ISO/IEC 27001: certify without useless bureaucracy.

What changed in the 2022 edition

Annex A went from 114 to 93 controls, grouped into 4 themes: organizational (37), people (8), physical (14) and technological (34). Eleven new controls were added:

• Threat intelligence
• Information security for cloud services
• ICT readiness for business continuity
• Physical security monitoring
• Configuration management
• Information deletion
• Data masking
• Data leakage prevention
• Monitoring activities
• Web filtering
• Secure coding

The 2024 amendment adds climate change as an issue to consider in the organization's context; it does not add controls.

End of the 2013 version

Certificates under ISO/IEC 27001:2013 expired on 31 October 2025. An organization that did not transition in time starts again with a full initial certification audit.

How certification works

• Stage 1: review of documentation and ISMS readiness.
• Stage 2: assessment of implementation and effectiveness.
• Certificate valid for 3 years, with surveillance audits in years one and two.
• Recertification in year three.

The implementation guide for the controls is ISO/IEC 27002:2022, and risk management relies on ISO/IEC 27005:2022.

How to prepare well

The most common mistake is to start with policies. What works is defining the scope well, running a real risk analysis and choosing the controls that reduce those risks. That way the ISMS helps you operate better, not just pass the audit.