ISO/IEC 27001:2022
The international standard for an Information Security Management System (ISMS).
- Annex A controls
- 93
- Themes
- 4
- New controls in 2022
- 11
- 2013 transition ended
- 31 Oct 2025
What is ISO/IEC 27001:2022?
ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS). Certification is audited by an accredited certification body.
The transition period for ISO/IEC 27001:2013 certificates ended on 31 October 2025, so only certificates issued against the 2022 edition are valid now. Amendment 1:2024 added climate change considerations to clauses 4.1 and 4.2.
Who needs it
- Organisations whose customers or tenders require a recognised security certification
- SaaS, IT services and BPO providers handling client data
- BFSI, fintech and healthcare organisations building a risk-based security programme
- Any organisation that wants a structured, auditable way to manage information security
How the standard is organised
Clauses 4 to 10 are mandatory management system requirements. Annex A lists reference controls you select based on risk.
Management clauses 4 to 10
- 4. Context of the organization
- 5. Leadership
- 6. Planning
- 7. Support
- 8. Operation
- 9. Performance evaluation
- 10. Improvement
Annex A: 93 controls in 4 themes
- Organizational controls (5.x): 37
- People controls (6.x): 8
- Physical controls (7.x): 14
- Technological controls (8.x): 34
11 new controls in the 2022 edition
- 5.7 Threat intelligence
- 5.23 Information security for use of cloud services
- 5.30 ICT readiness for business continuity
- 7.4 Physical security monitoring
- 8.9 Configuration management
- 8.10 Information deletion
- 8.11 Data masking
- 8.12 Data leakage prevention
- 8.16 Monitoring activities
- 8.23 Web filtering
- 8.28 Secure coding
The certification cycle
Certification runs on a three-year cycle with an accredited certification body.
01
Stage 1 audit
The auditor reviews your ISMS documentation, scope, risk assessment and Statement of Applicability to confirm you are ready for Stage 2.
02
Stage 2 audit
The auditor tests whether the ISMS and selected controls are implemented and operating effectively. Successful completion leads to certification.
03
Surveillance audits
Annual audits in years two and three confirm the ISMS is maintained and improving.
04
Recertification
A full recertification audit every three years renews the certificate.
From gap to evidence
- Gap assessment against clauses 4 to 10 and all 93 Annex A controls
- Risk assessment methodology, risk treatment plan and Statement of Applicability
- Policy and procedure design that fits how your teams actually work
- Internal audit and management review before the certification body arrives
- Stage 1 and Stage 2 audit support and corrective action follow-up
Frequently asked questions
What is the difference between ISO/IEC 27001 and ISO/IEC 27002?
ISO/IEC 27001 sets the requirements you are certified against. ISO/IEC 27002 is guidance on implementing the Annex A controls and is not certifiable by itself.
Do we have to implement all 93 Annex A controls?
No. You select controls based on your risk assessment and justify each inclusion or exclusion in your Statement of Applicability.
Our certificate is against the 2013 edition. Is it still valid?
No. The transition period ended on 31 October 2025, so 2013-edition certificates are no longer valid. You need a certificate against ISO/IEC 27001:2022.
How long does certification take?
It depends on scope, size and how mature your existing controls are. A gap assessment gives you a realistic plan and timeline.
Who issues the certificate?
An accredited certification body. Consultants such as Ausec help you prepare, but should not certify a system they helped build.
Working towards ISO 27001?
Start with a gap assessment and a clear, prioritised plan.