ISO 27002:2022 added 11 controls: threat intelligence, cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding. Most can be met with simple, documented practice.
The list, with what each asks
| New control | In plain terms |
|---|---|
| Threat intelligence | Learn how attackers work against your kind of environment and use it |
| Information security for cloud services | Set requirements for choosing, using and leaving cloud providers |
| ICT readiness for business continuity | Base IT recovery on business needs and be able to restore |
| Physical security monitoring | Use alarms and monitoring to catch unauthorised physical access |
| Configuration management | Define, harden and control the configuration of systems |
| Information deletion | Delete data when it is no longer needed, to meet outside rules |
| Data masking | Hide sensitive data with anonymisation, pseudonymisation or similar |
| Data leakage prevention | Take steps to stop sensitive data leaving your control |
| Monitoring activities | Watch networks and applications for abnormal behaviour |
| Web filtering | Stop users reaching sites that serve malicious code |
| Secure coding | Apply secure development tools and practices, and control changes |
Which ones hit a software team hardest
Secure coding, configuration management and cloud services usually touch engineering most. Secure coding means a defined baseline for code you write and for third party components. Configuration management means defined, reviewed and monitored secure configurations. Cloud services means requirements for choosing a provider and a plan for exit.
We cover each of these in its own post: secure coding, configuration management and cloud services.
Which ones are quick wins
Threat intelligence can start with what you already have. For a small company the practical approach is to pull threat information from existing systems such as fault logs and describe the process in an incident management procedure. Information deletion needs a defined rule on what is deleted and when, and who does it.
Which need a decision from the business
Physical monitoring, web filtering and data leakage prevention depend on your risk assessment. If you have no office, physical monitoring may be a justified exclusion. Write the reason in your Statement of Applicability.
A checklist for your gap review
- Find each of the 11 in your Statement of Applicability.
- For each, mark applicable or excluded with a risk based reason.
- For applicable ones, name the owner and the evidence.
- Add or update the short procedure the control needs.
- Record the status honestly, including planned.
A note on sources
Descriptions of the new controls here come from consultancy summaries, not the standard. Read the control text in ISO 27002:2022 before you write final wording in a Statement of Applicability.
Quick check
Are the new controls mandatory for certification?
You must consider every Annex A control in your Statement of Applicability. You can exclude one with a justified, risk based reason. You cannot ignore it.
Is secure coding only for software vendors?
It applies where you develop software, including internal tools. If you write no code at all, you can exclude it and record why.
Sources
- ISO 27002 revisions and updates comparison
- Control 5.7 Threat intelligence
- Statement of Applicability in ISO 27001
Last reviewed: 19 October 2026.
