In short: ISO/IEC 27001:2022 and ISO/IEC 27002:2022 mainly changed the control set. Annex A shrinks from 114 to 93 controls, the 14 sections become four themes, and eleven controls are new. The main body, meaning the mandatory clauses 4 to 10, was sharpened in a few places. The transition period for certificates under the 2013 edition ended on 31 October 2025. Anyone running an information security management system (ISMS) must now work to the new edition, and anyone delivering training should align the content with it.

Two standards, two roles

ISO/IEC 27001 sets out what an ISMS must achieve: the fixed roles, rules and processes an organisation uses to manage its information risks. This is the standard you get certified against. ISO/IEC 27002 is guidance. It describes each Annex A control with its purpose and implementation advice. You are not certified against 27002, it helps you implement.

The 2022 edition of ISO/IEC 27002 came first, and ISO/IEC 27001:2022 followed in October 2022 with the revised Annex A. Both now carry the main title "Information security, cybersecurity and privacy protection". They are closely linked: Annex A of 27001 takes its control titles from 27002.

Annex A: 93 controls in four themes

The old edition arranged 114 controls in 14 sections (A.5 to A.18). The new edition groups 93 controls into four themes:

  • Organisational (clause 5). 37 controls, such as policies, roles, suppliers, incident management and legal compliance.
  • People (clause 6). 8 controls, including screening and information security awareness, education and training.
  • Physical (clause 7). 14 controls covering access, equipment and storage media.
  • Technological (clause 8). 34 controls, from access rights and backup to secure development.

Fewer controls do not mean fewer requirements. Many former controls were merged, others reworded. For the Statement of Applicability (the list of which controls apply and why) this means it has to move to the new numbering, and every justification needs a fresh review.

The eleven new controls

Eleven controls did not exist in the 2013 edition. They reflect how attacks and operations have changed:

  1. 5.7 Threat intelligence. Collect and analyse information about threats so that safeguards respond to real attack patterns.
  2. 5.23 Information security for use of cloud services. Rules for acquiring, using, managing and exiting externally operated services.
  3. 5.30 ICT readiness for business continuity. IT must be planned and tested so that operations continue after a disruption.
  4. 7.4 Physical security monitoring. Monitor buildings and rooms continuously for unauthorised access.
  5. 8.9 Configuration management. Define, document and monitor secure configurations.
  6. 8.10 Information deletion. Delete data once it is no longer needed.
  7. 8.11 Data masking. Obscure sensitive data, for example in test environments.
  8. 8.12 Data leakage prevention. Detect and prevent unauthorised outflow of information.
  9. 8.16 Monitoring activities. Monitor networks, systems and applications for anomalous behaviour.
  10. 8.23 Web filtering. Restrict access to malicious websites.
  11. 8.28 Secure coding. Develop software following secure coding principles.

In practice, 5.23, 8.9, 8.16 and 8.28 tend to take the most effort, because they reach into day-to-day IT operations and development.

Attributes in ISO/IEC 27002:2022

Attributes are new in 27002. They are tags assigned to each control so you can filter the catalogue by your own views. The standard defines five attributes:

  • Control type. Preventive, detective or corrective.
  • Information security properties. Confidentiality, integrity, availability.
  • Cybersecurity concepts. Identify, protect, detect, respond, recover.
  • Operational capabilities. For example identity and access management or application security.
  • Security domains. Governance and ecosystem, protection, defence, resilience.

The attributes are not mandatory. They still help in practice: looking at all detective controls together quickly shows whether an attack would be noticed at all.

What changed in the main body

Clauses 4 to 10 kept their structure, but some requirements became more precise:

  • 4.2 Interested parties. You determine which requirements of customers, authorities or partners will be addressed through the ISMS.
  • 6.3 Planning of changes. New clause: changes to the ISMS must be carried out in a planned way.
  • 8.1 Operational planning and control. Criteria must be set for processes and the processes controlled accordingly, including externally provided processes, products and services.

Amendment 1:2024 added another point. Under 4.1 you determine whether climate change is a relevant issue for your organisation. A note in 4.2 clarifies that interested parties can have requirements related to climate change. Auditors ask whether and how this question was assessed.

What this means for training and operations

Training is itself an Annex A control (6.3) and a requirement under clauses 7.2 Competence and 7.3 Awareness. In the audit, evidence counts: who learned what and when. Two levels make sense, plus specialist training:

  1. Awareness for all staff. Short and regular: handling phishing, safe use of externally operated services, web filtering and why data gets deleted. The new controls supply concrete topics.
  2. In-depth training for information security officers and internal auditors. The new Annex A structure, migrating the Statement of Applicability, using attributes, the revised clauses 4.2, 6.3 and 8.1, and the climate question from Amendment 1:2024.
  3. Specialist training for operations and development. Configuration management, monitoring and secure coding only work if administrators and developers know the requirements.

In operations, a check is worth it. Have risk assessment, Statement of Applicability and policies been fully moved to the 2022 edition? Does every new control have an owner and evidence? Old references to "A.12" or "A.18" in policies are a typical leftover from the migration that surveillance audits pick up.

How GermanAI Defense helps

We assess your ISMS against the 2022 edition, migrate the Statement of Applicability and implement the new controls with your team. We have been certified to ISO/IEC 27001:2022 ourselves since May 2026 (certificate no. 26052601) and know the requirements of the 2022 edition from our own audit. For 8.16 Monitoring activities we can provide round-the-clock SOC monitoring, with service and response times as agreed in the contract.

→ Building, auditing and running the ISMS: ISO 27001 consulting

→ Information security training: GAD Academy

→ Comparison with the law: ISO 27001 and NIS 2 compared

Sources

As of 28 October 2026. This article is a professional overview and does not replace the text of the standard.