Moving an ISMS from ISO 27001:2013 to the 2022 revision

What actually changed

The management system clauses — 4 through 10 — changed relatively little in substance. The significant restructuring is in Annex A, which was reorganised from the previous domain structure into four control themes: organisational, people, physical and technological.

That reorganisation is not merely cosmetic. Overlapping controls were consolidated, some were reworded to change what they require, and a set of genuinely new controls was introduced covering areas the 2013 version predated — including threat intelligence, information security for cloud services, and requirements around secure development and configuration.

The Statement of Applicability is the real work

Your existing Statement of Applicability is keyed to the old control numbering. It cannot simply be renumbered, because the mapping is not one-to-one: some old controls merged, some split, and the new ones have no predecessor to inherit a justification from.

Every control in the new Annex A needs a fresh determination of applicability with a justification that stands on its own. In practice this is where most of the transition effort goes, and it is worth doing properly — the SoA is the first document a certification auditor reads.

Where organisations find genuine gaps

• Threat intelligence — most organisations consume threat feeds informally, if at all, and have no defined process for acting on them.
• Cloud services — often governed by procurement rather than by information security, with no security requirements defined at selection and no ongoing assurance.
• Secure configuration — baselines that exist for servers but not for cloud services, containers or network devices.
• Data leakage prevention — frequently interpreted as a product purchase rather than as a set of controls proportionate to actual data flows.
• Monitoring activities — logging is usually present; the requirement to actually monitor, with defined coverage and response, often is not.

Planning the transition

A structured transition has four stages. Map your existing control set onto the new structure. Identify controls that are genuinely new or materially changed. Assess your position against those specifically, rather than reassessing everything. Then rewrite the Statement of Applicability and update the risk treatment plan to match.

Organisations that treat transition as a full reimplementation spend considerably more than they need to. Organisations that treat it as a renumbering exercise fail the certification audit. The work sits between the two.

Independence in transition work

If a consultant is implementing your transition, they cannot also provide the internal audit that ISO 27001 requires over it. The standard requires internal audit to be objective and impartial, and a firm auditing its own implementation is neither. Separate the two — it is a requirement, not a preference.