ISO 27001:2022: the Annex A changes and what to do after the transition
The ISO 27001:2022 Annex A changes cut the controls from 114 to 93, group them into 4 themes and add 11 new controls. The transition deadline passed on 31 October 2025. So the task today is to apply the new Annex A properly and to know what to do if your certificate was still to the 2013 edition.
In 30 seconds: the ISO 27001:2022 Annex A has 93 controls (37 organisational, 8 people, 14 physical and 34 technological), 11 of them new. However, 2013 certificates expired or were withdrawn on 31 October 2025, so an organisation that did not transition needs a new certification. Since 2024, Amendment 1 also requires you to decide whether climate change is relevant to your ISMS.
ISO 27001 Annex A in 2026: the transition is over
ISO published ISO/IEC 27001:2022 on 25 October 2022. Then the International Accreditation Forum’s mandatory document, IAF MD 26:2023, set a 36-month transition. From 30 April 2024, initial certifications and recertifications could only take place against the 2022 edition. Finally, on 31 October 2025 all certifications based on the 2013 edition expired or were withdrawn. As a result, as of October 2026:
- An ISO/IEC 27001:2013 certificate is no longer valid, even when it shows a later expiry date.
- If you did not transition in time, you need a full initial certification to ISO 27001:2022 and its Annex A. This normally takes two stages: firstly a documentation review, then an implementation audit.
- If you did transition, your cycle’s expiry date did not change. However, the job now is to keep the new controls working at every surveillance audit.
ISO 27001 Annex A changes: from 114 to 93 controls in 4 themes
Annex A lists the controls from ISO/IEC 27002:2022. The 14 domains of 2013 are gone, as are group-level control objectives, so each control now has its own purpose. According to IAF MD 26, the ISO 27001:2022 Annex A has 11 new controls, 24 that result from merging earlier controls and 58 updated ones.
| Theme | Clause | Controls | Examples |
|---|---|---|---|
| Organisational | A.5 | 37 | Policies, assets, suppliers, cloud, incidents, ICT continuity |
| People | A.6 | 8 | Screening, awareness, confidentiality, remote working |
| Physical | A.7 | 14 | Perimeters, physical entry, monitoring, equipment, media |
| Technological | A.8 | 34 | Privileged access, malware, vulnerabilities, backups, logging, development |
| Total | 93 | 11 new, 24 merged, 58 updated |
Control attributes in ISO/IEC 27002:2022
ISO/IEC 27002:2022 tags each control with five attributes. They are optional, but they are very useful for filtering controls and also for mapping them across frameworks:
- Control type: preventive, detective or corrective.
- Information security properties: confidentiality, integrity and availability.
- Cybersecurity concepts: identify, protect, detect, respond and recover.
- Operational capabilities: governance, asset management, identity and access management, continuity and supplier relationships, as well as others.
- Security domains: governance and ecosystem, protection, defence and resilience.
The 11 new ISO 27001 Annex A controls and how to implement them
The new ISO 27001 Annex A controls call for practice you can demonstrate, not just a policy. Therefore, the more evidence comes straight from your systems, the less time you lose. We explain how in automating compliance evidence.
| Control | What it asks for in practice | Typical evidence |
|---|---|---|
| 5.7 Threat intelligence | Collect and analyse threat information and use it in risk management | Subscribed sources, periodic reports, resulting decisions |
| 5.23 Information security for use of cloud services | Define how cloud services are acquired, used, managed and exited | Cloud policy, inventory, contract review, exit plan |
| 5.30 ICT readiness for business continuity | Plan, test and maintain ICT capability in line with continuity objectives | BIA with RTO and RPO, recovery plans, test records |
| 7.4 Physical security monitoring | Monitor premises for unauthorised physical access | Alarms, CCTV, reviewed access logs |
| 8.9 Configuration management | Define, control and review secure configurations | Baseline configurations, change control, drift reports |
| 8.10 Information deletion | Delete information no longer needed, including at suppliers | Retention policy, deletion certificates |
| 8.11 Data masking | Mask or pseudonymise data in line with policy and the law | Masking rules, test environments without real data |
| 8.12 Data leakage prevention | Detect and prevent unauthorised disclosure of sensitive information | DLP rules, handled alerts, classification |
| 8.16 Monitoring activities | Monitor networks and systems for anomalous behaviour | SIEM or alert console, thresholds, tickets |
| 8.23 Web filtering | Manage access to external websites to reduce exposure to malware | Filter configuration, block reports |
| 8.28 Secure coding | Apply secure coding principles to development | Coding guidelines, code reviews, static analysis |
Which controls are hard to exclude
No ISO 27001 Annex A control is automatically mandatory: it applies when your risk assessment justifies it. However, excluding 5.23 when you run on the cloud or 8.28 when you develop software will be hard to defend. In addition, control 5.30 links to business continuity. So, to go beyond ICT, see how ISO 27001 and ISO 22301 differ.
Changes to clauses 4 to 10
The 2022 edition aligns the body of the standard with ISO’s harmonised structure. Most changes are editorial, but an ISO 27001 auditor will check these alongside Annex A:
- 4.2 c): decide which interested-party requirements the ISMS will address.
- 4.4: the ISMS includes the processes needed and also their interactions.
- 6.2: you monitor information security objectives and, in addition, document them.
- 6.3 (new): you plan changes to the ISMS before you make them.
- 8.1: criteria for processes and, in particular, control of externally provided processes, products or services.
- 9.3.2 c): management review also covers changes in the needs and expectations of interested parties.
Amendment 1:2024: climate change in 4.1 and 4.2
ISO/IEC 27001:2022/Amd 1:2024 came out in February 2024. Specifically, it adds to 4.1 that the organisation shall determine whether climate change is a relevant issue. It also adds a note to 4.2: interested parties can have climate-related requirements. In addition, the ISO and IAF joint communiqué makes clear that the intent of both clauses is unchanged. In practice, record in your context analysis whether climate affects your ISMS and what your customers expect. For example, consider heatwaves at a data centre or flooding at a site.
How to update the Statement of Applicability for ISO 27001 Annex A
The Statement of Applicability (SoA) must refer to all 93 controls of the ISO 27001:2022 Annex A. So, whether you are coming from 2013 or reviewing it before your next audit, follow these steps:
- Map each 2013 control to its 2022 equivalent using the correspondence table in Annex B of ISO/IEC 27002:2022.
- Review the risk assessment and treatment plan, then check them against the 11 new controls.
- For each control, state whether it applies, why you include or exclude it and whether you have implemented it.
- Update the references in policies and procedures, because they tend to quote the old numbers.
- Tag the controls with attributes and also with the regulations they respond to.
- Gather evidence that the controls work, because the auditor will not settle for documents.
How ISO 27001 Annex A relates to NIS2, DORA and ENS
None of these frameworks requires ISO 27001 certification. However, an ISMS built on the ISO 27001:2022 Annex A covers much of what they ask for:
- NIS2 (Directive (EU) 2022/2555) requires cybersecurity risk-management measures. Specifically, for certain digital providers, Implementing Regulation (EU) 2024/2690 sets them out in detail. In addition, ENISA’s technical guidance maps them to ISO/IEC 27001:2022 and 27002:2022, while stressing that the mapping does not imply equivalence.
- DORA (Regulation (EU) 2022/2554, applicable since 17 January 2025) also requires an ICT risk management framework. For example, controls such as 5.23, 5.30, 8.9 and 8.16 provide direct evidence.
- ENS, Spain’s National Security Framework (Royal Decree 311/2022), has its own measures and certification. Still, you can reuse much of your ISO 27001 Annex A evidence.
We go into this in ISO 27001 as a shortcut to NIS2, GDPR and DORA. We also cover it in our guide to meeting several regulations with one control map.
Frequently asked questions
Is an ISO 27001:2013 certificate still valid?
No. Under IAF MD 26, all ISO/IEC 27001:2013 certifications expired or were withdrawn on 31 October 2025, whatever date the certificate shows. Therefore, you now need an initial certification to the 2022 edition.
How many controls are in ISO 27001:2022 Annex A?
93, in 4 themes: 37 organisational (A.5), 8 people (A.6), 14 physical (A.7) and 34 technological (A.8). The 2013 edition, however, had 114 controls in 14 domains.
Do I have to apply all 93 ISO 27001 Annex A controls?
Not necessarily. Firstly, compare the controls your risk assessment requires against the 93 in Annex A so that you overlook none. Then justify every exclusion in the Statement of Applicability.
Does Amendment 1:2024 require recertification?
No. In fact, it clarifies clauses 4.1 and 4.2 without changing their intent. So add the climate change assessment to your context analysis. Your certification body will then review it during routine audits.
How do I check whether a supplier’s ISO 27001 certificate is valid?
Firstly, check that it refers to ISO/IEC 27001:2022, that its scope covers the service you receive and that it is in date. Then verify it in the certification body’s register or in IAF CertSearch. Finally, confirm that the body holds accreditation (in Spain, from ENAC, the national accreditation body).
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps
Atalaya GRC comes with the 93 controls of the ISO 27001:2022 Annex A preloaded and helps you maintain the Statement of Applicability. In addition, it links each control to the equivalent requirements in NIS2, DORA and ENS (“one control, many regulations”) and collects automated evidence from your systems. The regulatory clock also alerts you to audits, reviews and deadlines. Furthermore, it handles incidents, notifications and the third-party register. See the ISO 27001 and ISO 22301 guide or request a demo.
