ISO 27001:2022 | Information Security
Achieve ISO 27001:2022 certification, annual surveillance audits and re-certification with expert support
ISO/IEC 27001:2022 is the latest version of the globally recognised standard for information security management systems (ISMS). It reflects today’s evolving cyber threat landscape and helps organisations implement more precise, risk-based controls to protect their information assets.
The 2022 update strengthens the framework for identifying and addressing information security risks, integrating new and updated controls that better align with modern technologies and business practices. It supports organisations in establishing, maintaining, and continually improving an effective ISMS that safeguards sensitive data, ensures regulatory compliance, and builds trust with stakeholders.
By adopting ISO 27001:2022, organisations demonstrate a forward-thinking commitment to cybersecurity, privacy, and operational resilience in an increasingly data-driven world.
About the ISO 27001:2022 Updated Standard
ISO/IEC 27001:2022 is the latest revision of the international standard for information security management systems (ISMS). Published in October 2022, this update reflects the growing complexity of today’s cyber risks and the evolving needs of modern organisations.
The revised standard introduces a more streamlined structure, aligning with current risk management practices and integrating updated terminology for clarity. One of the most notable changes is the overhaul of Annex A, which now features 93 controls (down from 114), grouped into four clear categories: Organisational, People, Physical, and Technological. This makes the implementation of controls more adaptable and focused.
Other enhancements include:
Stronger emphasis on cybersecurity resilience and business continuity
Greater alignment with digital transformation, cloud services, and remote work environments
Updated language and definitions for improved clarity and usability
Organisations already certified to ISO 27001:2013 are expected to transition to the 2022 version within a specified timeframe, usually three years from the release date. Adopting ISO 27001:2022 demonstrates a proactive approach to protecting information assets, maintaining stakeholder confidence, and ensuring compliance in a changing digital world.
What is the Latest Version of ISO 27001? | Key Changes
The main changes of ISO 27001 2022 are outlined above. The part of the standard which has experienced the most revision is Annex A which is aligned with the ISO/IEC 27001 updates, published earlier this year. Clauses 4 to 10 have also undergone several minor changes, especially in clauses 4.2, 6.2, 6.3, and 8.1 where additional new content has been added. Other updates include minor changes in the terminology and restructuring of sentences and clauses. The title and order of these clauses do however remain the same:
- Clause 4: Context of the organisation
- Clause 5: Leadership
- Clause 6: Planning
- Clause 7: Support
- Clause 8: Operation
- Clause 9: Performance evaluation
- Clause 10: Improvement
Key Updates in ISO 27001:2022
The 2022 update places greater focus on proactive, risk-based thinking. Organisations are now required to take a structured approach to identifying, analysing, and treating information security risks—ensuring controls are regularly reviewed and updated to reflect emerging threats. Enhanced requirements also include ongoing monitoring and clear reporting to senior management.
Broader Scope Beyond IT Systems
ISO 27001:2022 adopts a more holistic view of information security. It expands coverage beyond digital systems to include people, physical assets, and processes. This broader scope ensures that risks across the entire organisation are addressed—not just those tied to IT.
Improved Communication and Stakeholder Engagement
The revised standard highlights the need for regular communication with internal and external stakeholders. Organisations must establish clear channels for sharing information security updates, incident responses, and threat intelligence with senior leaders, clients, suppliers, and partners.
More Rigorous Certification Process
Certification under ISO 27001:2022 requires a deeper evaluation of risk management practices and security controls. Audits now place more emphasis on evidence of continuous improvement—ensuring that organisations actively adapt to evolving cybersecurity risks.
The Benefits of ISO 27001:2022?
Will the Changes Affect My Current Certificate?
No, the changes will not invalidate your current ISO 27001 certificate. The ISO 27001:2013 version remains valid until 31 October 2025, giving you time to review the updates, make any necessary adjustments, and transition to the new 2022 standard. Once certified, your ISO 27001 certificate remains valid for three years, provided your ISMS is actively maintained and monitored throughout.
Need Help Adapting to ISO 27001:2022?
Staying ahead of the latest standards is essential—and at Candy Management Consultants, we’re here to make that process seamless. Our expert consultants can guide you through the transition to ISO 27001:2022, helping you align your systems, streamline operations, and achieve certification.
