The 2022 revision changes how controls are grouped, justified, and evidenced, so a legacy ISMS can look complete on paper but still fail against current expectations. The biggest practical issue is control mapping. Teams must realign policies, ownership, and risk treatment to the new structure before the transition deadline to avoid audit friction and certification delays.
Why This Matters for Security Teams
iso 27001:2022 is not a cosmetic update. It changes the control structure that auditors, internal assurance teams, and third-party assessors use to judge whether an isms is still coherent, current, and operating as intended. Organisations that keep older policy language, control names, and evidence sets often create a gap between what the ISMS claims and what the revised standard expects. That gap matters because certification readiness now depends on clear mapping, current risk treatment, and defensible implementation evidence, not just a mature-looking document set. The official ISO/IEC 27001:2022 Information Security Management standard makes this transition explicit, and the companion ISO/IEC 27002:2022 Information Security Controls guide shows how the control set was reorganised.
For security teams, the practical risk is not that a control disappears, but that ownership, scope, and justification become harder to defend when the ISMS still reflects the older structure. This affects remediation plans, internal audit cadence, supplier assurance, and the ability to show consistent control intent across business units. In practice, many security teams encounter the mismatch only after an audit review or certification gap has already exposed it, rather than through intentional transition planning.
How It Works in Practice
The 2022 revision reorganises Annex A into a smaller, more coherent control set with attributes that make controls easier to classify by theme, security objective, and implementation context. That is useful, but it also means an existing ISMS cannot simply rename a few policies and declare itself updated. Teams need to revisit the Statement of Applicability, map legacy controls to the revised structure, and confirm that evidence still proves both design and operational effectiveness.
In practice, the transition usually requires four linked tasks:
- Reconcile legacy controls against the 2022 control set and identify duplicates, merges, and renamed controls.
- Update the risk treatment plan so control selection and exclusions still match the current risk register.
- Refresh ownership, review frequency, and evidence expectations so operational teams know what must be demonstrated.
- Align internal audit and management review outputs with the revised control language to avoid inconsistent reporting.
That process is more than compliance housekeeping. It is how an organisation proves continuity of governance across a standard revision. Where relevant, the surrounding assurance model should also reflect how control changes affect supplier management, incident response, and technical monitoring, because ISO 27001 expects the ISMS to remain risk-driven rather than checklist-driven. Guidance from the standard body and the control companion should be used together so that policy text, control intent, and evidence all tell the same story. These controls tend to break down when multiple business units maintain their own spreadsheets or local control libraries because the mapping drift becomes invisible until the certification review.
Common Variations and Edge Cases
Tighter ISMS alignment often increases short-term workload, requiring organisations to balance audit certainty against transition effort. That tradeoff is especially visible in large enterprises, regulated sectors, and multi-entity groups where the legacy ISMS has grown through local exceptions rather than a single control model. Current guidance suggests treating the revision as a managed change programme, not a terminology update, but there is no universal standard for exactly how much evidence must be reworked before transition.
Some organisations will need a light mapping exercise if their documentation is already disciplined and centrally governed. Others will need a deeper redesign if the old ISMS mixes policy, standard, procedure, and control evidence into one layer. The most common edge cases are outsourced operations, inherited business units, and cloud-heavy environments where responsibility splits across internal teams and service providers. In those settings, control ownership can be clear in principle but weak in practice, especially when the SoA does not reflect how shared responsibility actually works.
ISO also leaves room for judgement, so the strongest approach is to document why each control was kept, changed, or retired, then make that rationale visible to auditors and operational owners. That is the difference between a transition that survives scrutiny and one that only looks complete in a policy archive.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS-Controls and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.PO-01 | Policy and governance updates are central to a controlled ISMS transition. |
| CIS-Controls | Control 6 | Access and governance controls often need remapping during ISO transition work. |
| NIST SP 800-53 Rev 5 | PM-9 | Security program governance supports structured control mapping and documentation. |
Refresh policies and governance records so the ISMS reflects current control intent and accountability.
Related resources from NHI Mgmt Group
- How should organisations prepare for ISO 27001:2022 certification if they rely on cloud access and admin credentials?
- Why does ISO/IEC 27001:2022 matter for IAM and NHI programmes?
- Why do organisations need more than evidence collection to satisfy ISO 27001:2022?
- Should organisations choose NIST CSF or ISO 27001 for NHI governance first?
