SideGuy · Compliance clarity · reviewed 2026-06-09
If you certified under 2013, you've transitioned to 2022 (or you're out of date). The standard's structure didn't change much — but Annex A was rebuilt: controls were consolidated, re-themed, and 11 genuinely new ones were added for the cloud era. Here's the real diff.
| Dimension | ISO 27001:2013 | ISO 27001:2022 |
|---|---|---|
| Annex A controls | 114 controls | 93 controls (merged + de-duplicated, not weakened) |
| Structure | 14 control domains (A.5–A.18) | 4 themes: Organizational (37), People (8), Physical (14), Technological (34) |
| New controls | — | 11 new: threat intel, cloud services, ICT continuity readiness, physical monitoring, config management, information deletion, data masking, DLP, monitoring activities, web filtering, secure coding |
| Attributes | None | Controls now tagged with attributes (control type, security property, etc.) for easier mapping |
| Clauses 4–10 | The management-system clauses | Minor wording alignment — the ISMS core is essentially unchanged |
| Transition | Certificates expired / had to transition | The standard in force; new certifications are 2022 only |
Nothing — 2013 is superseded. Existing 2013 certificates had to transition to 2022, so anyone still on 2013 needs to update.
Everyone certifying or recertifying now. Focus your gap work on the 11 new controls and re-mapping your Statement of Applicability to the new 4-theme structure.
93 in Annex A, down from 114 — but that's consolidation, not relaxation. Several 2013 controls were merged, and 11 brand-new controls were added, so the coverage actually expanded.
Threat intelligence, information security for cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding — largely cloud-era and modern-ops additions.
Yes — organizations certified to 2013 were required to transition within the IAF-set window (three years from the 2022 publication). New certifications are issued only against 2022.
It's a mapping-and-gap exercise, not a rebuild. Your ISMS (clauses 4–10) stays largely the same; you re-map Annex A to the 4 themes, update your Statement of Applicability, and implement the 11 new controls you don't already cover.
Written by PJ Zonis · SideGuy Solutions · operator-honest, vendor-neutral · Compliance hub