What changed in ISO 27001:2022 for European implementers

If your organisation holds an ISO 27001:2013 certificate, you have until late 2025 to transition to the 2022 edition. The clock is real — your certification body will not extend the deadline, and your customers' procurement teams will start asking questions long before then.

The headline changes

Annex A has been reorganised from 14 control categories into four themes (Organisational, People, Physical, Technological). The total number of controls dropped from 114 to 93 through consolidation, but 11 entirely new controls were added.

The 11 new controls — what they actually require

Threat intelligence (5.7) — actionable, not just consumed

Information security for use of cloud services (5.23)

ICT readiness for business continuity (5.30)

Physical security monitoring (7.4)

Configuration management (8.9)

Information deletion (8.10)

Data masking (8.11)

Data leakage prevention (8.12)

Monitoring activities (8.16)

Web filtering (8.23)

Secure coding (8.28)

What auditors will look for

Three areas will receive disproportionate attention during transition audits: cloud security (5.23), threat intelligence (5.7), and information deletion (8.10) — the last being a frequent compliance gap that organisations under-estimate.

A six-step migration plan

Map your current 2013 controls onto the 2022 structure (gap analysis)

Identify which of the 11 new controls genuinely apply to your scope

Update your Statement of Applicability — this is mandatory

Document the new threat-intelligence and cloud-security processes

Run a focused internal audit on the new and changed areas

Schedule your transition audit at least three months before your deadline

WPROIT's compliance practice has supported organisations across Germany, the Netherlands and Poland through this migration. The most common pattern: organisations with mature 2013 programmes can transition in 8-12 weeks; those whose 2013 implementations were paper exercises take significantly longer.