ISO 27001:2022: what changed from the 2013 version

If your company held ISO 27001 under the 2013 version, by now it will either have moved to the 2022 version or lost its certificate: the transition ended on 31 October 2025. And if you’re thinking of getting certified now, everything you find about the 2013 Annex A is out of date. In this article we summarise what really changed, with links to the sources, and what it means in practice for a software company.

The structure of Annex A

ISO/IEC 27001 has two parts: the management system requirements (clauses 4 to 10) and Annex A, the reference list of controls. Annex A is aligned with ISO/IEC 27002, the guidance that explains each control, and the 2022 version inherited its new structure.

According to the technical bulletin from UKAS, the United Kingdom’s accreditation body, ISO/IEC 27002:2022 contains 93 controls, 11 of which are new, organised in four themes; in addition, 24 have been merged and 58 updated.

Fewer controls doesn’t mean fewer requirements: many have been merged. What changes is how they’re grouped, and that means redoing the Statement of Applicability.

The 11 new controls

These are the eleven controls that didn’t exist in 2013 (the list is the same across certification bodies’ publications, such as SGS):

1. Threat intelligence. Collecting and analysing information about threats in order to act on it.
2. Information security for use of cloud services. How they’re procured, used, managed and exited.
3. ICT readiness for business continuity. Making sure systems can be recovered within the agreed objectives.
4. Physical security monitoring. Monitoring premises to detect unauthorised access.
5. Configuration management. Security configurations that are defined, documented and reviewed.
6. Information deletion. Deleting information when it’s no longer needed.
7. Data masking. Hiding data, especially personal data, when there’s no need to see it.
8. Data leakage prevention. Measures to detect and prevent information leaving without authorisation.
9. Monitoring activities. Monitoring networks, systems and applications to detect anomalous behaviour.
10. Web filtering. Controlling access to external websites to reduce exposure to malicious content.
11. Secure coding. Applying secure development principles when writing software.

For a software company, the ones that usually take the most work are configuration management, monitoring activities and secure coding. They’re very technical controls: a policy in a document won’t settle them; you need to be able to show the infrastructure as code, the monitoring with its alerts and the code review process.

The end of the transition: 31 October 2025

The standard was published on 25 October 2022. The International Accreditation Forum (IAF) set a three-year transition period and, according to the timeline published by UKAS, the transition of all certified clients had to be completed by 31 October 2025.

In other words, a valid ISO 27001 certificate today is for the 2022 version. If a supplier shows you a 2013 certificate, it is no longer in force.

The 2024 amendment: climate change

In February 2024 ISO/IEC 27001:2022/Amd 1:2024 was published, as part of an update ISO applied to its management system standards. It adds two sentences:

• In clause 4.1 (context of the organisation): the organisation shall determine whether climate change is a relevant issue.
• In clause 4.2 (interested parties): a note pointing out that interested parties can have requirements related to climate change.

It adds no controls. In practice, you deal with it by recording in your analysis of context whether climate affects your information security (for example, the availability of a data centre during extreme weather) and why.

What it means in practice

If you’re starting ISO 27001 now, go straight to the 2022 version with its amendment. The usual steps are:

1. Define the scope of the management system.
2. Assess the risks and decide how to treat them.
3. Write the Statement of Applicability covering the 93 controls: which apply, which don’t and why.
4. Implement what’s missing and gather evidence.
5. Internal audit and management review before the certification audit, which is carried out by an accredited certification body.

If you also work with the public sector, the ENS shares a lot of ground with ISO 27001; we explain it in the article on the ENS for public sector suppliers. And if your customers ask you about NIS2, in what NIS2 is and who it applies to we explain where Spain stands.

In ENS and ISO 27001 compliance we explain how we prepare you and support you up to the audit, and in the reliability and security audit, how we review the technical side of a platform. If you want to know how far you are from the 2022 version, send us an email.

Frequently asked questions

Is an ISO 27001:2013 certificate still valid?

No. The transition period ended on 31 October 2025, and certificates that hadn’t moved to the 2022 version stopped being valid on that date.

Do all 93 controls have to be applied?

Not necessarily. You have to review them all in the Statement of Applicability and justify which apply and which don’t, based on your risk assessment.

Does the 2024 amendment require measuring your carbon footprint?

No. It asks you to determine whether climate change is a relevant issue for your management system and to consider whether interested parties have climate-related requirements. It adds no specific controls or measurements.

Who issues the ISO 27001 certificate?

An accredited certification body, after a certification audit. We prepare you for that audit and support you through it; we don’t issue the certificate.

References

• ISO: ISO/IEC 27001:2022, the standard’s page.
• ISO: ISO/IEC 27001:2022/Amd 1:2024, climate change amendment.
• UKAS: Transition arrangements for ISO/IEC 27001:2022: number of controls and transition timeline.
• SGS: Key changes in ISO/IEC 27002:2022: list of the 11 new controls.