ISO 27001:2013 vs ISO 27001:2022: What Changed

ISO/IEC 27001:2022 replaced the 2013 edition as the current requirements standard for information security management systems. The revision did not discard the risk-based ISMS model, but it did change clause wording, reorganise Annex A and introduce control subjects that better reflect modern technology and threat conditions.

For an organisation moving from the previous edition, the useful question is not whether two control numbers match. It is whether the ISMS has understood the changed requirements, reconsidered its risks and produced evidence that the current system works.

Which edition is current?

ISO/IEC 27001:2022 is the current published edition. ISO/IEC 27001:2013 is withdrawn. The international transition period for accredited certification ended on 31 October 2025 under IAF MD 26, so a certificate still presented solely against the 2013 edition warrants investigation.

That does not make historical 2013 records useless. Prior risk assessments, treatment decisions, control procedures and audit results can remain valid evidence where they still reflect the current scope and operation. The organisation must show why it retained, revised or replaced them.

The management-system structure remained recognisable

The main requirements still follow the common management-system structure: context, leadership, planning, support, operation, performance evaluation and improvement. Core expectations such as defining scope, assessing risk, setting objectives, operating controls, conducting internal audit and completing management review remain.

The 2022 text nonetheless introduced changes that affect implementation and audit trails. Examples include:

• greater attention to changes in relevant interested-party requirements;
• an explicit need to determine which interested-party requirements the ISMS will address;
• clearer planning for changes to the ISMS;
• more explicit monitoring of information-security objectives;
• a requirement to make relevant documented information available for operational processes; and
• revised language around communication and control of externally provided processes, products or services.

These points should be considered in context. A transition project that only renumbers Annex A controls can miss changes in clauses 4 through 10. The guide to ISO 27001 clauses 4–10 helps owners connect those requirements to management evidence.

Annex A changed shape

The most visible revision is Annex A. The 2013 edition listed 114 controls in 14 domains. The 2022 edition lists 93 controls grouped into four themes:

2022 theme	Operational focus
Organisational	Governance, people-related administration, suppliers, incidents, continuity and compliance
People	Screening, employment responsibilities, awareness, disciplinary matters and reporting
Physical	Premises, equipment, media, utilities and environmental protection
Technological	Identity, access, configuration, networks, development, logging, data and technical resilience

The lower count does not mean fewer security outcomes. Many previous controls were merged, clarified or reorganised. Some were split conceptually, and 11 control subjects were introduced as new in the 2022 control set.

The 11 new Annex A controls guide explains the additions, including threat intelligence, cloud-service security, data masking, data leakage prevention and secure coding.

Control mapping is a starting point, not a decision

A crosswalk can show where an old control moved, merged or changed. It cannot decide whether the current control is necessary for a particular organisation. That decision still comes from information-security risk treatment, legal and contractual duties and other relevant requirements.

Use mapping in three stages:

1. Trace existing evidence. Identify which current policies, technical settings, reviews and records supported each previous control.
2. Reassess applicability. Evaluate the current Annex A controls against present risks and obligations rather than automatically inheriting old selections.
3. Close outcome gaps. Where the 2022 control intent is broader or newly relevant, assign an owner, implement treatment and gather operating evidence.

The Annex A control lookup can help navigate the current control set. The Annex A selection guide explains why applicability should follow risk rather than a mechanical mapping exercise.

Update the Statement of Applicability carefully

The Statement of Applicability should identify the necessary controls, explain inclusion and exclusion decisions, state whether necessary controls are implemented and connect those decisions to risk treatment.

A sound transition preserves traceability without turning the document into a history archive. For each current control, show:

• the risk or requirement that makes it relevant;
• the implementation status and responsible owner;
• the current supporting policy, process or technology;
• the evidence that demonstrates operation; and
• any relationship to an earlier control where that context is useful.

Do not assume that a merged control is fully implemented because one of its predecessors was. Inspect every relevant outcome. Equally, do not create duplicate processes merely because one current control maps to several older records.

The Annex A documentation-structure guide offers a practical way to keep control decisions, implementation material and operating evidence distinct.

Revisit risk and context before changing controls

The revision arrived alongside changes in cloud use, remote work, supply chains, privacy expectations and threat behaviour. A credible transition uses the revised standard as a reason to reassess the organisation, not as proof that its risks changed in a predetermined way.

Review at least:

• scope boundaries and important interfaces;
• interested parties and requirements the ISMS addresses;
• information assets, processes and supporting technology;
• supplier and cloud dependencies;
• risk criteria, assessments and treatment plans;
• security objectives and monitoring methods; and
• legal, regulatory and contractual changes.

Since the 2024 climate-action amendment, organisations must also determine whether climate change is a relevant issue in their context, and the accompanying note recognises that relevant interested parties may have climate-related requirements. This is a context decision, not a requirement to invent environmental controls where no information-security relevance exists.

Build an evidence-based transition record

Implementation evidence proves that the revised system was designed and put in place. Operating evidence proves it functions over time.

Useful implementation evidence includes:

• an approved transition scope and responsibilities;
• a clause-level change assessment;
• a 2013-to-2022 control crosswalk;
• revised risk and applicability decisions;
• approved changes to policies, processes and technologies;
• training or communication records where responsibilities changed; and
• a controlled plan for unresolved actions.

Useful operating evidence includes completed access reviews, supplier assessments, incident records, monitoring results, recovery tests, secure-development records, internal-audit samples and management-review decisions. Select evidence according to the controls and risks actually present.

Audit the transition as a management-system change

An internal audit should test more than document dates. Sample across governance, control operation and assurance.

Questions worth asking include:

• Was the change assessment complete across clauses and Annex A?
• Were applicability decisions reconsidered against current risks?
• Can owners explain changed responsibilities and control outcomes?
• Do new or revised controls have operating evidence?
• Were old references removed from live procedures without breaking traceability?
• Did internal audit cover the current edition and revised scope?
• Did management review address transition performance and remaining risks?

A pass is supported where current requirements are reflected in risk decisions, controls operate as intended and the evidence trail is coherent.

A partial result may apply where documents use 2022 numbering but risk decisions, owner understanding or operating evidence remain incomplete.

A fail is likely where the organisation treats a crosswalk as implementation, continues to assert certification to a withdrawn edition without valid evidence, or cannot connect current controls to risk treatment.

Avoid unnecessary reinvention

A revision does not require every ISMS document to be rewritten. Retain material that is accurate, controlled and effective. Change it when requirements, risks, responsibilities or operating practices have changed.

This reduces disruption and makes review easier: the organisation can explain what changed, what did not, why each decision was made and how effectiveness was verified.

The official ISO/IEC 27001 overview identifies the 2022 edition as current. The IAF document register publishes the mandatory transition arrangements used for accredited certification.

The strongest transition outcome is not a new numbering scheme. It is an ISMS that has re-examined its context and risks, selected current controls deliberately and can demonstrate that those controls operate.