The major change to ISO 27001, with the publication of the 2022 version, was the incorporation of the control set from ISO 27002:2022 into Annex A of ISO 27001:2022. With ISO 27002:2022, there was a a significant revision of the set of information security controls with the previous 114 being reduced to 93. Of those 93 controls:
- 58 have been updated
- 24 controls represent merging of 57 of the previous controls
- 11 new controls have been introduced.
More information on ISO 27002:2022 can be found here.
A number of changes to the management system clauses were made in ISO/IEC 27001:2022 with the goal of making some of the requirements more explicit and improving the alignment with other Annex SL standards, such as ISO 9001 and ISO 22301, e.g. sub clause titles, terms and definitions.
We were incredibly impressed with our consultant’s attention to detail during the reworking of many documents and the in-year assessment last month. He stood up and had his finger on the pulse and was a great help. He is liked by our team, and we look forward to a long working relationship with him.
Waste management company
Thinking about ISO 27001 but unsure how your project should take shape?
We offer a free, no‑commitment call to help you clarify your certification pathway, understand the standard in the context of your business.
Find out more
related BLog
ISO 27001 Clause 4.2, Understanding the Needs and Expectations of Interested Parties
Published on
2 Oct
2026
URM's blog examines ISO 27001:2022 Clause 4.2, covering interested parties, their requirements and how these are addressed through the ISMS.
Read more
Information Security
Published on
22/9/2026
What Are the Critical Steps When Implementing an Effective Information Security Management System?URM assisted over 500 organisations achieve ISO 27001 certification, here are the critical steps when implementing an effective information security system.
Read more
Information Security
Published on
22/9/2026
ISO 27001 Clause 4.1 - Understanding the Organisation and its ContextURM's blog explores ISO 27001 Clause 4.1 & how to identify organisational context, assess internal/external issues, and support effective ISMS decision-making.
Read more
Internal Audit
Published on
20/9/2026
Internal Auditing of Management SystemsURM’s blog explains how to plan and execute effective and conformant internal audits of management systems at each stage of the internal audit process.
Read more
"
URM's diligence during these audits has resulted in the business as a whole pulling together to collectively ensure that we up to par with the requirements. While our working relationship with URM’s consultant is fantastic, we are held to account for every bullet point of every requirement on every audit, which is precisely what we expect.
Open Banking Platform
contact US
Let us help you
Let us help you in your compliance journey by completing the form and letting us know how we can best support you.