ISO 27001:2022 FDIS — Changes presented in August 2022

Archive from 2022. Editions, transition dates, figures and lists reflect the original article. For current implementation, check the documents presently in force.

Main changes presented for ISO 27001:2022

• The original FDIS overview described the main requirements in clauses 4–10 as unchanged.
• It stated that the update focused on the information security controls listed in Annex A.
• The number of controls decreased from 114 to 93.
• The controls were grouped into four sections rather than the previous 14.
• There were 11 new controls; existing controls were retained or consolidated rather than simply deleted.

The 93 controls were distributed across four themes:

• Clause 5 — Organisational controls, where not otherwise classified: 37 controls.
• Clause 6 — People controls, relating to people: 8 controls.
• Clause 7 — Physical controls, relating to physical objects: 14 controls.
• Clause 8 — Technological controls, relating to technology: 34 controls.

Compiled and updated by the consulting and training team

• Consultant and trainer Pham Xuan Canh and ITVC Global’s consulting team.

Download the reference document

Main changes in ISO 27001:2022 FDIS