ISO 27001:2022: What Changed From the 2013
ISO 27001 2022 changed Annex A, introduced 11 new controls, and made the old 2013 control structure obsolete. StartComply helps European organisations remap controls, update the Statement of Applicability, and collect audit-ready transition evidence without rebuilding the ISMS from scratch.
Trusted by 100+ organisations across Europe
ISO 27001:2022 
SoA mapping 
Audit ready 
NIS2 mapped What you need to know about ISO 27001 2022
- ISO 27001 2022 reduced Annex A from 114 controls to 93 controls across four themes: organisational, people, physical, and technological.
- The revision introduced 11 new controls, including threat intelligence, cloud services, configuration management, data masking, monitoring activities, and secure coding.
- Existing certificates against the 2013 version had to transition by 31 October 2025; new certification projects should use ISO 27001:2022.
- Your Statement of Applicability must be remapped to the 2022 Annex A structure with documented justifications for every new control.
- StartComply centralises gap analysis, SoA updates, owner assignments, evidence collection, and transition audit preparation in one workflow.
Last updated June 2026.
What Changed in ISO 27001 2022?
ISO 27001 2022 updated the information security management standard to reflect modern cloud, supply chain, monitoring, and secure development realities. The main clauses changed in targeted ways, including the addition of Clause 6.3 for planned ISMS changes, while Annex A was fully restructured.
The most visible change is the Annex A control model. The 2013 version contained 114 controls across 14 domains. ISO 27001 2022 consolidates them into 93 Annex A controls across four themes: organisational, people, physical, and technological. That shift affects the Statement of Applicability, control owners, evidence mapping, and transition audit preparation.
The revision also introduced 11 new controls. These cover threat intelligence, information security for cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding.
The practical impact: ISO 27001 2022 is not just a renumbering exercise. Your SoA, risk assessment, policies, procedures, and audit evidence all need to reflect the new control structure.
The 2013 control set is obsolete. Your evidence needs to catch up.
New controls, new structure, new evidence expectations
- 93 Annex A controls replace the previous 114-control structure
- Four themes replace 14 legacy control domains
- 11 new controls require risk-based applicability decisions
- Clause 6.3 requires controlled planning of ISMS changes
- The SoA must map controls to risks, owners, status, and evidence
Transition risk: if your SoA still references the 2013 Annex A structure, it is not aligned to ISO 27001 2022.
Manual mapping creates audit gaps fast
- New controls added without risk-based justification
- Control owners missing from the 2022 SoA
- Evidence still labelled against old 2013 domains
- Policies updated, but procedures and records left behind
- Internal audit scheduled before transition evidence is complete
The audit reality: certification bodies ask for traceability from risk to control to SoA to evidence. Broken chains become findings.
What StartComply Automates for ISO 27001 2022 Transition
2022 Annex A Control Mapping
Map legacy 2013 controls into the 2022 four-theme model, identify merged and new controls, and keep every applicability decision traceable.
- 93-control Annex A structure built in
- Applicability status and rationale per control
- Control owner, review cadence, and evidence status
- Clear transition view for certification audits
Statement of Applicability Updates
Update the SoA without losing the connection between risks, treatment plans, implementation status, and supporting records.
- Risk-based justifications for all 11 new controls
- Evidence references linked to each applicable control
- Change history for auditor review
- Export-ready SoA for certification bodies
Transition Audit Readiness
Prepare for the transition audit with a live evidence library rather than static folders and disconnected spreadsheets.
- Evidence packs for selected controls
- Owner reminders and review workflows
- Internal audit preparation against 2022 controls
- Open gap tracking through closure
EU Compliance Mapping
Use the ISO 27001 2022 control structure as a reusable evidence base for European cyber and operational resilience obligations.
- Mapped control coverage for NIS2 measures
- DORA ICT risk evidence support
- Shared records across overlapping obligations
- Reduced duplicate compliance work
How to Transition to ISO 27001 2022 in Five Steps
Compare 2013 and 2022 controls Transition
Start with a control-by-control gap analysis. Identify controls that merged, split, or disappeared, then isolate the 11 new controls that need fresh applicability decisions. Use the ISO 27001 certification process as the audit endpoint for this work.
Update the Statement of Applicability SoA
Remap the SoA to the 93-control structure. Every applicable control needs owner, status, implementation reference, evidence reference, and a link to the risk treatment plan.
Refresh documents and records Clause 7.5
Update policies, procedures, and evidence records so they reference the new control structure. The ISO 27001 documentation set should match the 2022 SoA before the transition audit.
Run an internal audit first Audit
Run an internal audit against the updated framework before the certification body arrives. The ISO 27001 audit guide shows the evidence auditors typically request at Stage 1, Stage 2, surveillance, and transition checks.
Use the companion standards Risk
Use ISO 27002 guidance to implement controls properly, then connect your risk decisions to ISO 27005 risk management so control choices remain risk-based.
ISO 27001:2013 vs ISO 27001:2022 at a Glance
The 2022 update changes how control implementation, applicability, and audit evidence should be structured.
Use this comparison as a transition checklist, then validate every item against your own ISMS scope, risk register, and Statement of Applicability.
Frequently Asked Questions About ISO 27001 2022
What is the difference between ISO 27001:2013 and ISO 27001:2022?
ISO 27001:2022 restructures Annex A from 114 controls in 14 domains to 93 controls in four themes: organisational, people, physical, and technological. It also introduces 11 entirely new controls, including threat intelligence, cloud services, data masking, monitoring activities, and secure coding. The main clauses also changed, including the addition of Clause 6.3 for planned ISMS changes.
When did organisations need to transition to ISO 27001:2022?
The transition deadline for certificates issued against ISO 27001:2013 was 31 October 2025. Certification bodies stopped issuing new 2013 certificates after 31 October 2023. After the deadline, 2013 certificates are invalid, so new and maintained certification programmes should use the 2022 version.
Do I need a full recertification audit to transition?
Not necessarily. Transition normally requires a transition audit focused on whether the ISMS documentation, SoA, Annex A mapping, and new controls have been updated. If your certificate renewal date is close, your certification body may combine the transition and renewal activity. Either way, the auditor will expect objective evidence of transition, not only updated document titles.
What are the 11 new ISO 27001:2022 controls?
The 11 new controls are threat intelligence, information security for use of cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding. Each needs a risk-based applicability decision in the SoA.
How does ISO 27001:2022 help with NIS2 and DORA?
ISO 27001:2022 aligns strongly with European cyber and operational resilience obligations. NIS2 Article 21 covers risk analysis, incident handling, business continuity, supply chain security, and technical measures. DORA requires ICT risk management across protection, detection, containment, recovery, and repair. A well-mapped ISMS can support shared evidence across obligations.
What is the first step in moving to ISO 27001:2022?
Start with a structured gap analysis between your current control set and the 2022 Annex A. Then update your risk assessment, SoA, policies, procedures, owners, and evidence records. The biggest mistake is treating transition as a spreadsheet renumbering exercise instead of an ISMS change programme.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
