# ISO/IEC 27001:2022 — overview

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_overview_iso27001-isoiec-270012022-overview
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [ISO/IEC 27001:2022](https://support.icompaas.com/support/solutions/c_gen_iso27001) › [Overview](https://support.icompaas.com/support/solutions/folders/f_gen_cgeniso27001_overview)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

ISO/IEC 27001:2022 · 93 Annex A controls + 10 management-system clauses

### What is it?

**ISO/IEC 27001:2022** is the international standard for an **Information Security Management System (ISMS)**. Unlike point-in-time security checklists, it certifies _how you manage_ information security risk: scope, leadership, planning, evaluation and continual improvement (clauses 4–10), backed by **93 Annex A controls** grouped into Organisational (37), People (8), Physical (14) and Technological (34).

### Who needs it?

Enterprises that sell to other enterprises almost always require their suppliers to be certified. ISO 27001 is also a prerequisite (or strong accelerator) for ISO 27701 (privacy), ISO 27017 (cloud) and ISO 42001 (AI).

### How is it structured?

-   **Clauses 4–10** — the ISMS itself. Mandatory.
-   **Annex A** — a control reference (93 controls). The _Statement of Applicability_ records which apply, which you've implemented, and why any are excluded.

### The 2022 update — what changed from 2013?

The control set was rationalised from 114 to 93, reorganised into 4 themes, with **11 new controls** reflecting modern stacks: _threat intelligence_, _information security for use of cloud services_, _ICT readiness for business continuity_, _physical security monitoring_, _configuration management_, _information deletion_, _data masking_, _data leakage prevention_, _monitoring activities_, _web filtering_, and _secure coding_.

### Certification path

A certification cycle is three years: **Stage 1** (documentation review) and **Stage 2** (implementation audit) for the initial certificate, then annual **surveillance audits**, with a full re-certification at year 3. Initial audits typically take 8–12 weeks of preparation for a mid-market SaaS.

### How iCompaas helps

iCompaas ships an ISO 27001:2022 ISMS template: scope statement, risk register, treatment plan, SoA, internal audit schedule and Mgmt review minutes. Annex A technical controls (A.5.7 Threat intelligence, A.5.23 Use of cloud services, A.8.16 Monitoring activities, A.8.28 Secure coding…) are continuously evaluated.