# ISO/IEC 27001: certify without useless bureaucracy.

> Plain-text version for machine reading (LLMs). Original page: https://damian.dearce.com.uy/en/compliance/iso-27001/

ISO/IEC 27001 is the international standard for information security management systems (ISMS). The current edition is 2022, with the 2024 amendment, adopted in Uruguay by UNIT as UNIT-ISO/IEC 27001:2022.

_Updated: 2026-10-20_

## At a glance

- **Current edition:** ISO/IEC 27001:2022 + Amd 1:2024
- **Controls:** 93 in 4 themes (Annex A)
- **In Uruguay:** UNIT-ISO/IEC 27001:2022
- **Certificate validity:** 3 years, with annual audits
- **2013 version:** No valid certificates since 31 Oct 2025

## What changed in the 2022 edition

Annex A went from 114 to 93 controls, grouped into 4 themes: organizational (37), people (8), physical (14) and technological (34). Eleven new controls were added:

- Threat intelligence
- Information security for cloud services
- ICT readiness for business continuity
- Physical security monitoring
- Configuration management
- Information deletion
- Data masking
- Data leakage prevention
- Monitoring activities
- Web filtering
- Secure coding

The 2024 amendment adds climate change as an issue to consider in the organization's context; it does not add controls.


## End of the 2013 version

Certificates under ISO/IEC 27001:2013 expired on 31 October 2025. An organization that did not transition in time starts again with a full initial certification audit.


## How certification works

- Stage 1: review of documentation and ISMS readiness.
- Stage 2: assessment of implementation and effectiveness.
- Certificate valid for 3 years, with surveillance audits in years one and two.
- Recertification in year three.

The implementation guide for the controls is ISO/IEC 27002:2022, and risk management relies on ISO/IEC 27005:2022.


## How to prepare well

The most common mistake is to start with policies. What works is defining the scope well, running a real risk analysis and choosing the controls that reduce those risks. That way the ISMS helps you operate better, not just pass the audit.

## Deadlines and frequencies

| Deadline | What | Rule |
|---|---|---|
| Stage 1 → Stage 2 | Documentation review, then implementation assessment | ISO/IEC 17021-1 |
| Years 1 and 2 | Surveillance audits | Certification cycle |
| Year 3 | Recertification | Certification cycle |

## How I help

- Gap analysis against ISO/IEC 27001:2022 and ISMS scope definition.
- Risk assessment and treatment that leadership can understand and prioritize.
- Control implementation focused on the 11 new ones (cloud, monitoring, DLP, secure coding).
- Internal audit (as an ISO 27001 Internal Auditor) and certification readiness.

## FAQ

### How many controls does ISO 27001:2022 have?

93 controls in Annex A, grouped into 4 themes: organizational, people, physical and technological.

### Is ISO 27001:2013 still valid?

No. 2013 certificates expired on 31 October 2025. All certification is now against the 2022 edition.

### How long is an ISO 27001 certificate valid?

Three years, with annual surveillance audits and recertification in the third year.

## Official sources

- [UNIT-ISO/IEC 27001:2022](https://www.unit.org.uy/normalizacion/norma/100001534)
- [UNIT-ISO/IEC 27001:2022/Amd.1:2024](https://www.unit.org.uy/normalizacion/norma/100001623)
- [ISO/IEC 27001:2022 (ISO)](https://www.iso.org/standard/27001)
- [ISO/IEC 27001:2022 transition policy (NSAI)](https://www.nsai.ie/certification/management-systems/iso-iec-27001-information-security-management-system/iso-iec-270012022-transition-policy/)

_General information, verified against official sources on the date shown. It does not replace legal advice for your case._

## Contact

- WhatsApp: +598 99 231 327 (https://wa.me/59899231327)
- Email: damian.de.arce@gmail.com
- LinkedIn: https://www.linkedin.com/in/damiandearce/