25
October 2022

ISO/IEC 27001:2022 Published on 25 October

On 25 October 2022, the International Organization for Standardization published the latest version of ISO 27001 and updated its title to ‘Information security, cybersecurity and privacy protection — Information security management systems — Requirements’.  In line with its title, this latest version of ISO 27001 reflects a broader context and that preventing, detecting and responding to cyberattacks is now considered, as well as protecting information and data.

The 2022 version of the Standard provides the updated requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS) within the context of your organisation.

What are the key changes?

The major change to the Standard has been the incorporation of the control set from ISO 27002:2022 into Annex A of ISO 27001:2022.  Naturally, threats change over time and the new Annex A controls reflect some of the threats that have emerged since the 2013 version was published, e.g., the increasing range of cyber-related threats and moves towards home and remote working.

There have also been a number of changes to the management system clauses, with the goal of making some of the requirements more explicit and improving the alignment (structure, terms and definitions) with other Annex SL standards, such as ISO 9001 and ISO 22301.

How URM can help

URM is ideally placed to help organisations certify against the updated Standard.  Should you already be certified to ISO 27001:2013, we can provide you with the following practical support to help you quickly and seamlessly transition to the 2022 version of the Standard:

Not certified?

If you are not certified, now has never been a better time to develop an information security management system and achieve certification. If you would like to understand more about the benefits and what’s involved in implementing ISO 27001, please register your interest here and we will be in touch.

Cyber Essentials Questions Answered: Technical Requirements, BYOD Compliance and the Future of the Scheme

Latest update:
1 May
2025

URM’s blog answers key questions about CE, focusing specifically on its technical requirements, use of BYOD, and how the scheme may change in the future.

Read more
Thumbnail of the Blog Illustration
Information Security
updateD:
25/4/2025
Quantum Computing – the Risks to Encryption and the Implications for PCI DSS

URM’s blog explains the threat quantum computing poses to current encryption methods, how this may impact the PCI DSS, and how these challenges may be overcome.

Read more
Thumbnail of the Blog Illustration
Data Protection
updateD:
17/4/2025
Are you Processing Special Category Personal Data Without Knowing It?

URM’s blog breaks down the GDPR requirements around special category personal data and how organisations can avoid processing this data inadvertently.

Read more
Thumbnail of the Blog Illustration
Cyber Security
updateD:
17/4/2025
Cyber Security and Resilience Bill Policy Statement – What to Expect

URM’s blog explains the measures the Bill will introduce, the entities it will bring into regulatory scope & what the Bill could mean for your organisation.

Read more
"
I am pleased to recognise the work of the URM internal auditor we have worked. Throughout all the audits carried out, he has consistently demonstrated professionalism, diligence, and a commitment to excellence in every task undertaken. Thanks to his efforts, we have achieved a very successful first stage ISO 27001:2022 certification audit, with zero findings noted, which has positioned us on track for the second stage audit and for long-term success.
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.