Table of contents
If your organisation holds an ISO 27001:2013 certificate, you have until late 2025 to transition to the 2022 edition. The clock is real — your certification body will not extend the deadline, and your customers' procurement teams will start asking questions long before then.
The headline changes
Annex A has been reorganised from 14 control categories into four themes (Organisational, People, Physical, Technological). The total number of controls dropped from 114 to 93 through consolidation, but 11 entirely new controls were added.
The 11 new controls — what they actually require
- Threat intelligence (5.7) — actionable, not just consumed
- Information security for use of cloud services (5.23)
- ICT readiness for business continuity (5.30)
- Physical security monitoring (7.4)
- Configuration management (8.9)
- Information deletion (8.10)
- Data masking (8.11)
- Data leakage prevention (8.12)
- Monitoring activities (8.16)
- Web filtering (8.23)
- Secure coding (8.28)
What auditors will look for
Three areas will receive disproportionate attention during transition audits: cloud security (5.23), threat intelligence (5.7), and information deletion (8.10) — the last being a frequent compliance gap that organisations under-estimate.
A six-step migration plan
- Map your current 2013 controls onto the 2022 structure (gap analysis)
- Identify which of the 11 new controls genuinely apply to your scope
- Update your Statement of Applicability — this is mandatory
- Document the new threat-intelligence and cloud-security processes
- Run a focused internal audit on the new and changed areas
- Schedule your transition audit at least three months before your deadline
WPROIT's compliance practice has supported organisations across Germany, the Netherlands and Poland through this migration. The most common pattern: organisations with mature 2013 programmes can transition in 8-12 weeks; those whose 2013 implementations were paper exercises take significantly longer.
WPROIT Administrator
Talk to our team