security programme should do.
Organisations that implement them properly gain more than a certificate. They gain better visibility of their environment, faster detection of problems and a management system that improves security rather than documenting it. Our ISO practice supports organisations through gap assessments, implementation, internal audit and certification readiness, with a consistent focus on controls that work, not just controls that exist.