ISO 27001:2013 vs 2022: What Changed | Osto<\/title>\n<meta name=\"description\" content=\"ISO 27001:2013 vs 2022: what changed, why 114 controls became 93 across four themes, the 11 new controls, and what the transition means for your certification.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">ISO 27001:2013 vs 2022: what actually changed, why 114 controls became 93, the 11 new controls that matter most, and what it means if you are certifying now.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>7 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>The 2022 revision restructured Annex A: the 114 controls across 14 domains became 93 controls across four clean themes. Eleven entirely new controls were added, most reflecting the shift to cloud and modern development.<\/p>\n <p>The management clauses (4 to 10) changed only modestly. The 2013 version is now retired, so any new certification is against ISO 27001:2022. If you certify today, you simply start on the current version.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#why\">Why the update happened<\/a><\/li>\n <li><a href=\"#controls\">The controls restructure<\/a><\/li>\n <li><a href=\"#new\">The 11 new controls<\/a><\/li>\n <li><a href=\"#clauses\">What did not change much<\/a><\/li>\n <li><a href=\"#today\">What it means today<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"why\">ISO 27001:2013 vs 2022: why the update happened<\/h2>\n <p>The 2013 version was written for a different era of technology. Cloud had not yet become the default, modern software delivery looked different, and threats like large-scale data exfiltration were less central. The 2022 revision modernised the standard to reflect how organisations actually build and operate today, without changing its core philosophy of risk-based information security management.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The headline<\/div>The 2022 update is a modernisation, not a reinvention. The way ISO 27001 works, an ISMS driven by risk, is unchanged. What changed is the control set: fewer, better-organised controls, plus new ones for cloud and modern development.<\/div>\n\n <h2 class=\"sec\" id=\"controls\">The controls restructure<\/h2>\n <p>The most visible change is in <a href=\"https:\/\/www.osto.one\/resources\/glossary\/annex-a-controls\/\">Annex A<\/a>. The count dropped and the structure was simplified, mostly by merging overlapping controls rather than removing protection.<\/p>\n\n <div style=\"background:linear-gradient(180deg,#fbfcff,#f4f6ff);border:1px solid #e3e6f5;border-radius:18px;padding:30px 32px;margin:28px 0;box-shadow:0 8px 30px rgba(28,38,122,.07)\">\n <div style=\"font-size:11.5px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;color:#3a46c0;margin-bottom:6px\">The 2022 restructure<\/div>\n <div style=\"font-size:19px;font-weight:800;color:#0e1330;margin-bottom:22px\">What changed in the controls<\/div>\n <svg viewBox=\"0 0 700 170\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"ISO 27001 2013 to 2022 changes: 114 controls in 14 domains became 93 controls in 4 themes\">\n <g font-family=\"Inter,Arial,sans-serif\" text-anchor=\"middle\">\n <defs><marker id=\"a14\" markerWidth=\"11\" markerHeight=\"11\" refX=\"7\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L8 4 L0 8 Z\" fill=\"#9d97ff\"\/><\/marker><\/defs>\n \n <rect x=\"20\" y=\"30\" width=\"250\" height=\"110\" rx=\"16\" fill=\"#eef0ff\" stroke=\"#3a46c0\" stroke-width=\"2\"\/>\n <text x=\"145\" y=\"60\" font-size=\"14\" font-weight=\"800\" fill=\"#3a46c0\">ISO 27001:2013<\/text>\n <text x=\"145\" y=\"95\" font-size=\"30\" font-weight=\"800\" fill=\"#0e1330\">114 controls<\/text>\n <text x=\"145\" y=\"120\" font-size=\"13\" fill=\"#5b6178\">across 14 domains<\/text>\n \n <line x1=\"285\" y1=\"85\" x2=\"405\" y2=\"85\" stroke=\"#9d97ff\" stroke-width=\"3\" marker-end=\"url(#a14)\"\/>\n <text x=\"345\" y=\"74\" font-size=\"11\" font-weight=\"700\" fill=\"#5b52d6\">restructured<\/text>\n \n <rect x=\"430\" y=\"30\" width=\"250\" height=\"110\" rx=\"16\" fill=\"#e6f7f4\" stroke=\"#00c2a8\" stroke-width=\"2\"\/>\n <text x=\"555\" y=\"60\" font-size=\"14\" font-weight=\"800\" fill=\"#0a7a68\">ISO 27001:2022<\/text>\n <text x=\"555\" y=\"95\" font-size=\"30\" font-weight=\"800\" fill=\"#0e1330\">93 controls<\/text>\n <text x=\"555\" y=\"120\" font-size=\"13\" fill=\"#5b6178\">across 4 themes, 11 new<\/text>\n <\/g>\n <\/svg>\n<\/div>\n\n <p>The drop from 114 to 93 does not mean less security. Many controls were merged, several were updated, and eleven new ones were added. The old 14 domains became four clear themes: Organizational, People, Physical, and Technological.<\/p>\n\n <div class=\"otable\"><table class=\"regtable\">\n <tr><th>Aspect<\/th><th>ISO 27001:2013<\/th><th>ISO 27001:2022<\/th><\/tr>\n <tr><td><strong>Number of controls<\/strong><\/td><td>114<\/td><td>93<\/td><\/tr>\n <tr><td><strong>Structure<\/strong><\/td><td>14 domains<\/td><td>4 themes<\/td><\/tr>\n <tr><td><strong>New controls<\/strong><\/td><td>Baseline<\/td><td>11 added<\/td><\/tr>\n <tr><td><strong>Focus areas added<\/strong><\/td><td>Limited cloud coverage<\/td><td>Cloud, data leakage, secure coding<\/td><\/tr>\n <tr><td><strong>Status<\/strong><\/td><td>Retired<\/td><td>Current standard<\/td><\/tr>\n <\/table><\/div>\n\n <h2 class=\"sec\" id=\"new\">The 11 new controls that matter most<\/h2>\n <p>These additions are the clearest signal of what the update was for. For a modern SaaS company, several are likely to be highly relevant.<\/p>\n\n <div class=\"checkgrid\">\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">1<\/span><h4>Cloud and continuity<\/h4><\/div><ul><li>Threat intelligence (5.7)<\/li><li>Cloud services (5.23)<\/li><li>ICT readiness (5.30)<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">2<\/span><h4>Data and development<\/h4><\/div><ul><li>Data masking (8.11), leakage prevention (8.12)<\/li><li>Secure coding (8.28), configuration (8.9)<\/li><li>Information deletion (8.10), web filtering (8.23)<\/li><\/ul><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"clauses\">What did not change much<\/h2>\n <p>The management-system clauses, 4 through 10, saw only minor wording refinements. The requirements to define scope, show leadership, plan around risk, operate controls, evaluate performance, and improve remain the backbone of the standard. If you understood the 2013 clauses, the 2022 clauses will feel familiar.<\/p>\n\n <h2 class=\"sec\" id=\"today\">What it means if you are certifying today<\/h2>\n <p>The practical takeaway is simple. The 2013 version has been retired, so any new certification is against ISO 27001:2022. If you are starting now, there is no transition to manage, you build directly to the current standard. The only teams who had to actively transition were those already certified under 2013, and that window has passed.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">The one thing to get right<\/div>Because the new controls lean heavily toward cloud, data protection, and secure development, your certification now depends more than ever on real technical controls operating in those areas, not just documentation describing them.<\/div>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to the 2022 standard<\/h2>\n <p>The 2022 additions, cloud security, configuration management, data leakage prevention, secure coding, monitoring, are precisely the areas where a modern security platform does the heavy lifting. Meeting them with scattered tools is slow; meeting them from one place is straightforward.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. The new 2022 control areas, cloud posture, data leakage prevention, secure coding, configuration, and monitoring, run on one platform and map directly to ISO 27001:2022, with evidence collected from the same modules. That makes certifying against the current standard direct rather than a scramble across tools, which is why lean teams treat Osto as the default foundation for ISO 27001:2022.<\/div>\n\n <div class=\"callout\">\n <h3>Certify against the current standard, the direct way.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Run the cloud, data, and development controls ISO 27001:2022 emphasises, mapped to the standard automatically. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What changed between ISO 27001:2013 and 2022?<\/summary><p>Annex A was restructured: 114 controls across 14 domains became 93 controls across four themes, with 11 new controls added, mostly for cloud, data protection, and secure development. The management clauses (4 to 10) changed only slightly.<\/p><\/details>\n <details><summary>Why did the number of controls drop from 114 to 93?<\/summary><p>Not because protection was reduced. Many overlapping controls were merged and the structure simplified into four themes, while eleven new controls were added to reflect modern cloud and development practices.<\/p><\/details>\n <details><summary>What are the 11 new controls in ISO 27001:2022?<\/summary><p>Threat intelligence, cloud services, ICT readiness for continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding.<\/p><\/details>\n <details><summary>Is ISO 27001:2013 still valid?<\/summary><p>No. The 2013 version has been retired, and its certificates are no longer valid. Any new certification is against ISO 27001:2022, and organisations previously certified under 2013 needed to transition within the defined window, which has now passed.<\/p><\/details>\n <details><summary>If I certify now, which version do I use?<\/summary><p>ISO 27001:2022, the current standard. Starting fresh means there is no transition to manage; you build directly to the 2022 requirements and control set.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>ISO 27001:2013 vs 2022: What Changed | Osto ISO 27001:2013 vs 2022: what actually changed, why 114 controls became 93,\u2026<\/p>\n","protected":false},"author":8,"featured_media":782,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[297],"class_list":["post-781","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-iso-27001-2013-vs-2022"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/781","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=781"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/781\/revisions"}],"predecessor-version":[{"id":783,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/781\/revisions\/783"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/782"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=781"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=781"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=781"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":781,"date":"2026-08-16T19:42:10","date_gmt":"2026-08-16T19:42:10","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=781"},"modified":"2026-08-16T19:42:10","modified_gmt":"2026-08-16T19:42:10","slug":"iso-27001-2013-vs-2022","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/iso-27001-2013-vs-2022\/","title":{"rendered":"ISO 27001:2013 vs 2022: What Changed"},"content":{"rendered":"\n\n\n\n\n\nISO 27001:2013 vs 2022: What Changed | Osto<\/title>\n<meta name=\"description\" content=\"ISO 27001:2013 vs 2022: what changed, why 114 controls became 93 across four themes, the 11 new controls, and what the transition means for your certification.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">ISO 27001:2013 vs 2022: what actually changed, why 114 controls became 93, the 11 new controls that matter most, and what it means if you are certifying now.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>7 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>The 2022 revision restructured Annex A: the 114 controls across 14 domains became 93 controls across four clean themes. Eleven entirely new controls were added, most reflecting the shift to cloud and modern development.<\/p>\n <p>The management clauses (4 to 10) changed only modestly. The 2013 version is now retired, so any new certification is against ISO 27001:2022. If you certify today, you simply start on the current version.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#why\">Why the update happened<\/a><\/li>\n <li><a href=\"#controls\">The controls restructure<\/a><\/li>\n <li><a href=\"#new\">The 11 new controls<\/a><\/li>\n <li><a href=\"#clauses\">What did not change much<\/a><\/li>\n <li><a href=\"#today\">What it means today<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"why\">ISO 27001:2013 vs 2022: why the update happened<\/h2>\n <p>The 2013 version was written for a different era of technology. Cloud had not yet become the default, modern software delivery looked different, and threats like large-scale data exfiltration were less central. The 2022 revision modernised the standard to reflect how organisations actually build and operate today, without changing its core philosophy of risk-based information security management.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The headline<\/div>The 2022 update is a modernisation, not a reinvention. The way ISO 27001 works, an ISMS driven by risk, is unchanged. What changed is the control set: fewer, better-organised controls, plus new ones for cloud and modern development.<\/div>\n\n <h2 class=\"sec\" id=\"controls\">The controls restructure<\/h2>\n <p>The most visible change is in <a href=\"https:\/\/www.osto.one\/resources\/glossary\/annex-a-controls\/\">Annex A<\/a>. The count dropped and the structure was simplified, mostly by merging overlapping controls rather than removing protection.<\/p>\n\n <div style=\"background:linear-gradient(180deg,#fbfcff,#f4f6ff);border:1px solid #e3e6f5;border-radius:18px;padding:30px 32px;margin:28px 0;box-shadow:0 8px 30px rgba(28,38,122,.07)\">\n <div style=\"font-size:11.5px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;color:#3a46c0;margin-bottom:6px\">The 2022 restructure<\/div>\n <div style=\"font-size:19px;font-weight:800;color:#0e1330;margin-bottom:22px\">What changed in the controls<\/div>\n <svg viewBox=\"0 0 700 170\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"ISO 27001 2013 to 2022 changes: 114 controls in 14 domains became 93 controls in 4 themes\">\n <g font-family=\"Inter,Arial,sans-serif\" text-anchor=\"middle\">\n <defs><marker id=\"a14\" markerWidth=\"11\" markerHeight=\"11\" refX=\"7\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L8 4 L0 8 Z\" fill=\"#9d97ff\"\/><\/marker><\/defs>\n \n <rect x=\"20\" y=\"30\" width=\"250\" height=\"110\" rx=\"16\" fill=\"#eef0ff\" stroke=\"#3a46c0\" stroke-width=\"2\"\/>\n <text x=\"145\" y=\"60\" font-size=\"14\" font-weight=\"800\" fill=\"#3a46c0\">ISO 27001:2013<\/text>\n <text x=\"145\" y=\"95\" font-size=\"30\" font-weight=\"800\" fill=\"#0e1330\">114 controls<\/text>\n <text x=\"145\" y=\"120\" font-size=\"13\" fill=\"#5b6178\">across 14 domains<\/text>\n \n <line x1=\"285\" y1=\"85\" x2=\"405\" y2=\"85\" stroke=\"#9d97ff\" stroke-width=\"3\" marker-end=\"url(#a14)\"\/>\n <text x=\"345\" y=\"74\" font-size=\"11\" font-weight=\"700\" fill=\"#5b52d6\">restructured<\/text>\n \n <rect x=\"430\" y=\"30\" width=\"250\" height=\"110\" rx=\"16\" fill=\"#e6f7f4\" stroke=\"#00c2a8\" stroke-width=\"2\"\/>\n <text x=\"555\" y=\"60\" font-size=\"14\" font-weight=\"800\" fill=\"#0a7a68\">ISO 27001:2022<\/text>\n <text x=\"555\" y=\"95\" font-size=\"30\" font-weight=\"800\" fill=\"#0e1330\">93 controls<\/text>\n <text x=\"555\" y=\"120\" font-size=\"13\" fill=\"#5b6178\">across 4 themes, 11 new<\/text>\n <\/g>\n <\/svg>\n<\/div>\n\n <p>The drop from 114 to 93 does not mean less security. Many controls were merged, several were updated, and eleven new ones were added. The old 14 domains became four clear themes: Organizational, People, Physical, and Technological.<\/p>\n\n <div class=\"otable\"><table class=\"regtable\">\n <tr><th>Aspect<\/th><th>ISO 27001:2013<\/th><th>ISO 27001:2022<\/th><\/tr>\n <tr><td><strong>Number of controls<\/strong><\/td><td>114<\/td><td>93<\/td><\/tr>\n <tr><td><strong>Structure<\/strong><\/td><td>14 domains<\/td><td>4 themes<\/td><\/tr>\n <tr><td><strong>New controls<\/strong><\/td><td>Baseline<\/td><td>11 added<\/td><\/tr>\n <tr><td><strong>Focus areas added<\/strong><\/td><td>Limited cloud coverage<\/td><td>Cloud, data leakage, secure coding<\/td><\/tr>\n <tr><td><strong>Status<\/strong><\/td><td>Retired<\/td><td>Current standard<\/td><\/tr>\n <\/table><\/div>\n\n <h2 class=\"sec\" id=\"new\">The 11 new controls that matter most<\/h2>\n <p>These additions are the clearest signal of what the update was for. For a modern SaaS company, several are likely to be highly relevant.<\/p>\n\n <div class=\"checkgrid\">\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">1<\/span><h4>Cloud and continuity<\/h4><\/div><ul><li>Threat intelligence (5.7)<\/li><li>Cloud services (5.23)<\/li><li>ICT readiness (5.30)<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">2<\/span><h4>Data and development<\/h4><\/div><ul><li>Data masking (8.11), leakage prevention (8.12)<\/li><li>Secure coding (8.28), configuration (8.9)<\/li><li>Information deletion (8.10), web filtering (8.23)<\/li><\/ul><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"clauses\">What did not change much<\/h2>\n <p>The management-system clauses, 4 through 10, saw only minor wording refinements. The requirements to define scope, show leadership, plan around risk, operate controls, evaluate performance, and improve remain the backbone of the standard. If you understood the 2013 clauses, the 2022 clauses will feel familiar.<\/p>\n\n <h2 class=\"sec\" id=\"today\">What it means if you are certifying today<\/h2>\n <p>The practical takeaway is simple. The 2013 version has been retired, so any new certification is against ISO 27001:2022. If you are starting now, there is no transition to manage, you build directly to the current standard. The only teams who had to actively transition were those already certified under 2013, and that window has passed.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">The one thing to get right<\/div>Because the new controls lean heavily toward cloud, data protection, and secure development, your certification now depends more than ever on real technical controls operating in those areas, not just documentation describing them.<\/div>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to the 2022 standard<\/h2>\n <p>The 2022 additions, cloud security, configuration management, data leakage prevention, secure coding, monitoring, are precisely the areas where a modern security platform does the heavy lifting. Meeting them with scattered tools is slow; meeting them from one place is straightforward.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. The new 2022 control areas, cloud posture, data leakage prevention, secure coding, configuration, and monitoring, run on one platform and map directly to ISO 27001:2022, with evidence collected from the same modules. That makes certifying against the current standard direct rather than a scramble across tools, which is why lean teams treat Osto as the default foundation for ISO 27001:2022.<\/div>\n\n <div class=\"callout\">\n <h3>Certify against the current standard, the direct way.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Run the cloud, data, and development controls ISO 27001:2022 emphasises, mapped to the standard automatically. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What changed between ISO 27001:2013 and 2022?<\/summary><p>Annex A was restructured: 114 controls across 14 domains became 93 controls across four themes, with 11 new controls added, mostly for cloud, data protection, and secure development. The management clauses (4 to 10) changed only slightly.<\/p><\/details>\n <details><summary>Why did the number of controls drop from 114 to 93?<\/summary><p>Not because protection was reduced. Many overlapping controls were merged and the structure simplified into four themes, while eleven new controls were added to reflect modern cloud and development practices.<\/p><\/details>\n <details><summary>What are the 11 new controls in ISO 27001:2022?<\/summary><p>Threat intelligence, cloud services, ICT readiness for continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding.<\/p><\/details>\n <details><summary>Is ISO 27001:2013 still valid?<\/summary><p>No. The 2013 version has been retired, and its certificates are no longer valid. Any new certification is against ISO 27001:2022, and organisations previously certified under 2013 needed to transition within the defined window, which has now passed.<\/p><\/details>\n <details><summary>If I certify now, which version do I use?<\/summary><p>ISO 27001:2022, the current standard. Starting fresh means there is no transition to manage; you build directly to the 2022 requirements and control set.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>ISO 27001:2013 vs 2022: What Changed | Osto ISO 27001:2013 vs 2022: what actually changed, why 114 controls became 93,\u2026<\/p>\n","protected":false},"author":8,"featured_media":782,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[297],"class_list":["post-781","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-iso-27001-2013-vs-2022"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/781","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=781"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/781\/revisions"}],"predecessor-version":[{"id":783,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/781\/revisions\/783"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/782"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=781"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=781"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=781"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}