ISO 27001: Understanding the Differences Between the Old and New Standard

ISO 27001: Understanding the Differences Between the Old and New Standard

ISO 27001 is the internationally recognised standard for Information Security Management Systems (ISMS). It helps organisations manage the security of assets such as financial information, intellectual property, employee details, and information entrusted by third parties. With the evolving digital landscape and growing cybersecurity threats, the International Organization for Standardisation (ISO) periodically reviews and updates the standard to ensure it remains relevant and effective. The most recent update—ISO/IEC 27001:2022—introduces several changes from the previous ISO/IEC 27001:2013 version.

This blog explores the key differences between the old and the new versions of ISO 27001 and what these changes mean for organisations aiming to remain compliant and secure.

1. Structural Changes to Annex A Controls

One of the most noticeable updates is in Annex A, which lists the reference control objectives and controls. The 2013 version had 114 controls divided into 14 control categories. In the 2022 revision, the number of controls has been reduced to 93, now organised into 4 themes:

• Organizational controls (37)
• People controls (8)
• Physical controls (14)
• Technological controls (34)

This restructuring reflects a more modern and streamlined approach. Instead of fragmenting similar controls into multiple areas, related topics have been grouped more logically. The new format helps reduce redundancy, simplify implementation, and improve clarity.

2. Introduction of New Controls

While the number of controls decreased, this does not mean the standard became less rigorous. Instead, ISO 27001:2022 introduces 11 new controls that address contemporary challenges in cybersecurity, such as:

• Threat intelligence
• Information security for the use of cloud services
• ICT readiness for business continuity
• Physical security monitoring
• Data masking
• Data leakage prevention
• Monitoring activities
• Web filtering
• Secure coding

These new controls are designed to reflect the shift in how organizations operate, particularly with increased cloud adoption, remote work, and data-centric security approaches.

3. Use of Attributes and Control Tagging

The 2022 version introduces a tagging system that allows organisations to categorise controls using five attributes:

• Control type (Preventive, Detective, Corrective)
• Information security properties (Confidentiality, Integrity, Availability)
• Cybersecurity concepts (based on the NIST framework)
• Operational capabilities
• Security domains

This taxonomy gives organisations greater flexibility and insight into how controls serve different purposes. It also supports better risk analysis and tailoring of security measures to business needs.

4. Alignment with ISO 27002:2022

ISO/IEC 27001:2022 is closely aligned with the revised ISO/IEC 27002:2022, which serves as a guidance document for implementing controls. ISO 27002 has also been reorganised with the same four-category structure. Organisations using ISO 27001:2022 benefit from this alignment, as it provides a clearer path for implementing and managing controls.

5. Modernization of Language and Concepts

The 2022 version includes updated terminology to reflect modern IT environments. For example, it emphasizes “cloud services” over traditional on-premises infrastructure and acknowledges “digital assets” more broadly.

Also, while the core clauses of ISO 27001 (from Clause 4 to 10) remain largely unchanged in structure, there are minor but important revisions in wording. These include better clarity around organizational context, leadership responsibilities, planning, and performance evaluation.

6. Improved Integration with Other ISO Management Standards

ISO/IEC 27001:2022 enhances compatibility with other ISO management system standards (like ISO 9001 and ISO 22301) through the Harmonised Structure (HS). This makes it easier for organisations to integrate their ISMS with other management systems for quality, business continuity, or environmental management.

What Does This Mean for Organisations?

Organisations certified under ISO 27001:2013 are not immediately required to recertify under the new version. However, a transition period of around three years is typically provided. During this time, companies should:

• Conduct a gap analysis against the new controls
• Update their risk assessments and treatment plans
• Review and adjust policies and procedures to align with the new structure
• Train relevant stakeholders on the updated requirements

Organizations looking to achieve certification for the first time will now be certified under ISO 27001:2022.

Conclusion

The update from ISO/IEC 27001:2013 to ISO/IEC 27001:2022 is more than just a routine revision. It reflects a fundamental modernisation of the standard to stay relevant in today’s digital, cloud-driven, and threat-prone environment. By streamlining controls, introducing relevant new ones, and aligning with other frameworks, ISO 27001:2022 provides a robust and future-ready foundation for information security.

For organisations looking to maintain strong cybersecurity and regulatory compliance, adapting to the new standard should be a strategic priority.