The major change to ISO 27001, with the publication of the 2022 version, was the incorporation of the control set from ISO 27002:2022 into Annex A of ISO 27001:2022. With ISO 27002:2022, there was a a significant revision of the set of information security controls with the previous 114 being reduced to 93. Of those 93 controls:
- 58 have been updated
- 24 controls represent merging of 57 of the previous controls
- 11 new controls have been introduced.
More information on ISO 27002:2022 can be found here.
A number of changes to the management system clauses were made in ISO/IEC 27001:2022 with the goal of making some of the requirements more explicit and improving the alignment with other Annex SL standards, such as ISO 9001 and ISO 22301, e.g. sub clause titles, terms and definitions.
We have just received the CE+ certificate and notification that we have passed; we wanted to thank our assessor for all his help with this. It is greatly appreciated. I know that our team is very grateful as they were expecting the process to be difficult. Instead of being difficult, URM’s assessor made it a smooth process and we have all learned a lot
Contact centre software provider
Thinking about ISO 27001 but unsure how your project should take shape?
We offer a free, no‑commitment call to help you clarify your certification pathway, understand the standard in the context of your business.
Find out more
related BLog
5 Must-Dos of Effective ISO 27001 Risk Management
Published on
7 Aug
2026
URM’s blog explores five key actions organisations can take to strengthen their ISO 27001 information risk management processes.
Read more
Information Security
Published on
7/8/2026
The Fundamentals of Risk Management in ISO 27001URM’s blog explains the risk management requirements in ISO 27001, including identifying ISMS risk, risk assessment and treatment, documentation and more
Read more
Information Security
Published on
4/8/2026
ISO 27001 Clause 10.2: Nonconformity and corrective actionURM’s blog explains how to meet ISO 27001 Clause 10.2, including finding nonconformities, performing root cause analysis, implementing corrective actions & more
Read more
Information Security
Published on
30/7/2026
ISO 27001 Clause 7.4: Communication URM’s blog explains ISO 27001 communications requirements, their links to interested parties, & how both can be addressed through a single framework.
Read more
"
From beginning to end URM made achieving PCI compliance incredibly easy & worked with us to educate us on the requirements. They were always available for a call whenever we needed to discuss queries along the way & were always flexible to our internal deadlines. We would highly recommend URM from a consultancy & auditing perspective.
contact US
Let us help you
Let us help you in your compliance journey by completing the form and letting us know how we can best support you.