The release of ISO 27001:2022 introduced significant updates to the internationally recognised standard for information security management. While the core principles remain intact, the changes reflect the evolving threat landscape and the growing importance of aligning information security with modern-day risks and technologies.
If your business is already certified to ISO 27001:2013, the transition to the 2022 version might seem straightforward on paper — but many organisations are underestimating what’s actually involved.
In this blog, we break down the most common pitfalls companies face during the transition and how you can navigate them smoothly, efficiently, and with full compliance.
1. Underestimating the Scope of Change
One of the biggest mistakes companies make is assuming ISO 27001:2022 is just a minor update. While the management system structure remains similar, there are key changes that affect how your organisation approaches risk, controls, and evidence.
What’s changed?
- The number of Annex A controls has been reduced from 114 to 93, but grouped into four new themes: Organisational, People, Physical, and Technological.
- 11 new controls have been introduced (e.g. threat intelligence, data masking, and cloud services).
- The concept of “Attributes” was added to allow for more flexible categorisation and reporting.
Real-world example:
A mid-size SaaS company we worked with had assumed that their previous documentation would simply carry over. After a gap assessment, it became clear that over 30% of their controls needed to be revised or restructured — particularly in how they documented risk treatment and emerging technologies like cloud-based data storage.
Avoid this pitfall by conducting a detailed gap analysis early, mapping existing controls to the new structure, and understanding where your system may be misaligned.
2. Neglecting the New Controls
It’s easy to focus on what’s been removed or renamed, but failing to implement the 11 new controls can put your certification at risk. These new controls address modern security challenges and are not optional if they’re relevant to your risk landscape.
New controls include:
- Threat Intelligence
- Data Leakage Prevention
- Information Deletion
- Monitoring Activities
- Web Filtering
- Secure Coding
Real-world example:
An e-commerce retailer hadn’t considered “Threat Intelligence” relevant to their business until a phishing attack exposed customer data. During transition prep, they realised they lacked both a threat monitoring process and awareness training — putting them at risk of nonconformity.
How to avoid it: Don’t just tick boxes. Assess the applicability of each new control within your operational context. If it applies, you must implement it fully — and be prepared to demonstrate it during your audit.
3. Poorly Updated Statement of Applicability (SoA)
The Statement of Applicability is the backbone of ISO 27001. Yet many organisations treat it as a template document, rather than a live, evolving record of what controls apply — and why.
Under ISO 27001:2022, you need to revisit your SoA with a fresh lens, considering the revised Annex A and the rationale behind including or excluding each control.
Real-world example:
A logistics firm copied over their 2013 SoA and simply updated the formatting. During pre-audit review, it became clear they had missed entirely the new control on “Cloud Services” — even though a core part of their infrastructure had moved to AWS. That alone could have led to a major nonconformity.
Top tip: Redraft your SoA from the ground up. Don’t just update it — rethink it based on the new controls and your current operating environment.
4. Failing to Train Staff on the Changes
Your system is only as strong as the people using it. Many companies neglect to update staff awareness or training programmes to reflect the new version of the standard.
This leads to inconsistent implementation, confusion during audits, and a false sense of compliance.
Real-world example:
A professional services firm had updated their documentation but hadn’t briefed staff on the new responsibilities. During an audit, key team members were unaware of new monitoring procedures and reporting responsibilities, leading to a series of observations.
Solution: Include ISO 27001:2022 updates in your training plan. Run awareness sessions, especially for departments like IT, HR, and security. Update induction materials and team procedures to reflect any changes in how controls are applied.
5. Leaving It Too Late
The transition deadline for ISO 27001:2022 is 31 October 2025 — but don’t let that fool you into thinking there’s time to spare. Certification bodies are already seeing an influx of transition requests, and leaving it late could delay your audit or even risk a gap in certification.
Transitioning takes planning, evidence gathering, documentation updates, internal audits, and management review — all before your external audit can take place.
What you should do now:
- Book your transition audit well in advance
- Plan internal audits against the 2022 standard
- Update your risk assessments and SoA
- Brief your leadership and key personnel
- Get support if you’re unsure where to start
Need Help Transitioning to ISO 27001:2022? We’ve Got You Covered
At WHG, we make transitioning to ISO 27001:2022 clear, efficient, and fully supported. Whether you need a full system review, help updating your SoA, or just a sanity check before your audit — our team of experienced consultants can guide you through it all.
We’ve helped businesses of all sizes make the switch smoothly — with zero disruption and full confidence on audit day.
Ready to get started? Let’s talk.
Email phil@whginfo.co.uk to book your ISO 27001:2022 transition support.
Talk to WHG
Practical, defence-aware support across ISO, Def Stan and cyber compliance.
