The transition era for ISO/IEC 27001 is officially concluded. The three-year transition period established by the International Accreditation Forum (IAF MD 26:2022) expired on 31 October 2025, invalidating legacy ISO/IEC 27001:2013 accredited certificates. Security teams are now focused on operational maintenance, annual surveillance audits, and continuous control evidence generation under the 2022 standard.
1. The Four Annex A Control Themes
Annex A structures its 93 controls across four objective themes. It is vital to distinguish Annex A controls from the core ISMS management requirements found in Clauses 4 through 10 (Context, Leadership, Planning, Support, Operation, Performance Evaluation, Improvement):
Organizational Controls (Annex A.5)
Policies for information security, internal roles, segregation of duties, supplier relationships, asset inventory, and threat intelligence processes.
People Controls (Annex A.6)
Screening, employment terms, security awareness training, disciplinary actions, remote working guidelines, and non-disclosure agreements.
Physical Controls (Annex A.7)
Physical security perimeters, entry controls, office security, environmental threat monitoring, clear desk/screen policies, and equipment maintenance.
Technological Controls (Annex A.8)
User endpoint devices, privileged access rights, secure authentication, capacity management, data leakage prevention, secure coding, web filtering, and cryptography.
2. Deep Dive: The 11 Controls Added in the 2022 Revision
The 11 controls introduced in the 2022 revision address modern technological realities, including cloud architectures, software supply chains, and threat analytics:
Threat Intelligence
Systematic collection and analysis of information relating to cyber threats to build situational awareness and inform defensive controls.
Information Security for Use of Cloud Services
Processes for acquiring, configuring, monitoring, and terminating third-party cloud services in line with organizational security requirements.
ICT Readiness for Business Continuity
Ensuring operational information and communication technology resilience based on business continuity objectives and recovery requirements.
Physical Security Monitoring
Continuous monitoring of physical perimeters and facilities using CCTV, intrusion alarms, and surveillance systems to detect unauthorized access.
Configuration Management
Establishing, documenting, monitoring, and enforcing security configuration baselines across hardware, operating systems, and cloud infrastructure.
Information Deletion
Secure deletion of data stored in information systems and storage media when no longer needed, respecting statutory retention limits.
Data Masking
Deploying pseudonymization, anonymization, and data obfuscation techniques in accordance with access control policies and data protection regulations.
Data Leakage Prevention (DLP)
Technical controls to monitor, detect, and restrict unauthorized exfiltration or transfer of sensitive data across endpoints and networks.
Monitoring Activities
Continuous network and host monitoring to detect anomalous behavioral patterns, evaluated against established security baselines.
Web Filtering
Restricting outbound access to unauthorized or malicious websites to prevent phishing payload downloads and command-and-control communication.
Secure Coding
Integrating secure development principles across the software engineering lifecycle, incorporating automated code analysis and component vulnerability reviews.
3. The Five-Attribute Metadata Matrix
ISO/IEC 27002:2022 equips each control with five operational metadata attributes, allowing organizations to cross-walk and filter controls dynamically:
- Control Type: #Preventive, #Detective, #Corrective
- Information Security Properties: #Confidentiality, #Integrity, #Availability
- Cybersecurity Concepts: #Identify, #Protect, #Detect, #Respond, #Recover (NIST CSF alignment)
- Operational Capabilities: #Governance, #AssetManagement, #ApplicationSecurity, #IdentityAndAccess, etc.
- Security Domains: #GovernanceAndEcosystem, #Protection, #Defense, #Resilience
4. Telemetry Boundaries vs. Procedural Evidence
A credible compliance architecture maintains clear boundaries between automated telemetry and procedural documentation:
- Automated Telemetry (Annex A.8): Configuration checks from identity providers and cloud environments can continuously verify technical controls such as MFA enforcement, encryption at rest, network segmentation, and configuration drift.
- Procedural & Physical Evidence (Annex A.5, A.6, A.7): Human resources screening, physical access badges, organizational policies, and executive review meetings cannot be proven via cloud API connectors. They require documented records, signed policies, and external auditor verification.
Recognizing this distinction ensures your Statement of Applicability (SoA) reflects operational reality without overstating the scope of automated compliance tooling.