ISO/IEC 27001:2022: the new Annex A and what certification now means

What it is

ISO/IEC 27001 is the international standard for an information security management system (ISMS): the policies, processes, roles and records an organisation uses to manage information security risk in a repeatable way. It is the most widely recognised security certification worldwide. An accredited certification body audits the ISMS and, if it conforms, issues a certificate valid for three years with annual surveillance audits.

The standard has two parts. Clauses 4 to 10 contain the mandatory management system requirements: understand your context, show leadership, plan based on risk, provide resources, operate, evaluate performance and improve. Annex A lists reference controls. You select controls through risk assessment and record your decisions in a Statement of Applicability, which explains for each control whether it applies and why.

Why it matters

Customers, partners and regulators often ask for ISO 27001 certification as evidence of a functioning security programme, especially for cloud providers, managed service providers and outsourcers. For engineers, it explains why change records, access reviews and supplier assessments exist: they produce the evidence auditors need to see that controls operate consistently.

What changed in the 2022 edition

The 2022 edition was published in October 2022, aligned with the control set in ISO/IEC 27002:2022, and retitled under "information security, cybersecurity and privacy protection".

The total fell from 114 controls in 14 domains to 93 in four themes, mostly by merging overlapping controls. Eleven controls are new: threat intelligence; information security for use of cloud services; ICT readiness for business continuity; physical security monitoring; configuration management; information deletion; data masking; data leakage prevention; monitoring activities; web filtering; and secure coding. ISO/IEC 27002 also introduced optional attributes (such as control type and cybersecurity concept) that let you sort controls in different ways, for example by CSF function.

The management clauses changed less, but there are new or clearer requirements on planning changes to the ISMS, monitoring information security objectives and controlling externally provided processes. In February 2024 an amendment added climate action changes, requiring organisations to consider whether climate change is a relevant issue in their context and for interested parties.

The three-year transition ended on 31 October 2025. Certificates against the 2013 edition are no longer valid.

How practitioners apply it

1. Define scope carefully. Which sites, systems, teams and services are in the ISMS? A narrow, honest scope is better than a broad one you cannot evidence.
2. Run a risk assessment using a method you can repeat, then choose treatments.
3. Write the Statement of Applicability against the 93 controls, justifying inclusions and exclusions.
4. Implement and evidence controls. New controls such as configuration management and monitoring activities map directly to network work: configuration backups, baseline templates and alerting (see change, audit and continuity).
5. Run internal audits and management review, then fix nonconformities before the certification audit.

Consider how one new control plays out for a network team. Control 8.9, configuration management, expects secure configurations for hardware, software, services and networks to be established, documented, implemented, monitored and reviewed. In practice that means a documented baseline for each switch and firewall model, automated backups of running configurations, a way to detect unauthorised changes, and periodic review. An auditor will typically sample a few devices, compare them with the baseline and ask to see the change records that explain any differences. If the team already uses configuration management tooling and version control, most of this evidence exists; the work is in showing it clearly.

Tip: Map Annex A to the frameworks you already use. Most 2022 controls line up with CIS safeguards or CSF subcategories, so one set of evidence can serve several purposes.

Limitations and open questions

• Certification proves a management system, not security. A certified organisation can still be breached. The audit samples evidence; it does not test every control technically.
• Scope games. A certificate may cover only one data centre or service. Always read the scope statement.
• Paperwork risk. Some organisations produce documents without changing practice. Good auditors look for operating evidence, not just policies.
• Related standards are needed for depth: ISO/IEC 27002 for control guidance, 27005 for risk management, 27017 for cloud and 27701 for privacy.