The transition from ISO/IEC 27001:2013 to ISO/IEC 27001:2022 ended on 31 October 2025. NSAI, an Irish certification body, stated that after that date all certificates to the older edition would expire and certification would be formally withdrawn. A year later, customers' questionnaires still ask, "Which edition is your certificate against?" and "Can we see your Statement of Applicability?"
Here is what changed in Annex A, and how to answer cleanly.
What's affected
ISO/IEC 27001:2022 is Edition 3, published in October 2022 (NSAI gives 25 October 2022). ISO also lists an Amendment 1, "Climate action changes", dated 2024.
The main technical change, per a summary of IAF MD 26:2023 from the Cloud Security Alliance, is that the ISO/IEC 27002:2022 control set of 93 controls replaced the earlier Annex A set of 114 controls. SGS, a certification body, adds that the controls are now grouped into four categories (organizational, people, physical and technological) in place of the 14 themes and 35 categories of the 2013 edition. SGS also lists 11 new controls:
| Control | Annex A 2022 number |
|---|---|
| Threat intelligence | A.5.7 |
| Information security for use of cloud services | A.5.23 |
| ICT readiness for business continuity | A.5.30 |
| Physical security monitoring | A.7.4 |
| Configuration management | A.8.9 |
| Information deletion | A.8.10 |
| Data masking | A.8.11 |
| Data leakage prevention | A.8.12 |
| Monitoring activities | A.8.16 |
| Web filtering | A.8.23 |
| Secure coding | A.8.28 |
The names come from SGS. Check the numbering against your copy of the standard, which ISO sells.
The IAF document also changed clause wording, such as 6.1.3 c and d, and added a clause 6.3, Planning for Changes.
How to check if you're exposed
- Open your certificate. Does it name ISO/IEC 27001:2022 or the 2013 edition? A certificate citing 2013 is no longer valid after the transition end date.
- Open your Statement of Applicability. Do the control numbers look like A.5.1 to A.8.34 (2022) or A.5 to A.18 (2013)?
- For each of the 11 new controls, find the evidence. Do you have a record of threat intelligence sources, a cloud services policy, a deletion procedure, a secure coding standard?
What to do now
- If you are certified, confirm with your certification body which edition your current certificate cites and when it was issued.
- Update your Statement of Applicability so every control is marked applicable or not, with a reason.
- Write short procedures for the controls you were missing: information deletion, configuration management, secure coding and monitoring are the usual gaps for software companies.
- If you are not certified, tell customers you are working toward ISO 27001:2022, not the 2013 edition, and give the planned audit window as a plan, not a promise.
- Prepare a one paragraph answer with five facts: the standard and edition, the certification body, the certificate validity dates, the scope, and the version of your Statement of Applicability that you can share under NDA. Include only facts that are true today.
How to avoid this trap
The most common mistake is quoting the number of controls from memory. Customers who know the standard will notice if you say "114 controls". Use 93 for the 2022 edition.
Another is saying "ISO 27001 compliant". A certificate is issued by an accredited certification body after an audit, and it has a scope. State the scope. A certificate that covers only your office does not cover your product.
Why it matters
Customers use ISO 27001 to avoid redoing your security review. That only works if the scope, edition and control set are clear. A software company's 2022 certificate now implies evidence for secure coding, configuration management and deletion, which are things a buyer's engineers care about.
Quick check
How many controls are in the 2022 Annex A?
93, grouped into four categories. The 2013 edition had 114.
What happened to certificates against the 2013 edition?
They expired or were withdrawn after the transition period ended on 31 October 2025.
